Your Essential Cloud Migration Guide for SMB: Azure Strategy by SkyCore Solutions

Step 1: Establish Your Azure Migrate Project

The Azure Migrate service serves as your central hub for all migration activities. Establishing a project is the first critical step, enabling you to discover, assess, and migrate your on-premises workloads to Azure. This project provides a unified console to track your progress and manage various migration tools.

az migrate project create \
  --name "SkyCoreSMBMigrationProject" \
  --resource-group "SkyCoreSMB_RG" \
  --location "EastUS" \
  --solution-type "Servers"

• --name "SkyCoreSMBMigrationProject": Specifies a unique name for your Azure Migrate project. Choose a descriptive name.
• --resource-group "SkyCoreSMB_RG": Assigns the project to an existing Azure Resource Group. If you don't have one, create it first using az group create --name "SkyCoreSMB_RG" --location "EastUS".
• --location "EastUS": Defines the Azure region where the Migrate project metadata will be stored. This does not dictate where your migrated VMs will reside.
• --solution-type "Servers": Indicates the primary type of workloads you intend to migrate. Other options include "Databases", "WebApps", etc. You can add more solutions later.

Portal alternative: Navigate to the Azure portal, search for "Azure Migrate", click "Discover, assess and migrate", then select "Create project" and fill in the details.

Expected Output: A JSON output confirming the successful creation of the Azure Migrate project, including its ID, name, and provisioning state. You can verify its existence in the Azure portal under the specified resource group.

Step 2: Discover and Assess On-premises Workloads

With your Azure Migrate project in place, the next crucial phase involves discovering your on-premises servers and applications. Azure Migrate provides a lightweight appliance that runs in your on-premises environment to perform agentless discovery. This discovery is vital for identifying dependencies, assessing compatibility, and estimating the cost of running these workloads in Azure.

2.1: Deploy the Azure Migrate Appliance

The Azure Migrate appliance discovers your servers. For VMware and Hyper-V environments, it's deployed as a virtual machine. For physical servers, it's installed as a software agent. There is no direct CLI command for deploying the appliance itself; this is typically done via the Azure portal or by downloading and running an OVA/VHD file.

Portal step: In your Azure Migrate project, under 'Discovery & Assessment', select 'Discover' for Servers, databases and web apps. Choose your server type (VMware, Hyper-V, Physical/cloud) and follow the prompts to download the appliance software (e.g., OVA for VMware) and register it with your project using the generated project ID and key.

Expected Output: Once deployed and configured, the appliance starts discovering servers and sends metadata to the Azure Migrate project. You'll see discovered servers appear in your Azure Migrate project's inventory within minutes to hours, depending on environment size.

2.2: Create and Review an Assessment

After discovery, create an assessment to analyze server readiness, recommend Azure VM sizes, and estimate costs. This step helps SMBs make informed decisions about their migration strategy.

az migrate assessment create \
  --project-name "SkyCoreSMBMigrationProject" \
  --resource-group "SkyCoreSMB_RG" \
  --name "SMBWorkloadAssessment" \
  --group-name "DefaultMigrateGroup" \
  --sizing-criterion "PerformanceBased" \
  --time-range "OneMonth" \
  --confidence-level 5 \
  --azure-location "EastUS" \
  --azure-storage-redundancy "LRS" \
  --azure-offer-billability "PayAsYouGo"

• --project-name "SkyCoreSMBMigrationProject": The name of your Azure Migrate project.
• --resource-group "SkyCoreSMB_RG": The resource group where your project resides.
• --name "SMBWorkloadAssessment": A descriptive name for this specific assessment.
• --group-name "DefaultMigrateGroup": The group of discovered servers you want to assess. Azure Migrate automatically creates a default group. You can create custom groups using az migrate group create.
• --sizing-criterion "PerformanceBased": Recommends Azure VM sizes based on historical CPU/memory/disk performance data. "AsOnPremises" matches current on-premises configuration.
• --time-range "OneMonth": Uses performance data collected over the last month.
• --confidence-level 5: Indicates high confidence in the assessment (based on data completeness). Ranges from 1 (lowest) to 5 (highest).
• --azure-location "EastUS": The target Azure region for the assessment.
• --azure-storage-redundancy "LRS": Local Redundant Storage for recommended disks. Options include LRS, ZRS, GRS, RA-GRS.
• --azure-offer-billability "PayAsYouGo": Calculates costs based on a standard Pay-As-You-Go Azure subscription.

Portal alternative: In your Azure Migrate project, navigate to 'Servers, databases and web apps' tile, click 'Assess', then 'Azure VM'. Select your assessment properties, server group, and create the assessment. Review the generated report under 'Assessments'.

