Video Tutorial: How to Migrate Your WordPress Site to Azure for Nonprofits
Before you migrate your WordPress site, ensure you have deployed a WordPress site on Azure. If you're unfamiliar with this process, scroll down to the reference section at the bottom of this blog. There is an article that will guide you through creating a WordPress site in Azure, complete with a helpful video. Why Azure for Nonprofits? Azure offers various benefits for nonprofits, including cost savings, scalability, and robust security features. Migrating your WordPress site to Azure can help you leverage these advantages to better serve your community. Step-by-Step Guide Access the WordPress Admin Portal: Go to your personal WordPress site and navigate to the admin portal by adding /wp-admin to your site's URL. Install the WP Migration Plugin: Select Plugins > Add New. Search for "WP Migration" and press enter. Install and activate the "All-in-One WP Migration and Backup" plugin. Export Your Website: Click on the plugin itself where it says "All-in-One WP Migration". Select Export > Export Site to File. Download the exported file. Access the WordPress Site on Azure: Navigate to the admin portal of your WordPress site on Azure by adding /wp-admin to your site's URL. Install the WP Migration Plugin on Azure: Select Plugins > Add New. Search for "WP Migration". Install and activate the plugin. Import Your Website: Click on the plugin and select Import. Choose Import from File and select the file you downloaded earlier. Handling File Size Limits If you encounter a file size limit error (WordPress has a 50 MB limit), you can either purchase the unlimited extension or manually increase the limit: Access Azure Portal: Go to your Azure portal and type in "App Services". Select your app service. Use SSH to Modify File Size Limits: Scroll down to Deployment Tools and click on SSH. Click on Go to access the backend of the app service. Create a file in the home site wwwroot directory named .user.ini. Edit the File: Use the command nano /home/site/wwwroot/.user.ini. Add the following lines to increase the upload and post max size: upload_max_filesize = 1G post_max_size = 1G Save the file by pressing Ctrl + X, then Y, and Enter. Verify and Import: Refresh your WordPress site on Azure. Import the file again, and it should bypass the previous limit. Final Steps Once the migration is complete, you may want to delete the .user.ini file you created earlier. Use the command: rm /home/site/wwwroot/.user.ini References techcommunity.microsoft.com/blog/nonprofittechies/deploying-a-wordpress-site-on-microsoft-azure-a-guide-for-non-profits-with-video/4415254?previewMessage=true Resolving Host Restrictions on File Sizes Exceeding 50 MB in WordPress on Azure for Nonprofits | Microsoft Community HubDeploying a WordPress Site on Microsoft Azure: A Guide for Non-Profits (With Video Tutorial)
This guide is particularly beneficial for non-profits, as a strong online presence is essential for sharing your mission, attracting donors, and engaging with volunteers. Azure offers an affordable, secure, and scalable solution, allowing non-profits to focus on their impact while Azure handles the infrastructure. By the end of this session, you'll understand the key steps for deployment and how Azure can support your non-profit's digital transformation. Getting Started with Azure First, ensure you have an Azure subscription or an Azure account. If you don't have one, you can sign up at portal.azure.com. Step-by-Step Deployment Process Access Azure Marketplace Go to the Azure portal and click on "Create a resource." Search for "WordPress" in the Azure Marketplace. Choose Deployment Method There are various ways to deploy WordPress, but we recommend using Azure App Service. Click on "Create" and select the standard plan. Configure Your WordPress Site Resource Group: Select an existing resource group or create a new one. This is a container for all resources related to your website. Region: Choose the region closest to you for better performance. For example, select "Central US." Site Name: Give your site a name. Select a Hosting Plan Free: Trial version. Basic: Suitable for hobby projects. Standard: Recommended for production sites. Set Up WordPress Credentials Create a username and password for your WordPress admin portal. Review and Create Fill in the required details and click "Review and create." After validation, click "Create" to deploy your site. Additional Features and Considerations Managed Identity: Securely access Azure services without storing secrets. Email with Azure Communication Services: Send bulk emails efficiently. Azure Content Delivery Network (CDN): Distribute content globally for faster load times. Azure Front Door: Optimize website access by directing traffic through the fastest routes. Azure Blob Storage: Store large files like images and videos without slowing down your site. Networking and Virtual Networks: Enhance security by isolating resources. Staging Environment: Test changes before deploying them to your live site. High Availability: Ensure your site remains accessible even if one zone goes down (available with premium plans). Tags: Categorize resources for better management and reporting. Reference Once your site is created, you can access it and start customizing. You may also want to add a custom domain to your WordPress site. For more detailed guides, check out our follow-up articles on deploying your WordPress site. Deploying Your Nonprofit's Website on Azure (Part 2) | Microsoft Community Hub Deploying Your Nonprofit's Website on Azure (Part 3) | Microsoft Community Hub Pricing Calculator | Microsoft AzureUnlock the Power of Azure Database for MySQL servers
