{"id":59225,"date":"2026-10-19T20:17:04","date_gmt":"2026-10-19T10:17:04","guid":{"rendered":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/19\/from-migration-factory-to-a-secure-azure-landing-zone-at-scale\/"},"modified":"2026-10-19T20:18:24","modified_gmt":"2026-10-19T10:18:24","slug":"from-migration-factory-to-a-secure-azure-landing-zone-at-scale","status":"publish","type":"post","link":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/19\/from-migration-factory-to-a-secure-azure-landing-zone-at-scale\/","title":{"rendered":"From Migration Factory to a Secure Azure Landing Zone at Scale"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">In this blog post From Migration Factory to a Secure Azure Landing Zone at Scale we will explain how to move VMware, Hyper-V and physical servers to Azure using a repeatable migration process without carrying old cost, security and management problems into the cloud.<\/p>\n\n\n\n<!--more-->\n\n\n\n<p class=\"wp-block-paragraph\">Many migration projects begin with a deadline. Hardware is approaching end of life, VMware costs are changing, a data centre contract is expiring, or the business wants to reduce its dependence on ageing infrastructure.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The pressure to move quickly can lead to a costly mistake: treating migration as a server-copying exercise. The servers reach Azure, but they remain oversized, poorly documented and difficult to secure.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What a migration factory actually does<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A migration factory is not a physical facility. It is a repeatable process for discovering, assessing, testing and moving groups of servers in controlled waves.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Instead of creating a new plan for every server, the migration team uses consistent assessment rules, security checks, test procedures, approval steps and rollback plans. This makes the outcome more predictable and helps the team improve after each migration wave.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft Azure Migrate provides the core technology behind this approach. It can discover VMware virtual machines, Hyper-V virtual machines and physical servers, collect configuration and performance information, identify application dependencies and assess whether workloads are ready for Azure.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In plain English, it helps answer the questions leaders should ask before approving a move:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Which servers are still being used?<\/li>\n<li>Which applications depend on each other?<\/li>\n<li>What will each workload cost in Azure?<\/li>\n<li>Which systems need upgrading before they move?<\/li>\n<li>Which servers should be retired rather than migrated?<\/li>\n<li>How much downtime can the business accept?<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Build the destination before moving the servers<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A fast migration into an unprepared Azure environment simply creates a new version of the old server room. Administrators receive excessive access, networks grow without a plan, security alerts go nowhere and nobody can explain the monthly bill.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is why a secure Azure landing zone should be established before the first production migration. A landing zone is the pre-built foundation that defines how Azure subscriptions, user access, networks, security monitoring, backups and costs will be managed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft describes landing zones as a structured foundation for governing, securing and scaling Azure environments. They separate shared platform services from individual workloads, allowing teams to operate applications within centrally managed guardrails.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We explain this foundation in more detail in Why Use an Azure Landing Zone. For a migration program, the important point is simple: the landing zone is part of the migration, not a separate project to address later.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Five stages of a safer migration factory<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">1. Discover the real server estate<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Spreadsheets are rarely enough. They may list server names and operating systems, but they usually miss performance patterns, application connections, forgotten test systems and servers that nobody wants to own.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Azure Migrate uses an on-premises appliance, which is a small discovery system installed in the existing environment. It gathers server configuration and performance data so the migration team can build an evidence-based inventory rather than relying on assumptions.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Discovery often reveals an immediate saving: servers that can be retired, consolidated or left off for most of the week. Every unnecessary server removed is one less system to migrate, license, patch, back up and protect.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2. Decide what should move and what should change<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Not every workload should become another Azure virtual machine. Some applications should be moved largely as they are, while others can use a managed Azure service that removes part of the maintenance burden.