A path for the incidents your own team cannot close.

The escalation model

1. Intake: the issue arrives with what has been tried and what evidence exists. We agree severity and an initial response window.
2. Evidence: logs, captures, configuration state and change history are gathered before theories are tested.
3. Senior triage: an engineer decides which domains are involved and pulls in the depth needed across them.
4. Investigation: hypotheses are proven or eliminated with evidence, across boundaries, until the cause is isolated.
5. Remediation: a permanent fix, applied through change control and verified, with any interim mitigation clearly labelled as temporary.
6. Root cause and knowledge transfer: a written cause, the detection that would have caught it, and a session so your team can handle the next one.

What typically gets escalated

• Authentication and Conditional Access failures that only affect some users or locations
• Hybrid connectivity and DNS faults across VPN, ExpressRoute and site networks
• Azure platform behaviour that differs from documentation: throttling, routing, private endpoint resolution
• Certificate, PKI and federation problems with wide blast radius
• Post-change regressions where the change and the symptom are in different teams

Who owns what

Your team keeps first-line handling and the business relationship. North Ark owns the investigation and the engineering fix once an issue is escalated, and your team sees the evidence and reasoning throughout. The split for your organisation is agreed in writing under Managed Engineering.