Azure Cloud Modernization & Brownfield


Lift & Shift → Optimize → Modernize → Cloud-Native
Week 1       Month 1-3   Month 3-12   Year 1-2

Not every workload needs to reach cloud-native. Optimization alone can deliver major value.

2.2 Lift & Shift → Optimize (First 3 Months)

Month 1: Quick Wins

Right-size VMs
Enable Azure Hybrid Benefit
Auto-shutdown dev/test VMs
Purchase Reserved Instances
Enable Backup
Configure Monitor + Log Analytics
Apply tagging

Month 2: Security Hardening

Deploy Azure Firewall
Configure NSGs
Enable JIT access
Enable Defender for Cloud
Enable diagnostic logs
Apply Azure Policy
Deploy Bastion

Month 3: Platform Optimization

SQL VM → SQL MI
File servers → Azure Files
Private Endpoints
Managed Identity
Key Vault
Backup + DR strategy
Cost optimization

2.3 Refactor IIS → App Service

Category	Description
Easy	.NET Core → App Service
Medium	.NET Framework 4.8
Hard	ISAPI / COM+
Impossible	Windows Auth / Registry

Migration Steps

Create App Service Plan
Deploy to staging slot
Update DB connections
Move storage to Blob
Use Managed Identity
Use Key Vault
Replace scheduled jobs
Swap to production

2.4 Database Modernization Path


SQL VM → SQL MI → Azure SQL → Cosmos DB

SQL VM: Full control
SQL MI: Compatibility + managed
SQL DB: Fully managed
Cosmos DB: Global scale

2.5 Monolith Decomposition


Monolith → APIM → Extract Services → Microservices

Start with API gateway
Extract low-risk services first
Each service owns its database
Use CDC for gradual migration

3. Hybrid Coexistence

Hybrid Identity

Use Entra Connect Cloud Sync
Enable Password Hash Sync
Enable SSO
Migrate from ADFS
Enable Conditional Access

Hybrid DNS

Forward Azure → On-prem
Forward On-prem → Azure
Use Private DNS Zones
Implement split-brain DNS

Hybrid File Sync

Deploy Azure Files
Install sync agent
Enable cloud tiering
Cutover gradually

4. Legacy Modernization

Legacy	Modern	Effort
.NET 4.5	.NET 8	High
Web Forms	Blazor	Very High
WCF	gRPC/REST	High
Windows Services	Functions	Medium

Containerization Strategy

Platform	Use Case
AKS	Complex microservices
Container Apps	Serverless containers
App Service	Simple web apps
ACI	Short-lived workloads

5. Lift → Modernize Playbook

Month 1: Stabilize
Month 2-3: Infra modernization
Month 3-6: App modernization
Month 6-12: Architecture modernization

6. Database Migration Playbooks

SQL → SQL MI

DMA assessment
DMS migration
Cutover
Optimize

Oracle → PostgreSQL

Convert PL/SQL
Test extensively
Dual-write migration

MongoDB → Cosmos DB

Choose partition key
Estimate RU/s
Migrate & optimize

7. Identity Migration

Deploy Entra Connect
Enable PHS + SSO
Migrate users in phases
Decommission ADFS

8. Network Migration

Establish ExpressRoute/VPN
Migrate workloads in waves
Update DNS + routing
Decommission on-prem

9. Brownfield Gotchas

Hardcoded IPs
Windows Auth dependency
Shared DBs
Undocumented integrations
DNS issues
SSL certs
Service accounts
Bandwidth limits
DNS TTL issues
Cost surprises

10. Case Studies

Financial Services

200 servers → Azure
SQL → SQL MI
.NET → .NET 8
45% cost reduction

Healthcare

HIPAA compliance
Private endpoints
Firewall + Sentinel

Retail

Monolith → microservices
AKS + Service Bus
Multi-region