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example, an older web application may be suitable for a managed hosting service rather than another Windows server. Our article on how to modernise web apps without a rewrite explores this middle ground.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Database workloads need the same discussion. A suitable SQL system may benefit from Azure SQL Managed Instance, which provides familiar SQL Server capabilities while Microsoft manages more of the underlying platform. Critical databases may also need the resilience choices covered in our guide to zone-resilient Azure SQL Managed Instance workloads.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">3. Group workloads into migration waves<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Moving servers one at a time sounds cautious, but it can break applications when connected systems are separated. Moving everything over one weekend creates the opposite problem: too much business risk in a single event.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A better approach is to create waves containing related applications and their supporting servers. Start with lower-risk systems, learn from the process and then move more important workloads once the team has proven its testing and recovery procedures.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Azure Migrate includes wave-planning capabilities for grouping and tracking workloads. The technology matters, but clear business ownership matters more. Every wave needs an application owner who can confirm that invoicing, reporting, integrations and other business functions still work after the move.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">4. Apply security during migration<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Security should not be a final checklist completed after cutover. Access controls, network restrictions, encryption, backup, monitoring and patch management should be built into the migration pattern used for every wave.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Azure Policy, which automatically checks and enforces configuration rules, can prevent teams from creating resources outside approved regions or without required security settings. Microsoft Defender for Cloud can then identify risky configurations and provide an ongoing view of security posture.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Administrative access should also follow least-privilege principles, meaning people receive only the access required for their role. Time-limited privileged access is safer than leaving permanent administrator rights attached to everyday accounts.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">These controls support Essential Eight, the Australian Government&#8217;s cybersecurity framework that many organisations use to improve resilience. However, moving to Azure does not automatically achieve Essential Eight maturity. Multi-factor authentication, patching, backups, application control and restrictions on administrative privileges still need to be designed, implemented and tested.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Security-sensitive VMware decisions also deserve workload-level attention. We cover encryption, Secure Boot and confidential computing choices in VMware to Azure migration security choices CIOs face.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">5. Test, cut over and optimise<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A successful replication is not proof that an application works. Each migration wave should include a test run, business validation, a documented cutover plan and a rollback decision point.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">After cutover, the factory should continue for several weeks. Teams need to review performance, remove temporary migration resources, confirm backups, schedule patching and compare actual costs against the business case.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is also the time to right-size virtual machines based on real usage. Otherwise, a server purchased for a five-year hardware cycle may be copied into an equally oversized cloud configuration and billed every month.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">An illustrative mid-sized business scenario<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Consider an Australian distributor with 220 employees and 60 servers spread across VMware, Hyper-V and several physical machines. Its initial plan is to move all 60 servers before a hosting contract expires.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Discovery shows that 12 servers can be retired, eight should remain temporarily on-premises and 40 are suitable for migration or modernisation. Dependency mapping also reveals that the ordering platform relies on two services that were missing from the original spreadsheet.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The business avoids paying for 12 unnecessary cloud servers and moves the remaining workloads in four controlled waves. The eight retained systems are connected through Azure Arc, which brings Azure-based management and security visibility to servers outside Azure.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This hybrid approach reduces deadline pressure without losing oversight. For workloads that cannot move yet, Azure Arc and Site Recovery without re-platforming explains how to improve management and recovery while keeping applications in place.