Datacenter Migration to Azure: Why, How and Which Tools to Use in 2026

Most datacenter exits don’t start with a cloud strategy. They start with a date: a colocation contract ending, a storage array leaving support, a VMware renewal quote, or an operating system that stops receiving patches. The date forces a decision. How good that decision is depends on how well you know what you own, why each piece should move, and what the target platform must look like before the first server crosses the wire.

This post is for CIOs, cloud architects, migration leads and IT managers, especially in regulated EU organizations, who are planning to move a datacenter estate to Microsoft Azure. It covers the drivers and the honest caveats, the strategy as Microsoft’s Cloud Adoption Framework (CAF) frames it today, the landing zone and operating foundations, and the tools by phase, including what changed in 2025 and 2026. It ends with common pitfalls and a 30/60/90-day plan. For VMware-heavy estates, read it alongside VMware migration to public cloud. For the program view, see the Cloud Migration Handbook.

Key takeaways

  • Deadlines set the sequence. Strategy sets the depth. Contract, hardware, licensing and end-of-support dates decide the order; business goals decide how much you modernize on the way.
  • Azure isn’t automatically cheaper, and ESUs aren’t automatically free. Since April 1, 2026, Microsoft prices new Extended Security Update (ESU) offerings the same inside and outside Azure.
  • Use CAF as it stands today: seven phases and eight migration strategies. Rationalize the portfolio before moving anything.
  • Build the landing zone first, with the IaC accelerator on Azure Verified Modules and subscription vending. Make EU Data Boundary and sovereignty decisions before the first subscription exists.
  • Azure Migrate is the hub for discovery, dependencies, business case, waves and server migration. Several AI-assisted features are still in preview, and the classic agent-based replication experience retired on September 30, 2026.
  • Run operations, security and FinOps from wave one, and treat decommissioning as a deliverable.

Why organizations exit the datacenter

The hard deadlines

  • Lease, colocation and outsourcing contracts. The most common forcing function. Work backwards from the end date, including notice periods, data removal and certified hardware disposal.
  • Hardware refresh. Servers, storage or network gear leaving vendor support turns into a capital decision. Azure converts it to operating cost, but only if the old equipment actually goes.
  • VMware licensing. Broadcom’s changes reach Azure VMware Solution (AVS) too. Since November 1, 2025, new AVS deployments need a portable VMware Cloud Foundation (VCF) subscription from Broadcom. License-included pay-as-you-go deployments must transition by October 31, 2026, and license-included reserved instances by August 30, 2027.
  • End-of-support software. The last Windows Server 2012/2012 R2 ESU shipped on October 13, 2026. SQL Server 2016 left extended support on July 14, 2026, and Windows Server 2016 follows on January 12, 2027. In a regulated estate, each unpatched server is a future audit finding.

The strategic goals

  • Resilience. Availability zones, zone-redundant storage, Azure Backup and Azure Site Recovery give you recovery options that are expensive to build across two owned sites. For financial entities this ties directly to DORA.
  • Security and compliance. Microsoft Entra ID, Azure Policy and Microsoft Defender for Cloud give you one control plane and continuous evidence, which supports NIS2 obligations in energy, healthcare and manufacturing.
  • Scalability. Capacity becomes a configuration choice instead of a procurement cycle.
  • AI readiness. The current CAF landing zone architecture includes Microsoft Foundry as an optional workload capability, and Azure Migrate reports can target a “PaaS (AI-ready)” path. Rehosted VMs don’t become AI-ready by moving. The value comes from modernizing the data tier.
  • Sustainability. Azure Migrate business cases estimate on-premises versus Azure emissions. After the move, Carbon optimization in the Azure portal tracks emissions down to resource level.

Honest caveats

Cost isn’t automatically lower. Microsoft’s own guidance for on-premises teams says that with IaaS “the operational load doesn’t decrease … The load shifts.” You still patch, back up and secure guest operating systems while learning Azure networking, identity and cost management. A rehost-only migration often costs the same or more until you right-size, commit through reservations or savings plans, apply Azure Hybrid Benefit and move suitable components to PaaS.

