A Sovereign Azure Foundation for Switzerland’s Healthcare Digital Transformation
Built from zero for the Swiss Federal Office of Public Health – multi-region, fully governed, entirely as code.
Client
Federal Office of Public Health (BAG / FOPH)
Industry
Swiss Federal Office of Public Health
Environment
Microsoft Azure, Switzerland North & West
Challenge
Cloud Foundations from scratch
Timeline
September 2024 – ongoing
The Client
Federal Office of Public Health
BAG is the Swiss federal authority responsible for public health policy, and one of the lead organisations behind DigiSanté, the federal programme modernising the Swiss healthcare data ecosystem.
It operates in one of the most heavily regulated environments in the country. The mandate was to design and deliver, from scratch, a sovereign Azure Foundations able to host a growing portfolio of healthcare applications under strict data residency, security, audit and compliance requirements.
The Challenge
No Platform, No Governance, No Patterns
Swiss Data Resistency
Data and workloads had to remain inside Switzerland, end-to-end.
Federal Compliance
Security and compliance expectations had to be met from day one.
Many Teams, One Platform
Multiple aplication teams needed a consistent, predictable place to land.
Scale Without Sprawl
The design had to hold a large estate of subscriptions and stay manageable.
The Delivery
In Numbers
0
Azure regions covered (Switzerland North & Switzerland West)
>100
Azure subscriptions under a governed, multi-tier landing zone.
~ 0.5h
For new application infrastructure to be deployment-ready.
~ 100%
Of infrastructure managed as code with Terraform.
In Technology
Microsoft Azure
Terraform
GitHub
Azure Container Apps
Microsoft for PostgreSQL
Microsoft Defender
In Detail
Sovereightly by Construction
Workloads, telemetry, secrets, keys and backups stay in Switzerland. Data residency was the starting constraint, not a retrofit.
Platform Thinking from Day One
Shared platform subscriptions for connectivity, identity, security and observability, plus a spoke pattern any team can drop into.
Everything as Code
Terraform is the only way infrastructure changes. GitHub is the source of truth, and OIDC federation removes long-lived credentials.
Governance
- Stakeholders and decision rights agreed
- Scope and timeline you can put to a board
- Access and ways of working in place
Network
- Multi-region hub-and-spoke on Azure Virtual WAN, hubs in both Swiss regions
- Azure Firewall in each hub for centralized egress and inspection
- Application Gateway with WAF and Traffic Manager in front of public workloads
Application Platform
- Azure Container Apps as the standardized runtime
- Container Registry with immutable image versioning
- A reusable landing zone template: network, identity, secrets, logging, pipeline
Identity & Secrets
- Entra ID-integrated RBAC with least-privilege defaults
- Managed identities instead of long-lived service principals
- Key Vault for secrets, certificates and customer-managed keys
Observability
- Central Log Analytics workspace across platform, network and applications
- Microsoft Sentinel for SIEM, detection and audit
- Defender for Cloud with a defined remediation workflow
Enablement
- Reusable Terraform module library for common workload shapes
- Standard GitHub Actions CI/CD template with OIDC to Azure
- Pairing with application teams on their first deployments
The Outcome
From Zero to a Sovereign Multi-Region Infrastructure in a Year
BAG now runs a growing portfolio of healthcare digital services on a platform its own teams can extend safely. Every change is code-reviewed, version-controlled and policy-enforced.
Speed
New workloads onboard in minutes, because the spoke, networking, identity and pipelines already exist.
Audit
Infrastructure changes flow through pull requests and pipelines instead of manual portal work.
Focus
Application teams build healthcare services instead of rebuilding cloud foundations.
Trust
Data stays in Switzerland and the security posture is built into the platform, not bolted on.
The Client Reference
“Working with you was always a pleasure, both professionally and personally. rnIf I had to point to one specific example, I’d mention your flexibility and professionalism during the HSM implementation. But really, it’s the sum of everything that made the collaboration so valuable, including your willingness to regularly step into the support role. rnI would recommend you without hesitation and would welcome you back to the team anytime. rnThank you so much for your invaluable contribution to the BAG System Team!”