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Questions leaders should ask before approving migration<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Do we have performance-based cost estimates or only server counts?<\/li>\n<li>Have application owners confirmed system dependencies?<\/li>\n<li>Is the secure landing zone operational before production workloads arrive?<\/li>\n<li>Who can create resources and approve privileged access?<\/li>\n<li>How will backups and recovery procedures be tested?<\/li>\n<li>Which workloads will be retired, retained or modernised?<\/li>\n<li>Who will review security, performance and cost after migration?<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">A migration factory provides speed through consistency, not through skipped steps. Combined with a secure Azure landing zone, it turns a deadline-driven infrastructure move into a safer, more manageable platform for the business.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">CloudProInc brings more than 20 years of enterprise IT experience to this work. As a Melbourne-based Microsoft Partner and Wiz Security Integrator, we provide practical support across Azure migration, Microsoft Defender and Wiz, a cloud security platform that helps identify exposed systems and risky configurations.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you are not sure whether your VMware, Hyper-V or physical server estate is ready for Azure, we are happy to review the current environment, migration plan and likely risks with you \u2014 no strings attached.<\/p>\n\n\n","protected":false},"excerpt":{"rendered":"<p>Learn how to turn server migration into a repeatable, secure Azure program that reduces risk, controls cost and creates a better platform for future modernisation.<\/p>\n","protected":false},"author":1,"featured_media":59227,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":true,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[16,19,13,124],"tags":[],"class_list":["post-59225","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-microsoft-azure","category-azure-security","category-blog","category-cloud-cost-finops"],"jetpack-related-posts":[{"id":59129,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/16\/vmware-to-azure-migration-security-choices-cios-face-in-2026\/","url_meta":{"origin":59225,"position":0},"title":"VMware to Azure Migration Security Choices CIOs Face in 2026","author":"CPI Staff","date":"October 16, 2026","format":false,"excerpt":"Moving VMware workloads to Azure involves more than choosing VM sizes. CIOs must decide where Confidential VMs, Secure Boot and the right encryption model reduce risk without inflating cost.","rel":"","context":"In &quot;Azure&quot;","block_context":{"text":"Azure","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/microsoft-azure\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/10\/vmware-to-azure-migration-security-choices-cios-face-in-2026.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/10\/vmware-to-azure-migration-security-choices-cios-face-in-2026.png 1x, \/wp-content\/uploads\/2026\/10\/vmware-to-azure-migration-security-choices-cios-face-in-2026.png 1.5x, \/wp-content\/uploads\/2026\/10\/vmware-to-azure-migration-security-choices-cios-face-in-2026.png 2x, \/wp-content\/uploads\/2026\/10\/vmware-to-azure-migration-security-choices-cios-face-in-2026.png 3x, \/wp-content\/uploads\/2026\/10\/vmware-to-azure-migration-security-choices-cios-face-in-2026.png 4x"},"classes":[]},{"id":59161,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/17\/azure-arc-and-site-recovery-without-re-platforming-your-servers\/","url_meta":{"origin":59225,"position":1},"title":"Azure Arc and Site Recovery Without Re-platforming Your Servers","author":"CPI Staff","date":"October 17, 2026","format":false,"excerpt":"Protect hybrid servers with Azure Arc and Azure Site Recovery, reducing downtime without rebuilding applications or committing to a full cloud migration.","rel":"","context":"In &quot;Azure&quot;","block_context":{"text":"Azure","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/microsoft-azure\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/10\/azure-arc-and-site-recovery-without-re-platforming-your-servers.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/10\/azure-arc-and-site-recovery-without-re-platforming-your-servers.png 1x, \/wp-content\/uploads\/2026\/10\/azure-arc-and-site-recovery-without-re-platforming-your-servers.png 1.5x, \/wp-content\/uploads\/2026\/10\/azure-arc-and-site-recovery-without-re-platforming-your-servers.png 2x, \/wp-content\/uploads\/2026\/10\/azure-arc-and-site-recovery-without-re-platforming-your-servers.png 3x, \/wp-content\/uploads\/2026\/10\/azure-arc-and-site-recovery-without-re-platforming-your-servers.png 4x"},"classes":[]},{"id":58534,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/how-to-assess-legacy-apps-for-azure-app-service-managed-instance\/","url_meta":{"origin":59225,"position":2},"title":"How to Assess Legacy Apps for Azure App Service Managed Instance","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"A practical assessment framework for deciding whether a legacy Windows web application can move to Azure Managed Instance safely, affordably and without an expensive rebuild.","rel":"","context":"In &quot;App Service&quot;","block_context":{"text":"App Service","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/app-service\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/08\/how-to-assess-legacy-apps-for-azure-app-service-managed-instance.