Expected Output: A JSON confirmation of the assessment creation. The assessment report will be generated in the Azure Migrate portal, providing detailed insights into server readiness, recommended Azure VM SKUs, and estimated monthly costs. Review this report thoroughly to understand potential migration blockers and budget implications.

Step 3: Craft Your Migration Plan and Data Transfer Strategy

A well-defined migration plan translates your assessment into an actionable sequence of events, minimizing risk and downtime. This step involves prioritizing workloads, mapping dependencies, and choosing the most appropriate data transfer methods for your SMB.

3.1: Map Dependencies and Group Workloads

Dependencies between applications and databases are critical. Migrating dependent components together prevents service disruptions. Utilize the dependency visualization in Azure Migrate to identify these links. Grouping logically connected workloads into 'migration waves' is a best practice, especially for SMBs with limited resources.

# Example: Creating a custom group for interdependent applications
az migrate group create \
  --project-name "SkyCoreSMBMigrationProject" \
  --resource-group "SkyCoreSMB_RG" \
  --name "FinancialAppGroup" \
  --machines "/subscriptions/<subscription-id>/resourceGroups/<rg>/providers/Microsoft.OffAzure/ServerSites/<server-site-name>/machines/<machine-id-1>" \
  "/subscriptions/<subscription-id>/resourceGroups/<rg>/providers/Microsoft.OffAzure/ServerSites/<server-site-name>/machines/<machine-id-2>"

• --name "FinancialAppGroup": A logical name for your group of interdependent machines.
• --machines: A space-separated list of fully qualified resource IDs for the servers to include in this group. You obtain these IDs from your discovered inventory.

Portal alternative: In your Azure Migrate project, under 'Servers, databases and web apps', click 'Group', then 'Create group'. Add the desired discovered machines to the group. Use the 'Dependency visualization' feature to understand connections.

Expected Output: A JSON confirmation that the group has been created. The group will then be available for targeted assessments and migration operations.

3.2: Choose Your Data Migration Path

Selecting the right data migration path is crucial for security, speed, and cost-effectiveness. Consider your network connectivity, data volume, and sensitivity when making this decision.

• Azure ExpressRoute: Provides a private, dedicated, and high-bandwidth connection to Azure. Ideal for large datasets, critical applications requiring low latency, and continuous data synchronization. Requires initial setup time and costs.
• Site-to-Site VPN: Creates an encrypted tunnel over the public internet. More secure than public internet, suitable for moderate data volumes and less latency-sensitive workloads. Requires an Azure VPN Gateway.
• Azure Data Box: A physical appliance shipped by Microsoft. Best for offline migrations of very large datasets (terabytes to petabytes) when network bandwidth is limited or expensive. Slowest method due to shipping logistics.
• Public Internet: Basic, readily available. Only suitable for small volumes of non-sensitive data or for initial replication of less critical workloads where encryption is handled at the application layer. Least secure option and can consume local bandwidth.

SkyCore's Recommendation for SMBs: For most SMBs, a **Site-to-Site VPN** offers a good balance of security, performance, and cost-effectiveness for initial data transfer and ongoing hybrid operations. For very large initial data transfers, consider **Azure Data Box** to seed data, followed by VPN for incremental changes. ExpressRoute is typically an investment for larger enterprises or specific compliance needs.

Step 4: Prepare Your Azure Landing Zone

Before migrating any workloads, you need a properly configured Azure environment, known as a 'landing zone'. This foundational setup includes networking, identity, storage, and security configurations, ensuring your migrated applications have a stable and secure home.

4.1: Create Essential Azure Resources

Set up your core networking, storage, and identity components. For SMBs, a simplified hub-and-spoke or a single virtual network architecture is usually sufficient.

# Create a Resource Group for your Azure landing zone
az group create --name "SkyCore_LandingZone_RG" --location "EastUS"

# Create a Virtual Network (VNet) for your workloads
az network vnet create \
  --name "SkyCoreVNet" \
  --resource-group "SkyCore_LandingZone_RG" \
  --address-prefix "10.0.0.0/16" \
  --location "EastUS"

# Create a subnet for your virtual machines
az network vnet subnet create \
  --name "VMSubnet" \
  --vnet-name "SkyCoreVNet" \
  --resource-group "SkyCore_LandingZone_RG" \
  --address-prefix "10.0.1.0/24"

# Create a Network Security Group (NSG) for basic network security
az network nsg create \
  --name "SkyCoreVM_NSG" \
  --resource-group "SkyCore_LandingZone_RG" \
  --location "EastUS"

# Create a Storage Account for boot diagnostics and other general-purpose storage
az storage account create \
  --name "skycoresmbsa" \
  --resource-group "SkyCore_LandingZone_RG" \
  --location "EastUS" \
  --sku "Standard_LRS" \
  --kind "StorageV2"

• az group create: Creates a new resource group to logically organize your landing zone resources.
• az network vnet create: Establishes your primary virtual network with a specified address space.
• az network vnet subnet create: Defines a subnet within your VNet where your virtual machines will reside.
• az network nsg create: Creates a Network Security Group to filter network traffic to and from Azure resources. You'll add rules to this later.
• az storage account create: Provides a general-purpose storage account. Ensure the name is globally unique and only lowercase letters and numbers.