After deploying your web app, you would want to access and manage your database in Azure. If you are unsure how to deploy a WebApp in Azure, follow this article: Building a Web App and Database in Azure for Nonprofits | Microsoft Community Hub. This guide provides step-by-step instructions for nonprofits to connect to their Azure MySQL Database. Step-by-Step Instructions Log in to Azure Portal: Visit the Azure Portal: https://portal.azure.com/ Use your credentials to log in. Locate Your Database: Navigate to Resource Groups and select the group where your database is hosted. Click on your Azure SQL Database. Select Networking: In the settings, select Networking. In the image above, the MySQL database is situated within a Virtual Network (VNet). This configuration ensures the database is isolated from the internet, allowing communication solely between resources within the VNet. The most efficient method to access the database is via a virtual machine deployed within the same VNet. Additionally, ensure the virtual machine is deployed in the same region as the MySQL database. Step-by-Step Guide to Deploying a VM in Azure Sign in to Azure Portal: Visit the Azure portal and sign in with your Azure account: https://portal.azure.com Create a Virtual Machine: In the search bar, type "Virtual machines" and select it from the services. Click on "Create" and then "Azure virtual machine". Configure Instance Details: Enter a name for your VM (e.g., myVM). Choose the image (Ubuntu Server 24.04) Select the size of the VM based on your requirements. Set Up Administrator Account: Provide a username (e.g., azureuser) and a strong password. Configure Networking: Under "Inbound port rules", select the ports you want to allow. Please allow port ssh (22). Select Networking: Under Vnet, ensure that the virtual machine is still on the same Virtual network as the MySQL database. Review and Create: Click on "Review + create" to validate your settings. Once validation is complete, click "Create". Connect to Your VM: After deployment, go to the resource and select "Connect" > SSH. Connect with ssh using Azure CLI: Select configure + connect Download and install mysql-client tool to connect to the server. For this example the database is a MySQL database sudo apt-get update sudo apt-get install mysql-client Connect to the MySQL database Go back to the MySQL resource Click on reset password if you have forgotten the password. Once the password is changed, select connect and select connect from browser or locally. Copy the code that was displayed. You can see the example from the picture above. Paste the connection code into the virtual machine to establish a connection to the MySQL database. Upon successful connection, a welcome message will be displayed. You can then proceed to use MySQL commands to create and manage your tables. Conclusion By following these steps, nonprofits can securely access and manage their Azure SQL Database. In the next part, we’ll explore how to deploy your web application codes. Additional Resources Connect With Private Access in the Azure Portal - Azure Database for MySQL - Flexible Server | Microsoft Learn Networking Overview - Azure Database for MySQL - Flexible Server | Microsoft LearnMake your own private ChatGPT
Introduction Creating your own private ChatGPT allows you to leverage AI capabilities while ensuring data privacy and security. This guide walks you through building a secure, customized chatbot using tools like Azure OpenAI, Cosmos DB and Azure App service. Why Build a Private ChatGPT? With the rise of AI-driven applications, organizations, people often face challenges related to data privacy, customization, and integration. Building a private ChatGPT addresses these concerns by: Maintaining Data Privacy: Keep sensitive information within your infrastructure. Customizing Responses: Tailor the chatbot’s behavior and language to suit your requirements. Ensuring Security: Leverage enterprise-grade security protocols. Avoiding Data Sharing: Prevent your data from being used to train external models. If organizations do not take these measures their data may go into future model training and can leak your sensitive data to public. Eg: Chatgpt collects personal data mentioned in their privacy policy Prerequisites Before you begin, ensure you have: Access to Azure OpenAI Service. A development environment set up with Python. Basic knowledge of FastAPI and MongoDB. An Azure account with necessary permissions. If you do not have Azure subscription, try Azure for students for FREE. Step 1: Set Up Azure OpenAI Log in to the Azure Portal and create an Azure OpenAI resource. Deploy a model, such as GPT-4o (multimodal), and note