Platform choice is settled. Governance is what decides which initiatives get funded.

Governance and risk management on Microsoft Azure in Australian government.

Most Australian government agencies now run Azure, Microsoft 365 and Dynamics as standard infrastructure rather than as a project. The Digital Transformation Agency’s new five-year whole-of-Australian-Government agreement with Microsoft commenced on 1 July 2026, and Microsoft has committed A$25 billion to Australian AI infrastructure, cybersecurity and skills by 2029. The platform question is closed. What remains open is what it costs, how it is governed, and whether either answer can be defended to Finance, to an auditor, or to a minister.

Macquarie Government has launched a Microsoft Azure cloud, security and AI practice built for federal and state agencies. It extends a managed Azure model Macquarie Cloud Services has run for Australian businesses for seven years, as one of four sovereign Azure Expert MSPs in Australia, into an organisation that already provides cyber security services to 42 per cent of Federal Government agencies. Independent research across a representative cross-section of federal and state agencies this year surfaced four conversations happening in almost every one of them. This piece takes the second.

Why it is on the agenda?

Platform choice is largely settled, so governance and operability are what now decide which initiatives get funded. Funding is released where an agency can align an initiative to an existing governance model and defend the decision to auditors, central agencies and ministers. Sovereignty, data location, control ownership and failure scenarios have to be explicit, and ambiguity about who owns risk consistently kills momentum faster than any technical objection.

The problem.

The gap is rarely intent. It is evidence. Azure Policy estates drift, diagnostic logging is enabled inconsistently so the audit trail has holes exactly where it is needed, secure-score movement is not attributed to anyone, and privileged access accumulates: standing Owner assignments and root-scope User Access Administrator roles that no one has reviewed in a year. None of it is visible until an assessment, an incident or an audit surfaces it.

“Every control in our baseline is on by default, and every exemption is a decision the agency makes on the record. We’re not overruling anyone’s architects. We’re making sure that when something gets turned off, it’s a choice with a name against it rather than a gap nobody noticed for a year.”

What the wider evidence says.

Governance, risk and compliance is the highest-ranked investment priority for Australian government leaders over the next 12 months in ADAPT’s Government Edge research, nominated by 57 per cent, ahead of cyber security skills and awareness, application security, cloud security and data governance. In the same body of research, ensuring governance and compliance ranks ninth of ten organisational goals for the year. Governance is funded more readily than it is owned, which is close to how it behaves inside most estates.

Three further findings describe the operating reality. Only 19 per cent of agencies have automated policy enforcement for data and AI workloads. Manual approvals add an average of eight to twelve weeks to cross-agency initiatives. And 58 per cent of agencies have built bespoke assurance frameworks for data and AI that duplicate controls already present elsewhere in government, with fewer than one in four willing to accept another agency’s risk assessment without re-validating it.

Read together, those numbers describe a system doing governance by hand and doing it more than once. “Most agencies don’t have a governance intent problem, they have an evidence problem. Our baseline enforces diagnostic logging and a year of retention from day one, so when the auditor asks, your team is retrieving a record instead of reconstructing one.

What a defensible baseline looks like.

The most useful shift an agency can make is to stop treating governance as a set of things to check and start treating it as a set of things that are on unless somebody formally turns them off.

On by default, off only by recorded exemption. Endpoint and workload protection deployed across supported resource types. Diagnostic logging enabled on all resources, with retention set to a published standard rather than to whatever the default was, because the audit trail has to exist before the incident that needs it. Multi-user authorisation on backup and recovery vaults. Monitoring agents present everywhere rather than everywhere anyone remembered. A tagging regime that makes financial and inventory views resolvable by application, environment and owner, which is also the control that makes cloud cost defensible.

Benchmarked against a standard the agency did not write. The CIS Microsoft Azure Foundations Benchmark exists, it is public, it has Level 1 and Level 2 profiles, and assessing against it produces a posture score that is comparable across agencies and legible to an auditor. Given that 58 per cent of agencies are duplicating assurance work with bespoke frameworks, adopting a published benchmark is the cheapest available reduction in effort. A bespoke framework has to be defended before its findings can be discussed. A published one does not.

A remediation model with the decision left in the agency’s hands. Findings should be triaged into what can be remediated automatically, what needs an engineer working alongside the agency, and what needs a decision before anything is touched. The agency decides what gets fixed and what gets exempted. Exemptions are a decision made on the record, not a gap that quietly appears.

Controls that scale with classification, not a single blanket standard. For classified and sensitive workloads the control set tightens rather than changes shape: customer-managed keys, hardware security module custody, private endpoints, restricted public network access, and encryption in transit, at rest and in use. Applying that standard to everything is expensive and slow. Applying it to nothing is indefensible. Tiering it by classification is the only approach that survives both a budget review and an accreditation.

Who owns what.

Co-managed rather than outsourced is the model that works in government, and it should be stated plainly at the start of any engagement rather than discovered halfway through one.

The agency keeps architecture authority, accreditation, risk ownership and the authority to operate. None of that transfers when delivery is externalised, and no provider should imply otherwise. What a provider can genuinely take on is making the controls real and keeping them that way: enforcing the baseline, evidencing it continuously, and surfacing drift while it is still cheap to correct. Fully managed models earn their place where risk transfer is explicit and bounded, and cause trouble everywhere else.

Done properly, audit evidence stops being an annual assembly exercise and becomes a by-product of running the environment. That is the difference between an agency that can move when funding appears and one that spends eight to twelve weeks proving it should be allowed to.

Where to start.

Governance work is hard to fund because the gap is invisible until something forces it into view. An assessment is the most efficient way to make it visible on the agency’s own terms rather than an auditor’s.

A Macquarie Lens assessment is read-only, agentless, makes no production change and takes days rather than weeks. It runs several hundred checks across every subscription, mapped to Microsoft’s Cloud Adoption and Well-Architected Frameworks, and returns a prioritised findings register across governance, identity, security, reliability, cost and operations, including the policy drift, logging gaps and standing privileged access that rarely surface any other way. It is done onshore. The agency decides what gets remediated and what gets exempted.

That is the honest starting point for this conversation. Talk to us