The ESU argument has changed. Microsoft’s March 2026 pricing consistency update means customers pay the same list price for ESU offerings released on or after April 1, 2026, whether they run in Azure, on-premises or in another cloud. Existing offerings such as Windows Server 2012 and SQL Server 2014 aren’t affected. SQL Server 2016 ESUs are explicitly no longer free on Azure VMs, and Microsoft’s Azure Local documentation lists Windows Server 2016 under the new pricing. Get confirmed Windows Server 2016 ESU costs from your account team before they go into a business case.

Residency and sovereignty need explicit decisions. Microsoft completed the EU Data Boundary with Wave 3 in February 2025. Read the details: Azure Resource Manager can be configured for the EU Data Boundary only in a new tenant with no existing subscriptions, and some limited data, such as certain Microsoft Entra directory data, can still be replicated outside it. For stricter needs, Microsoft Sovereign Cloud (formerly Microsoft Cloud for Sovereignty) offers three models. Sovereign Public Cloud adds controls such as Data Guardian and External Key Management in EU regions. Sovereign Private Cloud runs on Azure Local in facilities you control. National Partner Clouds are run by local partners in a few geographies, such as Germany and France.

Regulation shapes the plan. DORA has applied since January 17, 2025 and requires exit strategies for ICT services that support critical or important functions. In November 2025 the European Supervisory Authorities designated Microsoft Ireland Operations Limited a critical ICT third-party provider. The EU Data Act switching rules have applied since September 12, 2025, and from January 12, 2027 providers generally can’t charge switching fees. Personal data stays under GDPR throughout the move.

How: the migration strategy

Use the Cloud Adoption Framework as it is today

Microsoft has restructured CAF over the last two years, so older diagrams mislead. The current framework has seven phases. The first four run in sequence. Govern, Secure and Manage run in parallel and continue into operations.

CAF phaseKey decision (CAF wording)In a datacenter exit
StrategyWhat should our Azure adoption look like?Drivers, exit date, success metrics, sovereignty position
PlanHow will we prepare for Azure adoption?Inventory, rationalization, business case, skills
ReadyHow will we build our Azure landing zone?Platform landing zone, connectivity, identity, subscription vending
AdoptHow will we migrate, modernize, and build workloads?Waves, migration factory, cutover, decommissioning
GovernHow will we control our Azure environment?Azure Policy, cost guardrails, compliance evidence
SecureHow will we protect our Azure environment?Zero Trust, Defender for Cloud, incident response
ManageHow will we operate and optimize Azure over time?Monitoring, patching, backup and DR, using CAF’s RAMP model (Ready, Administer, Monitor, Protect)

Within Adopt, the Migrate methodology runs in five steps: plan migration, prepare workloads, execute migration, optimize in cloud and decommission source. CAF’s Sovereignty and Azure VMware Solution scenarios build on this and are the most relevant for regulated EU estates.

Assess and rationalize the portfolio

For existing estates, CAF Plan runs through prepare, plan, discovery, select, assess, estimate and document. The output is a decision for every workload, using CAF’s eight strategies:

StrategyUse it whenTypical outcome
RetireLow business value, or migration costs more than it returnsDecommission; archive regulated data
RetainStable and compliant with no near-term driver, or held back by latency or regulationStays on-premises, managed through Azure Arc
RehostMinimal disruption needed, no immediate modernizationAzure Virtual Machines, or AVS for VMware
ReplatformPaaS benefits with minimal code changeFor example, SQL Server to Azure SQL Managed Instance
RefactorCode changes reduce technical debt or optimize for cloudFor example, a .NET app adapted for App Service
RearchitectArchitecture must change to use cloud-native capabilitiesFor example, Functions and Cosmos DB instead of VMs
ReplaceA SaaS or AI solution fits with little customizationSaaS subscription; retire the old platform
RebuildThe legacy system is too outdated to fix economicallyNew cloud-native implementation

With a fixed exit date, most workloads end up rehosted or replatformed. Microsoft’s guidance says the same: “Complete the migration first, then optimize and modernize.” That’s sound, provided “later” has a budget and an owner. Record decisions in the tool, using Azure Migrate reserved tags (preview) for environment (Prod, Dev, Test, UAT) and migration intent (Migrate, Retain, Retire), because these tags change how assessments size and price workloads. Microsoft’s guidance for on-premises teams adds two warnings: verify criticality labels, because a “non-production” database may have quietly picked up production use, and don’t size from physical server specifications, which are often inherited from other workloads.