down the endpoint and API key. Note there is also an option of keyless authentication. Configure permissions to control access. Step 2: Use Chatgpt like app sample You can select any repository to be as base template for your app, in this I will be using the third option AOAIchat. It is developed by me. GitHub - mckaywrigley/chatbot-ui: AI chat for any model. Azure-Samples/azure-search-openai-demo: A sample app for the Retrieval-Augmented Generation pattern running in Azure, using Azure AI Search for retrieval and Azure OpenAI large language models to power ChatGPT-style and Q&A experiences. sourabhkv/AOAIchat: Azure OpenAI chat This architecture diagram represents a typical flow for a private ChatGPT application with the following components: App UX (User Interface): This is the front-end application (mobile, web, or desktop) where users interact with the chatbot. It sends the user's input (prompt) and displays the AI's responses. App Service: Acts as the backend application, handling user requests and coordinating with other services. Functions: Receives user inputs and prepares them for processing by the Azure OpenAI service. Streams AI responses back to the App UX. Reads from and writes to Cosmos DB to manage chat history. Azure OpenAI Service: This is the core AI service, processing the user input and generating responses using models like GPT-4o. The App Service sends the user input (along with context) to this service and receives the AI-generated responses. Cosmos DB: A NoSQL database used to store and manage chat history. Operations: Writes user messages and AI-generated responses for future reference or analysis. Reads chat history to provide context for AI responses, enabling more intelligent and contextual conversations. Data Flow: User inputs are sent from the App UX to the App Service. The App Service forwards the input (with additional context, if needed) to Azure OpenAI. Azure OpenAI generates a response, which is streamed back to the App UX via the App Service. The App Service writes user inputs and AI responses to Cosmos DB for persistence. This architecture ensures scalability, secure data handling, and the ability to provide contextual responses by integrating database and AI services. What can you do with my template? AOAIchat supports personal, enterprise chat enabled by RAG People can enable RAG mode if they want to search within their database, else it behaves like normal ChatGPT. It supports multimodality, (supports image, text input) also depends on model deployed in Azure AI foundry. Step 3: Deploy to Azure Deploy a Cosmos DB account in nearest region Deploy Azure OpenAI model (gpt-4o, gpt-4o-mini recommended) Deploy Azure App service, try using container I would recommend B1plan to your nearest region, select docker registry sourabhkv/aoaichatdb:0.1 startup command uvicorn app:app --host 0.0.0.0 --port 80 After app service starts, put all environment variables The application requires the following environment variables to be set for proper configuration: Environment Variable Description AZURE_OPENAI_ENDPOINT The endpoint for Azure OpenAI API. AZURE_OPENAI_API_KEY API key for accessing Azure OpenAI. DEPLOYMENT_NAME Azure OpenAI deployment name. API_VERSION API version for Azure OpenAI. MAX_TOKENS Maximum tokens for API responses. MONGO_DETAILS MongoDB connection string. AZURE_OPENAI_ENDPOINT=<your_azure_openai_endpoint> AZURE_OPENAI_API_KEY=<your_azure_openai_api_key> DEPLOYMENT_NAME=<your_deployment_name> API_VERSION=<your_api_version> MAX_TOKENS=<max_tokens> MONGO_DETAILS=<your_mongo_connection_string> Optional feature: implement authentication to secure access. Within app service select Authentication and select service providers. I went with Entra based authentication with single tenant. There is option of multi-tenant, personal accounts as well. Restart App service and within 2 minutes your private ChatGPT is ready. Pricing Pricing may depend on the plan you have deployed resources and region. Check Azure calculator for price estimation. My estimate for pricing I deployed all my resources in Sweden central Cosmos DB config - Cosmos DB for MongoDB (RU) serverless config with single write master, 2 GB transactional storage, 2 backup plan (FREE) ~ 0.75$ Azure OpenAI service - plan S0, model gpt-4o-mini global deployment, Input 20000 tokens, Output 10000 tokens ~ 9.00$ App service plan - OS Linux, Tier B1, instance count 1 ~13.14$ Total monthly cost = 22.89$ This price may vary in future, in region I calculated my configuration in Azure calculator Governance Azure OpenAI provides content filters to block any kind of input that violates responsible AI practices. Categories include Hate and Fairness Sexual Violence Self-harm User Prompt Attacks (direct and indirect) The content filtering system detects and takes action on specific categories of potentially harmful content in both input prompts and output completions. Azure OpenAI Service includes default safety settings applied to all models set as medium. Content filters can be modified to different level depending on use case. It supports RAG, I have provided detailed solution for it in my GitHub. Practical implementation GE Aerospace, in partnership