I think a good start is to have a VPN. Only within the VPN developers are able/allowed to communicate with the INTERNAL parts of your cloud for things like test

I think a good start is to have a VPN. Only within the VPN developers are able/allowed to communicate with the INTERNAL parts of your cloud for things like test, staging environment, databases and so on. I don't know about Azure, but I know other clouds have services to integrate your VPN with their environment allowing you to directly transit between them. Hope that it brings some kind of insight to your research ;]