Build a business case people will sign

The Azure Migrate business case compares on-premises and Azure total cost of ownership and year-over-year cash flow. It also models an “on-premises with Azure Arc” scenario, savings from Azure Hybrid Benefit and management tooling, and sustainability impact. You choose a preference: Modernize (PaaS first, IaaS fallback), Migrate (IaaS), Azure Virtual Machines only, or Azure VMware Solution. Microsoft recommends waiting at least a day after discovery starts. In practice, a collection window that covers month-end or seasonal peaks sizes better. Then add what the tool can’t see: dual-running, connectivity, partner fees, training, contract exit costs and decommissioning effort. Present a range, and refine it after each wave.

Landing zone first

An Azure landing zone has two parts. The platform landing zone holds the management group hierarchy, the centralized resources (connectivity, security monitoring, identity services, management), and a repeatable way to hand out environments. Most organizations need one per Microsoft Entra tenant. Workload landing zones, which older material calls application landing zones, hold each workload’s dev, test and production subscriptions. They sit under the Online, Internal (“Corp”) or Local management groups and inherit policy from there.

  • Deploy with the accelerator. CAF recommends the Azure Landing Zones IaC Accelerator. It uses Bicep or Terraform built on Azure Verified Modules (AVM), wires up GitHub or Azure DevOps pipelines, and runs in four phases: planning, prerequisites, bootstrap and run. A portal accelerator exists, but you’ll want code by the second wave.
  • Vend subscriptions. Subscription vending gives workload teams an official front door, using the AVM Bicep module (avm/ptn/lz/sub-vending) or the Terraform lz-vending module. Define product lines such as corp-connected and online, so each wave lands in a governed, pre-networked subscription.
  • Decide sovereignty controls up front. The Sovereign Landing Zone applies policy as code for residency, confidential computing and location controls. It’s currently available through the Terraform AVM modules and the accelerator.
  • Treat generated designs as drafts. The Azure Copilot Migration Agent can produce a landing zone configuration and downloadable templates from your requirements. Review the output against your design-area decisions.

Hybrid connectivity

You’ll run hybrid for the whole program, so connectivity is on the critical path. CAF’s data-path guidance: use ExpressRoute when you have it, VPN when you don’t, Azure Data Box for large offline volumes, and the public internet only for non-sensitive data. ExpressRoute Direct offers dual 10, 100 or 400 Gbps ports with MACsec on the physical links. ExpressRoute Metro dual-homes a circuit across two peering locations in one city at the cost of a standard circuit. Site-to-site VPN covers the period before circuits arrive, and can run over ExpressRoute private peering if you need end-to-end encryption. Plan IP ranges and hybrid DNS early. CAF recommends against overlapping ranges between production and DR networks.

Identity

Microsoft Entra ID is the control plane for everything you deploy. For hybrid identity, Microsoft’s direction is Microsoft Entra Cloud Sync, with a phased transition away from Entra Connect’s sync engine and customer notifications starting in July 2026. New designs should assume Cloud Sync wherever its scale limits fit. Applications that still need Kerberos or NTLM need domain controllers in the identity subscription or Microsoft Entra Domain Services. Use managed identities in place of service accounts, and Privileged Identity Management for admin roles. Azure Migrate now has built-in roles (Azure Migrate Owner, Decide & Plan Expert, Execute Expert), so the migration team doesn’t need subscription Owner.

Wave planning and the migration factory

CAF’s wave rules are simple. Plan iteratively, detailing only the next wave. Keep dependency groups together. Move non-production before production. Include one or two representative complex workloads early, so you meet the hard problems while stakes are low. Check progress at 25%, 50% and 75% of each wave. Azure Migrate supports this with wave planning (preview), which can also track migrations run with other tools, and auto wave planning (preview, September 2026). Auto wave planning generates waves from inventory, assessments, application mapping and dependencies, applies rules such as separating production from dev/test, and scores each wave for priority, confidence and risk. Use it for a first draft, then apply business calendars and team capacity.