with Microsoft and Accenture, has launched a company-wide generative AI platform, leveraging Microsoft Azure and Azure OpenAI Service. This solution aims to transform asset tracking and compliance in aviation, enabling quick access to maintenance records and reducing manual processing time from days to minutes. It supports informed decision-making by providing insights into aircraft leasing, compliance gaps, and asset health. For enterprises implementing private ChatGPT solutions, this illustrates the potential of generative AI for streamlining document-intensive processes while ensuring data security and compliance through cloud-based infrastructure like Azure. GE Aerospace Launches Company-wide Generative AI Platform for Employees | GE Aerospace News Build your own private ChatGPT style app with enterprise-ready architecture - By Microsoft Mechanics How to make private ChatGPT for FREE? It can be FREE if all of the setup is running locally on your hardware. Cosmos DB <-> MongoDB. Azure OpenAI <-> Ollama / LM studio Refer this NOTE : I have used gpt-4o, gpt-4o-mini these values are hardcoded in webpage, if you are using other models, you might have to change them in index.html. App Service <-> Local machine Register for Github models to access API for FREE. Note: GitHub models have rate limit for different models. Useful links sourabhkv/AOAIchat: Azure OpenAI chat What is RAG? Get started with Azure OpenAI API Chat with Azure OpenAI models using your own dataHow to Purchase a Domain in Azure: A Step-by-Step Guide
At the heart of this post is Kairos IMS, an innovative Impact Management System designed to empower human-serving nonprofits and social impact organizations. Co-developed by the Urban League of Broward County and our trusted technology partner, Impactful, Kairos IMS reduces administrative burdens, enhances holistic care, and enables organizations to leverage data for increased agility and seamless service delivery. In this blog series, we’ll take a closer look at the powerful technologies that fuel Kairos IMS, from Azure services to security frameworks, offering insight into how modern infrastructure supports mission-driven impact. Click here to learn more. How to Purchase a Domain in Azure: A Step-by-Step Guide Purchasing a domain in Azure is a straightforward process that allows you to create a custom web address for your applications. Whether you're setting up a personal blog, a business website, or an app, Azure makes it easy to manage your domains. Here's a step-by-step guide to help you get started. Step 1: Prerequisites Before you begin, ensure you have the following: An Azure subscription with a paid tier (App Service domains aren't supported on free trial or credit-based subscriptions). An existing App Service app or create a new one in an Azure Public region. To learn more about creating a new App Service app, please visit: Deploying a Web App on Azure App Service | Microsoft Community Hub ⚠️ Important: You cannot proceed with purchasing a domain through the App Service experience without first creating or selecting an existing App Service app. Step 2: Navigate to Custom Domains Log in to the Azure Portal: Go to portal.azure.com and sign in with your Azure account and click on "App Services." Please note: If you do not see App Services you may need to search for it in the search bar. Select Your App Service: Navigate to the App Service app you want to associate with your domain. Custom Domains: Under "Settings", you will see the "Custom Domains" option. Click on it to manage your custom domains. Step 3: Purchase a Domain Buy App Service Domain: Click on "Buy App Service domain." Configure Domain Settings: Subscription: Choose the subscription to use for purchasing the domain. Resource Group: Select the resource group where the domain will be placed. Domain Name: Enter the domain name you want (e.g., contoso.com). If your desired domain isn't available, Azure will suggest alternatives. Contact Information: Provide accurate contact information as required by ICANN for domain registration. Ensure you have access to the email address provided. Hostname Assignment: Verify the default hostnames to map to your app, such as the root domain (e.g., contoso.com) and the 'www' subdomain (e.g., www.contoso.com). Step 4: Complete the Purchase Review and Purchase: Review your settings and click "Buy" to complete the purchase. Confirmation: You will receive a confirmation email from GoDaddy, the domain registrar used by Azure. Step 5: Configure DNS Settings DNS Management: After purchasing the domain, you can manage DNS settings directly in Azure. Navigate to the "DNS Zone" in the Azure portal to configure records such as A, CNAME, and MX. For information on how to Create an Azure DNS zone and record using the Azure portal, please visit: Quickstart: Create a public DNS zone and record - Azure portal - Azure DNS | Microsoft Learn Map Domain to App: Ensure your domain is correctly mapped to your App Service app by verifying the DNS settings. You can learn more about buying and managing an app Service domain, by visiting: Buy and configure an App Service domain - Azure App Service | Microsoft Learn Conclusion Purchasing a domain in Azure is a seamless process that integrates well with your existing Azure services. By following these steps, you can easily set up a custom domain for your applications, enhancing your online presence and making your web address more memorable.Deploying Your Nonprofit's Website on Azure (Part 3)