Portal alternative: Use the Azure portal search to find and create "Resource groups," "Virtual networks," "Subnets," "Network security groups," and "Storage accounts" by following the guided steps for each resource.

Expected Output: JSON outputs confirming the successful creation of each resource. You can verify these resources in the Azure portal under the `SkyCore_LandingZone_RG` resource group.

4.2: Configure Identity and Connectivity

For seamless integration, connect your on-premises Active Directory to Azure Active Directory (now Microsoft Entra ID) using Azure AD Connect. Set up a Site-to-Site VPN Gateway to establish secure connectivity between your on-premises network and your Azure VNet, facilitating initial data transfers and hybrid operations.

# Create a Public IP for the VPN Gateway
az network public-ip create \
  --name "SkyCoreVPNGatewayIP" \
  --resource-group "SkyCore_LandingZone_RG" \
  --location "EastUS" \
  --allocation-method "Static" \
  --sku "Standard"

# Create a Virtual Network Gateway (VPN Gateway)
az network vnet-gateway create \
  --name "SkyCoreVPNGateway" \
  --resource-group "SkyCore_LandingZone_RG" \
  --location "EastUS" \
  --vnet "SkyCoreVNet" \
  --public-ip-address "SkyCoreVPNGatewayIP" \
  --gateway-type "Vpn" \
  --sku "VpnGw1" \
  --vpn-type "RouteBased" \
  --no-wait

• az network public-ip create: Creates a public IP address required for the VPN Gateway.
• az network vnet-gateway create: Deploys the VPN Gateway, connecting it to your VNet and assigning the public IP. --sku VpnGw1 is a good starting point for SMBs.

Portal alternative: Search for "Virtual network gateways" and click "Create". Fill in the details, ensuring it's connected to your `SkyCoreVNet`. Once created, configure a "Local network gateway" representing your on-premises network, and then create a "Connection" between them.

Expected Output: JSON outputs for the created Public IP and confirmation of the VPN Gateway deployment. The VPN Gateway creation can take 30-45 minutes. You'll then configure your on-premises VPN device to establish the tunnel to this Azure VPN Gateway.

Step 5: Execute Workload Migration and Validation

This is the core migration phase, where you replicate your servers and databases to Azure, perform test migrations, and finally cut over your production workloads. Azure Migrate provides tools for agent-based and agentless replication depending on your source environment.

5.1: Configure Replication for Virtual Machines

Azure Migrate allows you to set up continuous replication of your on-premises VMs to Azure. This minimizes downtime during cutover by ensuring that Azure has an up-to-date copy of your data.

# Example for VMware VMs using Azure Migrate replication
# Note: Specific CLI commands for starting replication are often complex and depend on collector setup.
# The primary method for initial replication setup is through the Azure portal after discovery.
# Once replication is enabled via portal, subsequent actions like test migration can use CLI.

# Placeholder for starting replication (conceptual, portal-driven for setup):
# az migrate vmware machine start-replication \
#   --project-name "SkyCoreSMBMigrationProject" \
#   --resource-group "SkyCoreSMB_RG" \
#   --machine-name "YourOnPremVMName" \
#   --target-resource-group "SkyCore_LandingZone_RG" \
#   --target-vnet-name "SkyCoreVNet" \
#   --target-subnet-name "VMSubnet" \
#   --disk-type "Standard_HDD"

Portal step: In your Azure Migrate project, under 'Servers, databases and web apps', click 'Replicate'. Select your source and target settings, choose the VMs you want to replicate (from your discovered inventory), and configure replication settings (target resource group, VNet, subnet, disk type, availability options). Initiate replication.

Expected Output: The Azure portal will show the replication status, indicating data synchronization progress. Initial replication can take hours or days depending on data volume and network bandwidth.

5.2: Perform a Test Migration

Crucial for validating your migration strategy without impacting production. A test migration creates copies of your replicated VMs in a segregated Azure network, allowing you to test application functionality, network connectivity, and performance.