The migration factory makes this repeatable: standard intake, a runbook covering replication, test migration, cutover, hypercare and handover, and named roles for wave lead, engineers, application owners, testers and operations. Run it from a backlog, and build targets with infrastructure as code.

Pick the right first movers

The pilot wave should prove the factory, not test the platform’s limits. Good first movers have real users but low criticality, few dependencies, a representative stack (a Windows or Linux VM, a SQL Server database, an IIS app) and an engaged owner. CAF suggests internal tools, development environments and low-usage standalone apps. Keep ERP, core transactional systems and anything near OT networks for later.

Cutover patterns

PatternWhen it fitsHow on Azure
Replicate and cut overMost rehosted serversAzure Migrate replication, test migration in an isolated network, final sync with the source shut down
Online database replicationCritical databases, tight windowsManaged Instance link, Log Replay Service, Azure DMS online mode
Backup and restoreWorkloads that tolerate an outageNative backup to URL, Azure DMS offline mode, Data Box seeding plus delta sync
Parallel run, traffic shiftCustomer-facing web tiersLow DNS TTL, weighted routing via Azure Front Door or Traffic Manager, source kept as hot standby

Whatever the pattern, follow CAF’s execution guidance. Enforce a change freeze in your pipelines. Agree rollback triggers and decision authority before the window opens. Validate data with checksums, not just row counts. Watch closely for the first 24 to 48 hours, and keep the source available as a fallback until the business signs off.

Operations from the first wave

  • Azure Monitor with the Azure Monitor Agent and data collection rules. The legacy Log Analytics agent is retired, and its uploads can stop at any time after March 2, 2026.
  • Azure Update Manager for patch compliance across Azure VMs and Arc-enabled servers.
  • Microsoft Defender for Cloud. Foundational CSPM is free. Defender CSPM adds attack path analysis. Defender for Servers Plan 2 adds agentless vulnerability, malware and secrets scanning on top of Plan 1’s Defender for Endpoint integration.
  • Azure Backup and Azure Site Recovery from day one. Use Site Recovery for Azure-to-Azure DR. Microsoft recommends Azure Migrate, not Site Recovery, for the migration itself.
  • Azure Arc so that retained servers get the same policy, patching and Defender coverage as Azure VMs.

Don’t design post-migration dependency mapping around VM insights Map or the Dependency Agent, both of which retire on June 30, 2028. And as Microsoft’s migration guidance puts it: “Factor Azure training into your migration timeline. Don’t plan to conduct training after cutover.”

FinOps from day one

Define tags (owner, cost center, environment, wave, application), enforce them with Azure Policy, and enable tag inheritance in Microsoft Cost Management. Give every vended subscription a budget and anomaly alerts, and split shared platform costs with cost allocation rules. Commit to reservations, the savings plan for compute and Azure Hybrid Benefit only after right-sizing on real Azure telemetry. Review Azure Advisor every wave, and track dual-running cost as a program KPI, because that’s the cost that grows quietly when decommissioning slips.

Decommission deliberately

CAF treats decommissioning as a governed step. Get formal approval from business and technical owners against agreed success criteria. Preserve data that falls under retention rules, using Blob Storage immutability policies and legal holds where regulation requires them. Update diagrams, monitoring, the CMDB and runbooks. Remove temporary network extensions and firewall exceptions. Then reclaim licenses, cancel contracts and dispose of hardware with certificates. If you skip this step, you pay twice and keep the security exposure.

Tools by phase

Azure Migrate is free for discovery, assessment and planning. For server migration, there are no tool charges for 180 days from the start of replication for each VM; you pay for replication storage and network, and for compute used in test migrations.