Welcome to the third part of our series on deploying your nonprofit's website on Azure. In this installment, we'll explore how to create a custom domain for your website, enhancing your organization's online presence and credibility. We'll cover two options: adding a custom domain and buying an App Service domain. If you have missed the previous guides, please see part 1 and 2 below: Part 1: Deploying Your Nonprofit's Website on Azure (Part 1) | Microsoft Community Hub Part 2: Deploying Your Nonprofit's Website on Azure (Part 2) | Microsoft Community Hub Adding a Custom Domain Step 1: Navigate to Your App Service Follow the first part of accessing your WordPress site from this article: Deploying Your Nonprofit's Website on Azure (Part 2) | Microsoft Community Hub. Once you are done you will reach your app service overview page. Step 2: Add a Custom Domain Click on Add custom domain. Select Add custom domain Step 3: Configure DNS Settings Copy the necessary A and TXT records to your domain provider. If you need assistance locating your domain provider records, reach out to t Ensure the DNS records propagate, which may take up to 48 hours. Step 4: Enable SSL Navigate to the TLS/SSL settings in your App Service. Bind an SSL certificate to your custom domain to enable HTTPS. Follow this article for a step by step guide: Secure your domain with TLS/SSL - Azure App Service | Microsoft Learn Buying an App Service Domain Step 1: Navigate to Your App Service Follow the first part of accessing your WordPress site from this article: Deploying Your Nonprofit's Website on Azure (Part 2) | Microsoft Community Hub. Once you are done you will reach your app service overview page. Under Domains, select Add Custom domains. Step 2: Buy an App Service Domain Click on Buy App Service domain. In the Basics tab, configure the following settings: Subscription: Select the subscription to use for buying the domain. Resource Group: Choose the resource group to place the domain in. Domain: Enter the domain name you want (e.g., yourdomain.org). If the domain is unavailable, select from suggested available domains or try a different name. Step 3: Provide Contact Information Fill out the required contact information as per ICANN regulations. Ensure accuracy to avoid issues with domain registration. Step 4: Assign Hostnames Verify the default hostnames to map to your app: root (@): The root or apex subdomain (e.g., yourdomain.org). www: The www subdomain (e.g., www.yourdomain.org). Step 5: Complete the Purchase Review your settings and click Buy. Azure will process the purchase and configure the domain. Once it is deployed, the website will miss a TLS/SSL certificate. See picture below. Follow this article on how to add TLS/SSL certificate to make the connection secured using HTTPS Secure your domain with TLS/SSL - Azure App Service | Microsoft Learn Conclusion Creating a custom domain for your nonprofit's website on Azure is a crucial step in establishing a professional online presence. Whether you choose to add a custom domain or buy an App Service domain, Azure provides the tools and support to make the process seamless. Follow these steps to enhance your nonprofit's website and reach a wider audience.Deploying Your Nonprofit's Website on Azure (Part 2)
In Part 1 of our guide, we covered the initial steps to deploy your WordPress site to Azure. Here is the link to the first guide: Deploying Your Nonprofit's Website on Azure (Part 1) | Microsoft Community Hub. Now, in Part 2, we'll dive into how to access your WordPress site and configure the backend to ensure everything runs smoothly. Accessing Your WordPress Site Once your WordPress site is set up on Azure, accessing it is straightforward. Follow these steps: Navigate to Your Site URL: Open your web browser and go to the URL of your WordPress site. If you are unsure on how to access the website url, go back to the Azure portal using this link. Home - Microsoft Azure Click on resource groups: Then select the name of the resource groups that was deployed. Click on the App service resource: Click on the name of the app service that was deployed. Select the URL of your website: Click on the link that shows default domain. Once it is clicked, you will be directed to your website. Log In to the Admin Dashboard: To access the backend, append /wp-admin to your site URL (e.g., https://<your-site-name>.azurewebsites.net/wp-admin). Enter the admin username and password you created during the setup process. Explore the Dashboard: Once logged in, you'll be taken to the WordPress admin dashboard. This is where you can manage your site's content, settings, and plugins. Configuring the Backend The WordPress admin dashboard, also known as the backend, is the control center for your website. Here's how to configure it: Customize the Dashboard: The dashboard provides an overview of your site's activity. You can customize it by