This curriculum spans the technical and operational rigor of a multi-phase cloud migration engagement, comparable to an enterprise advisory program that integrates discovery, governance, networking, data, modernization, security, and operating model changes across a large-scale Azure adoption.
Module 1: Assessing On-Premises Environments and Readiness
- Conduct dependency mapping for legacy applications using discovery tools like Azure Migrate to identify inter-service communication patterns.
- Classify workloads based on business criticality, performance requirements, and compliance obligations to prioritize migration sequence.
- Evaluate virtual machine utilization metrics over a 30-day period to right-size Azure VM instances and avoid overprovisioning.
- Determine data gravity implications by analyzing the volume and access patterns of on-premises data stores before initiating lift-and-shift.
- Identify non-supported configurations (e.g., custom BIOS settings, legacy OS versions) that prevent direct migration to Azure.
- Coordinate with network engineering teams to assess DNS, DHCP, and IP address conflicts between on-prem and target Azure VNet.
Module 2: Designing Azure Landing Zones and Governance Frameworks
- Implement management groups and subscription hierarchies aligned with business units to enforce separation of duties and cost accountability.
- Define and deploy Azure Policy initiatives to enforce naming conventions, tag compliance, and region-specific deployment restrictions.
- Configure Azure Blueprints to standardize network topologies, logging configurations, and security baselines across environments.
- Integrate Azure Lighthouse to enable delegated resource management for external MSPs without granting direct tenant access.
- Establish service principals with least-privilege roles for CI/CD pipelines to prevent over-permissioned automation accounts.
- Design resource lock strategies (CanNotDelete, ReadOnly) for production resources to prevent accidental deletion during operations.
Module 3: Network Architecture and Hybrid Connectivity
- Select between ExpressRoute, VPN Gateway, or a hybrid model based on bandwidth requirements, SLA needs, and failover tolerance.
- Design VNet peering topology with hub-and-spoke architecture to centralize firewall and inspection points for east-west traffic.
- Implement User Defined Routes (UDRs) to steer traffic through next-generation firewalls or virtual appliances for inspection.
- Plan subnet address space allocation to avoid overlap and accommodate future growth, including space for gateway subnets.
- Configure DNS forwarding rules between on-prem and Azure to resolve hybrid service endpoints without public exposure.
- Test latency and throughput across hybrid links under peak load to validate application performance post-migration.
Module 4: Data Migration and Storage Strategy
- Choose between Azure Blob Storage tiers (Hot, Cool, Archive) based on access frequency and retrieval cost sensitivity.
- Use Azure Data Box for multi-terabyte data transfers when network bandwidth constraints make online migration impractical.
- Migrate SQL Server databases using Log Shipping or Azure Database Migration Service with minimal downtime strategy.
- Implement Azure Files Sync to tier on-prem file shares to cloud while maintaining local cache for performance.
- Configure lifecycle management policies to automatically transition blobs between storage tiers based on age.
- Validate data integrity post-migration using checksums and reconcile row counts between source and target databases.
Module 5: Application Refactoring and Modernization
- Determine refactoring scope for monolithic applications by identifying stateful components that hinder containerization.
- Migrate stateless workloads to Azure App Service while retaining stateful dependencies in VMs during phased modernization.
- Containerize .NET applications using Azure Container Instances as an intermediate step before full AKS adoption.
- Replace on-prem message queues with Azure Service Bus or Event Grid based on throughput and delivery semantics.
- Implement feature toggles to decouple deployment from release during incremental application updates in Azure.
- Modify connection strings and authentication mechanisms to use Azure Key Vault instead of configuration files.
Module 6: Identity, Access, and Security Integration
- Extend on-prem Active Directory using Azure AD Connect with password hash sync or pass-through authentication.
- Configure Conditional Access policies to enforce MFA for administrative access to Azure resources.
- Migrate application-specific service accounts to managed identities to eliminate credential management overhead.
- Integrate Azure Security Center to enable continuous assessment and remediation of misconfigurations.
- Define role-based access control (RBAC) at resource group level to align with DevOps team responsibilities.
- Enable Azure AD Privileged Identity Management (PIM) for just-in-time elevation of administrative roles.
Module 7: Migration Execution and Cutover Planning
- Develop a cutover runbook specifying pre-migration checks, DNS TTL adjustments, and rollback triggers.
- Perform test migrations in non-production environments to validate replication consistency and RPO/RTO targets.
- Coordinate change windows with business stakeholders and schedule migrations during low-usage periods.
- Use Azure Site Recovery to orchestrate multi-VM failover with dependency-preserving replication groups.
- Monitor replication health and latency metrics during the pre-cutover phase to detect drift.
- Execute DNS switchover using traffic routing policies in Azure Traffic Manager or Application Gateway.
Module 8: Post-Migration Optimization and Operations
- Review Azure Cost Management reports to identify underutilized resources and schedule shutdown policies.
- Enable Azure Monitor alerts for CPU, memory, and disk usage thresholds to support proactive scaling.
- Implement auto-scaling rules for App Services and VM Scale Sets based on historical load patterns.
- Conduct architecture reviews at 30, 60, and 90 days post-migration to identify technical debt and optimization gaps.
- Integrate Azure Log Analytics with SIEM solutions to centralize security event monitoring.
- Document operational runbooks for backup, patching, and disaster recovery procedures in the new environment.