PhaseToolWhat it doesStatus (October 2026)
DiscoverAzure Migrate applianceContinuous discovery of VMware, Hyper-V and physical servers, software, databases, web apps and performance dataRecommended. Required for agentless dependency analysis and agentless VMware migration
DiscoverCollector; CSV or RVTools import; Arc-based discoveryOffline snapshot for restricted networks; quick import for an early business case; assessments from Arc-enabled serversArc-based discovery is in preview. RVTools isn’t Microsoft software; download it only from official sources after its May 2025 supply-chain attack
DependenciesAgentless dependency analysis; network discovery and assessmentServer connections with process and port, multi-server maps, application grouping; VMware and NSX network inventory and target recommendationsAgent-based analysis exists only in the classic view, scheduled for deprecation by end of 2026. Network features are in preview
DecideBusiness case, Reports, security insightsTCO and ROI, executive summaries, unsupported software and CVE exposureReports and security insights are in preview
PlanAzure Copilot Migration AgentNatural-language analysis of inventory, readiness, strategies, business case, wave proposals and landing zone configurationPreview, enabled by administrators. For EU customers, agent data is processed and stored in EU regions
PlanWave planning, auto wave planningGroup, sequence and track waves; generate recommended waves with scoresPreview
Migrate serversAzure Migrate: Migration and modernizationAgentless VMware and Hyper-V; agent-based for VMware, physical and other clouds; test migrations; Trusted Launch targetsClassic agent-based experience fully retired September 30, 2026; use the simplified experience. Trusted Launch migration is GA
Migrate databasesAzure DMS; SQL Server migration in Azure Arc; SSMS migration component; Managed Instance link; Log Replay ServiceAssess and migrate SQL Server to Azure SQL targets, online or offlineAzure Data Studio and its Azure SQL migration extension retired February 28, 2026. Data Migration Assistant is deprecated
Migrate web appsAzure Migrate web app migration; App Service Migration Assistant; Managed Instance on Azure App Service; GitHub Copilot modernization for .NETASP.NET on IIS to App Service; hosting for apps that need COM, registry changes or MSI installersManaged Instance is GA for Windows web apps in select regions on Pv4/Pmv4, with no domain join. Check your EU region
Move dataAzure Storage Mover; Data Box 120 and 525; Data Box Disk; AzCopy v10Online SMB and NFS migration; offline bulk transfer; scripted copiesData Box Heavy is retired. Microsoft recommends Storage Mover above 1 TB, and Data Box Disk below 40 TB
VMware estatesAzure VMware SolutionvSphere on dedicated Azure hosts with minimal changeGen 2 (AV64, deployed into a VNet) is recommended for new deployments. Portable VCF required. Host quota approval can take up to five business days
Hybrid and secureAzure Arc; Microsoft Defender for CloudInventory, policy, patching and ESU delivery outside Azure; posture management and server protectionUse Arc before migration and for retained workloads
OptimizeCost Management, Azure Advisor, pricing calculator, Carbon optimizationBudgets, anomalies, allocation, recommendations, emissionsThe Emissions Impact Dashboard for Azure retires March 31, 2027

For regulated organizations, create the Azure Migrate project in an EU geography (Europe, or a country geography such as Spain, France or Germany), because the geography determines where discovery metadata is stored. Azure Migrate also supports Private Link if public endpoints are off the table.

Funding and Microsoft help

In July 2025 Microsoft announced Azure Accelerate, which brought Azure Migrate and Modernize, Azure Innovate and Cloud Accelerate Factory into one offer. Microsoft’s Azure pages now present it as Frontier Accelerate for Azure, part of Microsoft’s FY27 Frontier Accelerate framework. It includes Cloud Accelerate Factory (zero-cost deployment help from Microsoft experts across more than 30 Azure services, delivered with partners), partner delivery funding, Azure credits, a funded migration assessment, a sandbox and skilling. Eligibility criteria aren’t published, so engage through your account team or an Azure specialized partner, and confirm current terms, which change between fiscal years. FastTrack for Azure retired on December 31, 2024. If you have Microsoft Unified, its Enhanced Solutions add proactive services and Designated Engineering. Unified doesn’t include ESUs.

Third-party tools

Partner tools still fit unusual sources, very tight windows or CMDB integration. Microsoft lists integrations such as Carbonite Migrate, RackWare and Zerto for migration, and Cloudamize, Device42 and Turbonomic for assessment. Weigh them against what Azure Migrate now does for free, and remember that its wave tracking can include migrations run with other tools.