adding or removing widgets to suit your needs. This helps you keep track of important metrics and updates. Manage Posts and Pages: Use the "Posts" and "Pages" sections to create and manage your site's content. You can add new posts, edit existing ones, and organize them into categories and tags. Install and Configure Plugins: Plugins extend the functionality of your WordPress site. To install a plugin, go to the "Plugins" section, click "Add New," and search for the plugin you need. Once installed, configure the plugin settings as required. Customize Themes: The "Appearance" section allows you to customize your site's look and feel. You can choose a theme, customize it, and even add custom CSS for more advanced styling. Set Up Menus: In the "Appearance" section, you can also create and manage menus. This helps you organize your site's navigation and improve user experience. Configure Settings: The "Settings" section is where you can configure various aspects of your site, such as general settings, writing settings, reading settings, and more. Make sure to review and adjust these settings to match your nonprofit's needs. Security and Maintenance Ensuring the security and smooth operation of your WordPress site is crucial. Here are some tips: Regular Updates: Keep your WordPress core, themes, and plugins up to date to protect against security vulnerabilities. Backup Your Site: Regularly back up your site to prevent data loss. Monitor Performance: Use Analytics, site health and Azure Monitor to track your site's performance and identify any issues. Conclusion By following these steps, you can effectively access and configure the backend of your WordPress site on Azure. This will ensure that your nonprofit's website runs smoothly, remains secure, and provides a great user experience. Follow this next guide on how to add your own custom domain: Deploying Your Nonprofit's Website on Azure (Part 3) | Microsoft Community Hub.Modernizing Legacy Applications in your Nonprofit
In this blog, we’ll explore how nonprofits can modernize their existing applications to enhance security without starting from scratch. By leveraging Microsoft Azure’s powerful tools, organizations can strengthen their defenses, improve performance, and ensure their applications remain secure and scalable for the future. Securing Legacy Applications Without Rebuilding from Scratch For many nonprofits, starting over isn’t an option—they need to secure and modernize the applications they already have. Fortunately, Microsoft Azure provides solutions that help organizations enhance security without requiring a complete rebuild: ✅ Containerization with Azure Kubernetes Service (AKS) – Nonprofits can containerize legacy applications and host them in a secure, scalable environment, reducing vulnerabilities without rewriting the entire application. This approach helps keep security updates and compliance requirements in check while maintaining the existing software functionality. ✅ Incremental Modernization with Cloud-Native Services – Instead of a full-scale rebuild, nonprofits can gradually modernize their applications by integrating cloud-native services. This could involve migrating databases to Azure SQL, implementing API-driven architectures, or introducing automation through Azure Logic Apps. This phased approach enhances security, improves performance, and allows for future scalability without disrupting core operations. ✅ Azure SQL Database – Helps nonprofits move from outdated, on-premises databases to a fully managed cloud database, reducing maintenance efforts while improving security, performance, and compliance. ✅ Azure API Management – Allows organizations to connect legacy systems with modern cloud-based services by securely exposing APIs, enabling seamless integration and extended functionality. Understanding Your Options When considering the modernization of legacy applications, there are several strategies that organizations can adopt, each with its own benefits and considerations: Rehost (Lift-and-Shift) This strategy is all about speed and simplicity. It involves moving applications from their current environment to a new one with minimal or no changes to the code. This allows organizations to quickly transition to the cloud without altering the core functionality of their applications. Replatform Replatforming sits between rehosting and refactoring. It requires making some code changes so that applications can take advantage of cloud technologies. This approach allows organizations to benefit from cloud capabilities without needing a complete overhaul of their applications. Refactor (or Repackage) Refactoring focuses on enhancing productivity and speed by making minimal code changes. This strategy ensures that applications can connect easily to a cloud-first environment, optimizing their performance and scalability. Rearchitect For organizations that need enhanced cloud scalability, rearchitecting is the way to go. This approach involves modifying and extending the application's functionality and code to better utilize cloud resources, ensuring improved performance and scalability. Rebuild (or Rewrite) When existing applications have limited functionality