Moving our infrastructure to AZURE

[Emmanuel JAMIN]

Hello,

I am the IT Administrator for our company. We are looking at changing our infrastructure which one is inside the organization at this point. By the end of the year I will need to change our servers, update the virtualized servers (2008R2 currently).

We just finished with the development of our new CRM customized to our product. I am planning to move that one to AZURE for access purposes.

Our Infra is currently in the Orange MPLS (secured network)...

I watched many videos on AZURE... and that product seems to be a good solution BUT of course I am not sure of the cost, security... Can a users access the new CRM using SSL without trouble, secured. I was told to put a proxy server (knowing the sever will be Linux). I have 15 virtualized server going from AD, DNS, finances, Shared systems, RDP, DB, printer server and more...

I don't think the solution would be to move everything in one shot ?

Our current MPLS is quite expensive but I want to have a good security environment in AZURE ? What do you suggest ? AZURE VPN ? BACKUP ? ...

Well I don't really know where to start ?

Thanks for your suggestions.

[#2]

Hello Emmanuel,

My suggestion is to start with a small POC, and then start to moving the applications as virtual machines (IaaS). Problaly, you'll find that this scenario can be optimizated using more PaaS services and automation.

Try to understand in this POC, if your scenario is full supported and the related costs. The billing is the complex topic you will face.

Feel free to share more information / questions so we can help you.

[#3]

I think the aforementioned PoC is a great suggestion.  Get comfortable with the key Azure capabilities and how they would fit in with your requirements. What you have laid out sounds like a big program of work, which I am sure is doable but it won't be without its complications. I'd suggest getting some assistance if needed, things like networking, firewalls, resilience can get quite complicated, there are also options like ExpressRoute.  Getting some help to navigate these options especially if you are on a deadline, could make sense.  Also look at costings and the different ways of paying for Azure, the most preferential is usually via an Enterprise Agreement, also if you have been buying your Windows Server licences with SA, you should be able to make use of Azure Hybrid Use Benefit to save on costs. Finally, you also want to make sure you understand IaaS vs PaaS and the corresponding options in Azure like Azure Virtual Machines vs Azure Web Apps.  The main documentation site is very good.

[#4]

A good place to start is

1. Create your Azure Virtual Network

2. Deploy necessary servers, AD domain controller, web server, db server, file server

3. To add layer 7 protection, there is Azure web application firewall that serves up an https/ssl public endpoint to your CRM

3. Consider site to site VPN to your corporate network to this azure virtual network. Once comfortable with this then leverage Express Route.

4. Pricing: azure pricingin calculator but this is rough estimate, but once you have this POC environment you can track cost consumption on a daily basis. 

Let me know any further questions

[#5]

All the replies are valid, i would on the other hand suggest you have a MS partner assist you with planning. If you only have 15 servers, getting a rough estimate on cost and services should not take many hours.

there are also assement tools to help you with planning VM sizes and so on.

Also there is a Web Application proxy feature in Azure AD i think you should consider if you have it the requires Azure AD tier. This will save you administration of a VM.

[#6]

Some useful replies here. As a follow up question I was wondering what the current "best" solution is for managing printing if you were to go full cloud.

Some Assumptions I have after moving to full cloud:
- You can have full GPO added printers because AD connectivity works as expected
- You could use Branch Office Direct Printing to keep the print jobs off the WAN

The key of course as I see it is to keep the print jobs off the WAN but I've never personally implemented a full no on-prem infrastructure environment (always leaving at least one little server to handle roles like DC / Print Services / LoB applications)