Azure Solution Architect

Sample Azure migration blueprint

Recommendation

Use a governed landing zone with clear production/nonproduction boundaries, private application and data paths, and staged migration waves. Keep the initial design regional and avoid choosing a secondary-region DR pattern until the business approves RPO/RTO and residency.

Facts and open decisions

Provided: two on-premises .NET services, 600 requests/second peak with brief bursts, SQL Server transactions, file-share documents, Entra ID authentication, hybrid operation, 99.9% target.

Unknown: traffic mix and read/write ratio, supported .NET/runtime versions, database size and dependencies, document size/retention, data region/residency, RPO/RTO, tenant isolation, compliance controls, connectivity bandwidth, budget, and team AKS maturity.

• Treat 99.9% as a target, not an SLA or achieved result.

Architecture outline

Governance: Establish management groups aligned to policy and environment boundaries; separate production and nonproduction subscriptions where ownership, blast radius, quotas, or billing justify it. Use consistent resource naming, ownership/data tags, budgets, policy assignments, and documented exception handling. Keep platform, security, and workload responsibilities explicit.
2.

Network: Select hub-spoke for controlled shared network services or Virtual WAN if multi-site scale and operations warrant it. Use private subnets, NSGs, explicit route ownership, private endpoints where supported, and private DNS zones. For hybrid connectivity compare VPN and ExpressRoute using bandwidth, latency, redundancy, and operational needs. Document on-prem routes, failover, DNS resolution, and overlapping address-space risks.
3.

Application: Begin with App Service or Container Apps for straightforward managed hosting; consider AKS only if Kubernetes capabilities and team operations justify its added responsibility. Place public ingress behind an appropriately configured edge or gateway, protect API routes, apply health checks, bounded concurrency, timeouts, and gradual rollout with rollback.
4.

Data and files: Compare Azure SQL/SQL Managed Instance with current SQL Server compatibility and feature requirements before migration. Model connection pooling, storage growth, HA, backup, and restore. Move documents to private Blob Storage or Azure Files according to file semantics, access patterns, retention, and application changes. Enforce encryption, least-privilege managed identity, and lifecycle controls.
5.

Identity and security: Use Entra federation for workforce access and managed identities for workloads. Minimize permanent Owner/Contributor assignments; use scoped RBAC and controlled elevation. Store secrets and keys in Key Vault where required. Review public exposure, logging, policy exceptions, threat model, and alert ownership.
6.

Operations: Define SLOs and instrument API latency/errors, saturation, SQL connections, dependency health, and migration outcomes. Use Azure Monitor/Application Insights as appropriate, route alerts to an owned response process, and document support runbooks. Manage infrastructure with reviewed Bicep or Terraform, staged environments, smoke tests, and a rollback or forward-recovery plan.

Migration and recovery

Inventory dependencies and classify data before selecting a migration method. Pilot a low-risk service, test authentication and network flows, measure representative workload, and validate SQL compatibility. Agree RPO/RTO first; then design backup retention, restore exercises, and any Site Recovery or regional failover. A successful backup job alone does not demonstrate recoverability.

Cost and validation

Measure app compute, SQL sizing/storage/IO, network egress, private endpoint and monitoring usage, backup retention, and hybrid connectivity. Validate current regional service availability, quotas, pricing, SQL migration compatibility, and platform limits with Microsoft’s current official documentation and workload tests.

Next actions

Approve data residency and RPO/RTO; collect database and file-share inventories; document routes and DNS; choose a representative migration pilot; define security and SLO acceptance tests. This is a sample design only; no tenant was inspected and no resources were deployed.