or lifespan, rebuilding them using cloud solutions might be necessary. Although this approach requires significant effort, it provides a fresh start with modern capabilities and extended lifespans. Replace If an application no longer meets current or future business needs, even after rebuilding, replacing it with a ready-made solution may be the best option. This approach can be quicker than rebuilding and allows organizations to focus on other priorities. However, it may also pose challenges such as business process interruptions and limitations on future modernization efforts. Nonprofit Considerations Wrapping up, we agree that nonprofits rely on technology to drive their missions, but outdated applications can pose serious security risks. We've covered how organizations don’t have to start from scratch to modernize and secure their systems. By leveraging Microsoft Azure’s powerful tools—like containerization, cloud-native services, and secure database management—nonprofits can enhance security, improve performance, and ensure long-term scalability. Here is one thing to consider: Nonprofits may not have the technical team to assist with these processes, but understanding these strategies is crucial. This knowledge can empower them in conversations with development partners, ensuring they are fully aware and engaged throughout the modernization journey. By being informed, nonprofits can make better decisions, ask the right questions, and collaborate effectively with their partners to achieve their modernization goals. Modernization isn’t just about keeping up with technology; it’s about protecting the trust nonprofits have built with their donors, volunteers, and communities. Whether it’s securing legacy applications or embedding security into new software development through the Secure Software Development Lifecycle (SSDLC), taking proactive steps today ensures a more resilient and secure future. On the contrary, for nonprofits that do want to start over from scratch with building new applications, integrating security from the start is essential. Learn more about how SSDLC can strengthen your organization’s software security here: Building Secure Software from the Ground Up: Why It Matters for Nonprofits | Microsoft Community Hub Want to explore nonprofit application modernization further? Check out this guide: What is Application Modernization? | Microsoft Azure.Building Secure Software from the Ground Up: Why It Matters for Nonprofits
What Is the Secure Software Development Lifecycle (SSDLC)? The Secure Software Development Lifecycle (SSDLC) integrates security into every phase of the traditional Software Development Lifecycle (SDLC). Instead of treating security as a final step before software deployment, SSDLC ensures that security measures are embedded from day one. This approach reduces vulnerabilities and strengthens nonprofit organizations against cyber threats. Key Phases of SSDLC and Why They Matter Planning & Requirements Identify security risks before development begins: This involves understanding potential threats and vulnerabilities that could affect the software. Define compliance needs: Ensure that the software meets regulatory requirements such as GDPR, HIPAA, and donor data protection. Design Use secure architecture principles to mitigate risks: Design the software with security in mind, incorporating principles that reduce potential risks. Implement encryption, authentication, and access control measures: Ensure that data is protected through encryption, and that only authorized users can access the system. Development Follow secure coding best practices: Prevent vulnerabilities like SQL injection, cross-site scripting (XSS), and unauthorized access by adhering to secure coding standards. Use automated security scanning tools: Detect issues early in the development process by employing tools that automatically scan for security vulnerabilities. Testing Conduct penetration testing, security audits, and code reviews: Uncover weaknesses by thoroughly testing the software's security. Simulate cyberattacks to test software resilience: Ensure the software can withstand real-world attacks by simulating various cyber threats. Deployment & Maintenance Monitor for security threats and apply regular updates: Continuously watch for potential security issues and keep the software up-to-date with the latest patches. Conduct incident response drills: Prepare for potential breaches by regularly practicing how to respond to security incidents. How Nonprofits Can Implement SSDLC with the Right Tools Understanding SSDLC is one thing—putting it into practice effectively is another. Many nonprofits lack dedicated cybersecurity teams or technical expertise, making it difficult to integrate security throughout the development process. This is where Microsoft’s Security Development Lifecycle (SDL) comes in. Leveraging Microsoft’s Security Development Lifecycle (SDL) Practices Microsoft’s Security Development Lifecycle (SDL) is a structured approach that aligns with SSDLC principles, providing security best practices and tools to help organizations—including nonprofits—develop secure applications. Some of the key SDL practices that nonprofits should incorporate include: 🔹 Perform Security Design Review and Threat Modeling – Nonprofits often handle sensitive data, such as donor information and beneficiary details. Conducting thorough security design reviews and identifying potential security risks early in the development cycle through threat modeling helps protect this sensitive information and ensures compliance with regulations. 