# Example: Perform a test migration for a specific VM
az migrate vmware machine test-migrate \
  --project-name "SkyCoreSMBMigrationProject" \
  --resource-group "SkyCoreSMB_RG" \
  --machine-name "YourOnPremVMName" \
  --target-vnet-name "SkyCoreVNet" \
  --target-resource-group "SkyCore_LandingZone_RG" \
  --azure-test-subnet-name "VMSubnet"

• --machine-name "YourOnPremVMName": The name of the specific VM you are testing.
• --target-vnet-name, --target-resource-group, --azure-test-subnet-name: Specify the Azure network where the test VM will be created.

Portal alternative: In your Azure Migrate project, navigate to 'Replicating servers', select the VM, and click 'Test migration'. Choose your target virtual network for the test.

Expected Output: A test Azure VM will be created from the replicated data. After testing, remember to 'Clean up test migration' to remove the test VM and associated resources. Document all findings and resolve any issues before proceeding to full migration.

5.3: Execute the Full Migration (Cutover)

Once test migrations are successful and you're confident, you can initiate the full migration, which performs a final synchronization and powers down the on-premises source, bringing up the migrated workload in Azure.

# Example: Migrate a specific VM to Azure
az migrate vmware machine migrate \
  --project-name "SkyCoreSMBMigrationProject" \
  --resource-group "SkyCoreSMB_RG" \
  --machine-name "YourOnPremVMName" \
  --shut-down-source-machine "true"

• --shut-down-source-machine "true": This critical flag instructs Azure Migrate to power off the on-premises source machine during cutover, preventing data inconsistencies or conflicts.

Portal alternative: In your Azure Migrate project, navigate to 'Replicating servers', select the VM, and click 'Migrate'. Choose the option to shut down the source VM before migration. Monitor the migration status.

Expected Output: The on-premises machine will be powered off, and the replicated Azure VM will power on, becoming your new production instance. Perform immediate post-migration validation to ensure all services are functional. Decommission the on-premises source machine and any Azure Migrate appliance once satisfied.

Step 6: Optimize, Secure, and Monitor Your Cloud Environment

Migration isn't the finish line; it's the beginning of cloud operations. Post-migration, focus on optimizing costs, enhancing security, and establishing robust monitoring to fully realize the benefits of the cloud.

6.1: Cost Optimization and Resource Sizing

Review your Azure VM sizes and resource configurations. The assessment provided initial recommendations, but real-world usage patterns might differ. Consider reserved instances or Azure Hybrid Benefit for further cost savings.

# Example: Resize an Azure VM
az vm resize \
  --resource-group "SkyCore_LandingZone_RG" \
  --name "YourMigratedVM" \
  --size "Standard_B2ms" # Example: downsize from a larger VM to a cost-effective Bursting VM

# Enable auto-shutdown for non-production VMs
az vm auto-shutdown \
  --resource-group "SkyCore_LandingZone_RG" \
  --name "YourDevTestVM" \
  --time "1900" \
  --email "admin@skycore.com"

• az vm resize: Changes the size of an existing Azure Virtual Machine. Choose appropriate SKUs based on workload.
• az vm auto-shutdown: Configures automatic shutdown for VMs, ideal for development/testing environments to save costs.

Portal alternative: Navigate to individual VM blades, select 'Size' to change VM size. For auto-shutdown, find 'Auto-shutdown' under Operations.

Expected Output: The VM will restart with the new size, or auto-shutdown will be configured. Use Azure Cost Management + Billing tools in the portal to track and optimize spending.

6.2: Security Hardening and Monitoring

Leverage Azure's native security capabilities. Implement Network Security Groups (NSGs) to restrict traffic, enable Azure Defender for Cloud for threat protection, and configure Azure Monitor for logging and alerts.

# Example: Add an NSG rule to allow RDP from a specific IP range
az network nsg rule create \
  --resource-group "SkyCore_LandingZone_RG" \
  --nsg-name "SkyCoreVM_NSG" \
  --name "AllowRDPFromOffice" \
  --priority 100 \
  --direction Inbound \
  --access Allow \
  --protocol Tcp \
  --destination-port-ranges 3389 \
  --source-address-prefixes "YourOfficePublicIP/32"

# Enable Azure Defender for Cloud for a subscription (can be done at resource group/VM level)
az security auto-provisioning-setting update \
  --name "default" \
  --auto-provision "On"

• az network nsg rule create: Adds a rule to an NSG to control inbound or outbound network traffic.
• az security auto-provisioning-setting update: Enables automatic provisioning of the Azure Defender for Cloud agent on new VMs, enhancing security posture.

Portal alternative: Configure NSG rules directly on the NSG blade. Enable Azure Defender for Cloud through the "Microsoft Defender for Cloud" service in the portal.

Expected Output: Your network will have more granular control, and Azure Defender for Cloud will begin scanning your resources for security recommendations and threats. Configure Azure Monitor dashboards and alerts to proactively manage your environment.