How IHRP Secured Their Azure Environment and Migrated Their Entire Codebase to GitLab

LocationSingapore

SolutionAzure Security Review & GitLab Migration

Days to full migration

Zero

Security incidents post-migration

100%

Codebase transferred to GitLab

At-a-Glance

IHRP (Institute for Human Resource Professionals), Singapore's national HR certification body governing professional standards for HR practitioners.

Case Study

CHALLENGE:

Active vulnerabilities in the Azure environment combined with a fragmented, unversioned codebase that blocked collaboration and audit readiness.

SOLUTION:

Intelegain executed a two-track programme: a full Azure Security Review with remediation, and a GitLab server deployment on an Azure VM with RBAC, secure networking, and complete code migration.

RESULTS:

45-day end-to-end delivery, zero security incidents post-migration, 100% codebase transferred with full integrity validated.

The Challenge: Before Intelegain

IHRP operates Singapore's national HR certification framework, meaning their systems sit at the intersection of professional credentialing data, membership records, and regulatory compliance obligations. When their internal audit flagged gaps in their Azure posture, the exposure was not theoretical — it was a direct risk to member data and institutional trust.

At the same time, their development team was working without a centralised version control system. Code lived across individual machines and shared network drives. There was no audit trail for changes, no branching strategy, and no mechanism to enforce peer review before code went live. A single developer machine failure could mean permanent loss of critical application logic.

Identified Azure vulnerabilities:

Misconfigured network security groups, overly permissive role assignments, and unencrypted data-at-rest endpoints were flagged during the initial assessment.

No centralised source control:

Developers had no shared repository, making collaboration dependent on manual file transfers and informal version naming conventions like "final_v3_REAL.zip".

Compliance risk:

Without access logs and change tracking, IHRP could not demonstrate the chain of custody required under Singapore's Personal Data Protection Act (PDPA) obligations.

Delayed incident response:

Without proactive monitoring tied to a consistent codebase, the team had no structured way to correlate code changes with production issues.

Why IHRP Chose Intelegain

IHRP evaluated several IT service providers before awarding the engagement. Three factors drove the decision in Intelegain's favour:

Azure-native security expertise:

Intelegain's team holds hands-on experience with Microsoft's Cloud Adoption Framework and Azure Security Benchmark, giving IHRP confidence that the review would go beyond a checklist and surface actionable remediation paths.

Integrated delivery model:

Rather than treating the security review and GitLab migration as separate workstreams requiring separate vendors, Intelegain proposed a single coordinated programme — reducing handoff risk and making the 45-day commitment credible.

Singapore data residency expertise:

Intelegain demonstrated familiarity with PDPA requirements and Azure's Singapore region capabilities — a non-negotiable for an organisation handling member professional credentials.

Implementation: The Intelegain Approach

The engagement ran across two parallel tracks, sequenced carefully to avoid blocking either workstream. Security hardening had to progress far enough before the GitLab VM was provisioned — there was no value in deploying a new server into a vulnerable network segment. Both tracks closed within the 45-day window.

Phase 1: Azure Security Review & Remediation

Intelegain conducted a comprehensive assessment of IHRP's existing Azure environment. This covered Identity & Access Management configurations, Network Security Group rule sets, storage account access policies, and Key Vault configurations. Each identified vulnerability was documented with a severity rating and a specific remediation action. High-severity items — including overly broad Contributor role assignments and publicly accessible storage blobs — were remediated immediately. Medium findings were resolved within the same phase. The team applied least-privilege principles across all service principals and managed identities, eliminating standing access that had accumulated over time without structured review.

Phase 2: GitLab Server Deployment on Azure VM

With the network security posture hardened, Intelegain provisioned a dedicated Azure Virtual Machine sized for GitLab's operational requirements. The VM was placed in a private subnet with NSG rules restricting inbound access to approved IP ranges — SSH on port 22 was locked to the Intelegain management IP and IHRP's internal network gateway. GitLab CE was installed, configured with HTTPS via a valid SSL certificate, and optimised for the team size and concurrent user load. RBAC within GitLab was structured to mirror organisational hierarchy: Maintainer access for senior developers, Developer access for active contributors, and Reporter access for business stakeholders needing read-only visibility.

Phase 3: Code Migration & Handover

The migration of the existing codebase was executed in batches. Each repository was initialised, historical commits were reconstructed where source files permitted, and branches were mapped to GitLab's project structure. Post-migration validation confirmed file integrity across all transferred repositories. A sample CI pipeline was executed to verify that the code functioned correctly in the new environment. A structured handover session covered GitLab workflows, merge request procedures, and Azure Monitor alerts configured to flag VM health anomalies and GitLab service interruptions in real time.

Microsoft AzureAzure Virtual MachinesAzure NSG & RBACGitLab CEAzure MonitorAzure Key VaultSSL/TLS Configuration