🔹 Require Use of Proven Security Features, Languages, and Frameworks – Nonprofits may have limited resources, so it's crucial to use reliable security features, programming languages, and frameworks that are known to minimize vulnerabilities. This ensures that the software is built on a secure foundation without requiring extensive custom security solutions. 🔹 Perform Security Testing – Regularly run comprehensive security tests, including penetration tests and vulnerability assessments, to identify and address security flaws. This practice is essential for nonprofits to maintain the trust of their donors and beneficiaries by ensuring that their data is secure. 🔹 Implement Security Monitoring and Response – Continuously monitor for security threats and have a robust incident response plan in place to address potential breaches. Nonprofits need to be prepared to quickly detect and effectively manage any security incidents to minimize the impact on their operations and stakeholders. 🔹 Provide Security Training – Educate and train staff on security best practices and the importance of maintaining a secure development lifecycle. Nonprofits often rely on volunteers and staff who may not have extensive technical backgrounds, so ongoing security training is crucial to prevent security breaches and ensure everyone understands their role in maintaining security. This list showcases some of the essential SDL practices that can greatly benefit nonprofits. For a comprehensive overview, please view the following resources: Microsoft Security Development Lifecycle Practices. Learn how Microsoft supports secure software development as part of a cybersecurity solution - Training | Microsoft Learn Microsoft Tools That Support Secure Development To help nonprofits implement SSDLC and SDL, Microsoft offers several security-focused tools that integrate directly into the software development process. ✔ Microsoft Defender for DevOps – Protects code repositories and CI/CD pipelines from security threats, ensuring security is embedded throughout the development lifecycle. ✔ Azure DevOps Security Tools – Integrates security checks into DevOps workflows with automated scanning for vulnerabilities in code, dependencies, and containerized applications. ✔ Microsoft Defender for Cloud – Provides real-time security monitoring, threat detection, and compliance management for cloud-based applications. This helps nonprofits maintain continuous security visibility across Azure and hybrid environments. ✔ Azure Key Vault – Secures application secrets, encryption keys, and certificates, preventing unauthorized access to sensitive credentials used in nonprofit applications. ✔ Azure Web Application Firewall (WAF) – Helps protect nonprofit web applications from common threats like SQL injection, cross-site scripting (XSS), and bot attacks by filtering and monitoring traffic. ✔ Azure Policy – Automates security compliance checks within Azure environments, ensuring nonprofit applications and services follow best security practices throughout their lifecycle. Bringing It All Together For nonprofits, cybersecurity isn’t just an IT issue—it’s a mission-critical priority. A data breach can compromise donor trust, expose sensitive beneficiary information, and disrupt critical operations. By integrating Microsoft’s SDL practices and security tools into the Secure Software Development Lifecycle (SSDLC), nonprofits can: ✅ Proactively reduce cybersecurity risks before they become major threats. ✅ Protect donor and beneficiary data from unauthorized access. ✅ Ensure compliance with data privacy regulations. ✅ Strengthen trust with stakeholders who rely on them. By leveraging Microsoft’s security tools, nonprofits can build safer, more resilient applications—even without large security teams. This blog discusses building applications and incorporating security from the very beginning phases of development. If you are a nonprofit with applications that you may not have the budget to rebuild from the ground up, you can learn about modernizing and upgrading the security for your legacy applications here: Modernizing Legacy Applications in your Nonprofit | Microsoft Community HubGetting secrets from Key Vault in YAML pipeline
If you have ever created an Azure App Service or Azure Function App that uses app settings, then you have dealt with the problem of how you are going to get those settings secure and updated correctly in each environment. You need a secure location to store this information and then be able to access it during your deployment process. Azure Key Vault and using the Azure Key Vault task inside a deployment pipeline in Azure DevOps can solve this problem for you. If you prefer video, then have a look at this as it will walk you through the steps of getting this setup.
