Architecture of RES observability for Corporate Mobility
Smart correlation between Device, Network, Identity and Application
The Challenge
Critical issues in the current model
Data Fragmentation
Isolated signals in Intune, Enter ID, Cisco VPN and Salesforce without deterministic correlation
Reactive Operation
Incidents identified only by user tickets, increasing impact and response time
High MTTR
Slow diagnosis for context exchange between multiple consoles without unified view
Lack of Correlation
Impossibility to Track Journey Device → Network → Identity → Application
Video Summary
Understand the solution in a few minutes
The Solution
Unified observability platform with SRE
Unified Platform
Datadog Telemetry Center with Azure-native (Event Hubs, Functions, Container Apps)
SCEP Deterministic Correlation
Identity Stitching via IntuneDeviceId in the SAN certificate, eliminating ambiguity between VPN and MDM
SLOs and Error Budget
SRE governance with user-oriented SLIs, Burn Rate Alerts and impact-based automation
Privacy by Design
LGPD input protection with Sensitive Data Scanner, irreversible hashing and granular RBAC
Technical Architecture
4 layers intelligent processing
Ingestion
Resilient telemetry capture with replay and insulation
- Azure Event Hubs with Geo-Disaster Recovery
- Diagnostic Settings (Intune/Entra) with replay retention
- Azure Container Apps with self-scaling KEDA (backlog-driven)
Enrichment
Inventory and business context efficiently
- Microsoft Graph Delta Queries (90% overhead reduction)
- Auto Fallback for full sync in case of expiration (410 Gone)
- Reference Tables (department, region, VIP status, cost center)
Correlation
Identity Stitching deterministic without ambiguity
- IntuneDeviceId injected into the SAN of the SCEP certificate (URI)
- Cisco ASA extracts GUID via Regex and map for session attribute
- Join confidence (high/medium/low) for diagnostic quality
Automation
Intelligent Remediation and Integration ITSM
- Logic Apps for auto-healing (remote sync, user notification)
- Creation/update of incidents with correlated evidence
- Default scenario runbooks (stale device, regional VPN)
Model SRE
SLIs, SLOs and Error Budget for reliability governance
Fleet Compliance Health
≥95%Devices in compliance vs. active fleet (tri-valued state: Healthy/Unknown/Down)
VPN Availability
≥99%VPN success rate with documented exclusions (wrong password, expired cert)
Salesforce Access
≥99.5%Success of authentication and use of critical business application
Pipeline Freshness
P95 <15minEnd-to-end intake latency (source → Datadog) to ensure SLI quality
Burn Rate Alerts
Fast Burn
Accelerated Error Budget consumption indicates severe incident ongoing. It requires immediate action and scheduling.
Slow Burn
Gradual degradation detected. A sign of a negative trend that allows preventive action before critical impact.
Technical Differences
Unique capabilities of the solution
Identity Stitching SCEP
deterministic correlation via IntuneDeviceId in the certificate SAN, eliminating IP/user ambiguity
Tri-valued State
Healthy/Unknown/Down absorbs uncertainty from the Twelve Mode without inflating false positives
Privacy by Design
Sensitive Data Scanner with hashing/redation in input, granular RBAC and LGPD audit
Logs-to-Metrics
Aggregation for SLIs/trends with gross log disposal, reducing cost without losing visibility
Flex Logs
Economic retention for low access logs ( Forensic/audit investigation)
Managed Identity
Static Keyless Authentication (Key Vault, Event Hub, Graph API) with automatic rotation
FinOps Governance
Operational sustainability and cost optimization
Ingestion Reduction
Delta Queries (Graph API) reduce overhead by 90%+ v. full recurrent scans
Hot vs Cold Logs
Selective index: indexed critical (research); volumetric (successes) in Flex Logs
Cardinality Guardrails
Tag policies, volume alarms and limits to prevent cardinality explosion
Cost Optimization
Complete Documentation
Access executive presentation and detailed technical documentation
37 pages of detailed technical architecture
Includes code, diagrams and runbooks
In short
SRE observability for corporate mobility
An architecture of end-to-end observability for fleets of corporate devices, uniting Datadog, Azure and Android Enterprise to transform an opaque fleet into actionable telemetry — and reduce time for detection and problem solving in the field.
- End-to-end visibility — from device to cloud, in one vision.
- Datadog — correlated metrics, logs and strokes.
- Azure + Android Enterprise — identity, management (MDM) and fleet telemetry.
- Lower MTTR — detect and resolve before the impact on the user.
Frequently Asked Questions
Frequently Asked Questions
What is RES observability for corporate mobility?
It is the ability to see, from end to end, the health of a fleet of corporate devices — from device to cloud — with correlated metrics, logs and dashes. The goal is to detect and solve problems in the field before they affect the user.
Why Datadog, Azure and Android Enterprise together?
Datadog correlates metrics, logs and strokes; Azure provides identity and backend; Android Enterprise manages the fleet (MDM) and exposes device telemetry. Integrated, give a unique and actionable view of the fleet.
What result does architecture deliver?
Reduction of detection time and resolution (MTTR) of incidents in the field, fewer blind spots in the fleet and operational decisions based on real telemetry rather than assumption.