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/08\/how-to-assess-legacy-apps-for-azure-app-service-managed-instance.png 1x, \/wp-content\/uploads\/2026\/08\/how-to-assess-legacy-apps-for-azure-app-service-managed-instance.png 1.5x, \/wp-content\/uploads\/2026\/08\/how-to-assess-legacy-apps-for-azure-app-service-managed-instance.png 2x, \/wp-content\/uploads\/2026\/08\/how-to-assess-legacy-apps-for-azure-app-service-managed-instance.png 3x, \/wp-content\/uploads\/2026\/08\/how-to-assess-legacy-apps-for-azure-app-service-managed-instance.png 4x"},"classes":[]},{"id":58755,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/modernise-web-apps-without-a-rewrite-on-azure-managed-instance\/","url_meta":{"origin":59225,"position":3},"title":"Modernise Web Apps Without a Rewrite on Azure Managed Instance","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"Learn when Azure App Service Managed Instance can move legacy Windows web apps off ageing servers without a costly rewrite while improving security, supportability and cost control.","rel":"","context":"In &quot;App Service&quot;","block_context":{"text":"App Service","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/app-service\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/09\/modernise-web-apps-without-a-rewrite-on-azure-managed-instance.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/09\/modernise-web-apps-without-a-rewrite-on-azure-managed-instance.png 1x, \/wp-content\/uploads\/2026\/09\/modernise-web-apps-without-a-rewrite-on-azure-managed-instance.png 1.5x, \/wp-content\/uploads\/2026\/09\/modernise-web-apps-without-a-rewrite-on-azure-managed-instance.png 2x, \/wp-content\/uploads\/2026\/09\/modernise-web-apps-without-a-rewrite-on-azure-managed-instance.png 3x, \/wp-content\/uploads\/2026\/09\/modernise-web-apps-without-a-rewrite-on-azure-managed-instance.png 4x"},"classes":[]},{"id":59237,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/20\/azure-backup-in-2026-with-vmware-9-and-immutable-recovery-plans\/","url_meta":{"origin":59225,"position":4},"title":"Azure Backup in 2026 with VMware 9 and Immutable Recovery Plans","author":"CPI Staff","date":"October 20, 2026","format":false,"excerpt":"VMware 9 support removes an important backup gap, but recoverability requires more. Learn how immutability, access controls and tested recovery plans reduce ransomware and outage risk.","rel":"","context":"In &quot;Azure&quot;","block_context":{"text":"Azure","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/microsoft-azure\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/10\/azure-backup-in-2026-with-vmware-9-and-immutable-recovery-plans.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/10\/azure-backup-in-2026-with-vmware-9-and-immutable-recovery-plans.png 1x, \/wp-content\/uploads\/2026\/10\/azure-backup-in-2026-with-vmware-9-and-immutable-recovery-plans.png 1.5x, \/wp-content\/uploads\/2026\/10\/azure-backup-in-2026-with-vmware-9-and-immutable-recovery-plans.png 2x, \/wp-content\/uploads\/2026\/10\/azure-backup-in-2026-with-vmware-9-and-immutable-recovery-plans.png 3x, \/wp-content\/uploads\/2026\/10\/azure-backup-in-2026-with-vmware-9-and-immutable-recovery-plans.png 4x"},"classes":[]},{"id":59222,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/19\/azure-arc-key-vault-extension-migration-before-2027-retirement\/","url_meta":{"origin":59225,"position":5},"title":"Azure Arc Key Vault Extension Migration Before 2027 Retirement","author":"CPI Staff","date":"October 19, 2026","format":false,"excerpt":"Microsoft will retire the Azure Arc Key Vault Secrets Provider extension on 9 October 2027. Here is a practical migration plan that reduces disruption, security risk and rushed decisions.","rel":"","context":"In &quot;Azure Key Vault&quot;","block_context":{"text":"Azure Key Vault","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/azure-key-vault\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/10\/azure-arc-key-vault-extension-migration-before-2027-retirement.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/10\/azure-arc-key-vault-extension-migration-before-2027-retirement.png 1x, \/wp-content\/uploads\/2026\/10\/azure-arc-key-vault-extension-migration-before-2027-retirement.png 1.5x, \/wp-content\/uploads\/2026\/10\/azure-arc-key-vault-extension-migration-before-2027-retirement.png 2x, \/wp-content\/uploads\/2026\/10\/azure-arc-key-vault-extension-migration-before-2027-retirement.png 3x, \/wp-content\/uploads\/2026\/10\/azure-arc-key-vault-extension-migration-before-2027-retirement.png 4x"},"classes":[]}],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"\/wp-content\/uploads\/2026\/10\/from-migration-factory-to-a-secure-azure-landing-zone-at-scale.png","_links":{"self":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59225","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/comments?post=59225"}],"version-history":[{"count":1,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59225\/revisions"}],"predecessor-version":[{"id":59226,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59225\/revisions\/59226"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/media\/59227"}],"wp:attachment":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/media?parent=59225"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/categories?post=59225"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/tags?post=59225"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}