Common pitfalls

  1. Migrating before the landing zone exists. Every workload placed in an ungoverned subscription gets moved again or retrofitted.
  2. Trusting the CMDB. Skipping dependency analysis is the fastest route to a broken application after cutover.
  3. Sizing from hardware. Copying on-premises specifications into Azure inflates the first invoice.
  4. Old business case assumptions. “Free ESUs in Azure” doesn’t hold for the 2016 generation, and IaaS doesn’t remove operational work.
  5. Connectivity on the critical path. Late ExpressRoute orders, overlapping IP ranges and unplanned DNS changes stall waves that are otherwise ready.
  6. Runbooks built on retired tooling. Rewrite anything that still uses the classic replication appliance, the Azure Data Studio migration extension, the Log Analytics agent or Data Box Heavy.
  7. Accepting AI output unreviewed. The Copilot agent and auto wave planning are useful but in preview. Review their output like a junior architect’s draft.
  8. Deferring operations, security and training until the first incident is already open.
  9. No exit plan. DORA expects one for critical functions. Write it while you design the entry.
  10. Never finishing. Without decommissioning milestones and an owner, the old datacenter lives on next to the new bill.

For application-level lessons, see lessons learned from application migrations. If SAP is in scope, plan it as its own track: SAP migration to Azure.

Where to start: a 30/60/90-day plan

Days 1–30: mobilize and discover

  • Name a sponsor and program lead. Agree the drivers, the exit date and three to five measurable success criteria.
  • Build a contracts and lifecycle register: leases, hardware support, VMware renewals, end-of-support dates and ESU exposure.
  • Decide the tenant, EU Data Boundary, sovereignty controls and regions before creating any subscription.
  • Create the Azure Migrate project in an EU geography, deploy appliances (or the collector), and import RVTools or CSV data for a first business case.
  • Ask your account team or partner about Frontier Accelerate funding, and start the skills plan.

Days 31–60: decide and build the foundation

  • Rationalize: tag environment and intent, confirm dependency groups with owners, and assign a strategy to each workload.
  • Produce business case version one as a range.
  • Deploy the platform landing zone with the IaC accelerator and subscription vending. Bring up VPN and order ExpressRoute.
  • Stand up the operations baseline (Azure Monitor Agent, Update Manager, Defender for Cloud, Backup) and the FinOps baseline (tags, budgets, alerts).
  • Pick pilot workloads and run test migrations.

Days 61–90: prove the factory

  • Migrate the pilot wave, non-production first and then one low-risk production workload, using the full runbook and rollback criteria.
  • Measure duration, defects, cost against estimate and user impact. Feed the results back into the runbook and business case.
  • Draft the next two or three waves with auto wave planning, then constrain them with business calendars.
  • Decommission the pilot’s source servers properly, so everyone sees the process end with things switched off.
  • Report a re-baselined plan, risks and funding status to the steering group.

After 90 days you should have a governed platform, a proven factory, a credible business case and a wave plan tied to your exit date. The rest is disciplined repetition.

Sources

Last reviewed: October 2026.

One response to “Datacenter Migration to Azure: Why, How and Which Tools to Use in 2026”

  1. […] Use Azure Migrate and Azure Database Migration Service, testing at each stage. See our guides to datacenter migration to Azure, VMware migration and SAP migration to […]

Leave a Reply

Rares Juretchi

Rares Juretchi

Rares is a cloud and enterprise architect with over 25 years of IT experience. He has led or architected over 100 cloud programs in regulated industries, including healthcare, finance, manufacturing and energy, and specializes in Azure landing zones, migrations and governance, with AWS alongside.

The blog offers practical guidance on:

  • Cloud migration strategy and execution
  • EU digital regulation (NIS2, DORA, the AI Act and more) for cloud teams
  • Cloud security frameworks and compliance
  • Landing zones and cloud governance

Read the full profile →

Let’s connect

Discover more from Information Technology Blog

Subscribe now to keep reading and get access to the full archive.

Continue reading