Keyless by default
SQL, blob storage, Redis and telemetry authenticate with managed identity. SQL runs Entra ID-only authentication; storage shared keys are switched off.
Service
DevOps and DevSecOps for Umbraco
Crumpled Dog builds, deploys and runs Umbraco with DevOps that is repeatable and security designed in from the start: CI/CD pipelines, infrastructure as code, keyless identity, private networking and audited operations. We specialise in Microsoft Azure, powered by our own Umbraco Hosting Kit and StrongArm templates, and also deliver on Umbraco Cloud and other hosting platforms.
Why do Umbraco sites fail security reviews?
Usually not because of Umbraco itself, but because of how it is hosted: connection strings with passwords in config files, databases reachable from the internet, shared admin accounts, hand-built servers nobody can reproduce, and monitoring nobody checks.
Our DevSecOps service removes each of those, and gives your risk and IT teams the evidence to prove it.
Looking for Umbraco DevOps rather than a security review?
The same foundation serves both. If what you need is reliable Umbraco DevOps, with automated builds and deployments, identical environments, safe releases and a team that is not nervous on release day, that is exactly what the work below delivers, with security built in rather than bolted on afterwards.
What is included in Umbraco DevSecOps?
Private by design
VNet integration with private endpoints for SQL, Redis, Key Vault, storage and search. Default-deny network rules everywhere.
Secrets stay in the vault
Azure Key Vault with RBAC and purge protection. Developers load secrets at runtime, so nothing sits in source control or local config files.
Infrastructure as code
Every environment defined in Bicep with StrongArm. Each change runs a what-if preview and validation before it is applied.
Safe releases
GitHub Actions deploy with OIDC federated credentials, so there are no stored deploy secrets, to a staging slot, then swap live with instant rollback.
Proven monitoring
Availability tests with alerts, plus health checks that confirm logging is actually arriving, not just configured.
Least privilege in the CMS
Developer settings hidden on live sites, with time-limited elevation for named super-admins and an audit trail of operational actions.
Controlled change windows
Scheduled maintenance mode with countdowns and editor announcements, and automatic alerts when a health check fails.
How it works
-
Assess
Review your current hosting, access and release process against our baseline.
-
Codify
Define every environment in StrongArm Bicep templates, in your Azure tenant.
-
Secure identity
Replace passwords with managed identity, Key Vault and Entra ID single sign-on.
-
Deploy
OIDC pipelines, staging slots and post-deploy health checks on the live site.
-
Operate
Run it with the Hosting Kit dashboard, alerts and planned Umbraco upgrades.
Products that support this service
DevSecOps for Umbraco case studies
-
-
-
-
-
-
DevOps and DevSecOps questions
What is DevSecOps for Umbraco?
It means treating security as part of how an Umbraco site is built, released and run, not a check at the end. Hosting is defined as code, access uses identities instead of passwords, and every release is repeatable and reversible.
Does it run in our own Azure subscription?
Yes. Environments are deployed into your own Azure tenant, so you keep ownership of the infrastructure, the data and the audit trail.
Do you only work with Azure?
No. Azure is where our own tooling goes deepest, but we also run Umbraco securely on Umbraco Cloud and other hosting platforms, applying the same principles: codified environments, least-privilege access, no secrets in code and repeatable releases.
Can you take over an existing Umbraco site?
Yes. We start with an assessment, then move the site onto codified infrastructure, often alongside an upgrade to Umbraco 17 LTS.
Is the Umbraco Hosting Kit open source?
No. The Umbraco Hosting Kit, including StrongArm, is Crumpled Dog's own commercial tooling, and its licence is included in our support agreements. Our open-source Umbraco packages are listed on the Products and Packages page.
Do you provide Umbraco DevOps without a security review?
Yes. Many clients simply want reliable Umbraco DevOps: automated builds and deployments, repeatable environments and releases that no longer depend on one person. It is the same approach, and the security controls come with it rather than being a separate project.
Can you set up CI/CD for Umbraco?
Yes. We build GitHub Actions pipelines that build, test and deploy Umbraco to a staging slot, check the live site is healthy, and then swap it live with instant rollback. Pipelines authenticate with OIDC federated credentials, so no deploy secrets are stored.
How do changes move between environments?
Infrastructure is defined in Bicep and applied the same way to every environment. Schema and settings move with uSync, content can be moved between environments with uSync Publisher, and each release goes through the same pipeline from development to production.
Security review
Find out how your Umbraco hosting measures up
A fixed-scope review of your hosting, access and release process. Tell us about your setup and we will reply within one working day.