Field notes · 11 min read
The No-Fluff Guide to Hybrid Cloud Migration: Building Infrastructure That Actually Works
Most hybrid cloud migration decks look the same: a marketecture diagram, an arrow to Azure, a shrug about identity. What actually ships is a mess of half-migrated mailboxes, an AD nobody wants to touch, and Conditional Access policies written by three different people. This is the sequence I use in production — identity first, endpoints second, workloads last.
Why hybrid, not all-in
Pure-cloud looks great in a slide deck. In the field, most enterprises have a line-of-business app the vendor will not certify on Azure, a factory-floor system that must stay local, or a compliance regime that pins data to a specific country. Hybrid is not a stepping stone — it is the honest target state for the next three-to-five years.
The mistake is treating hybrid as "some servers here, some there." Real hybrid means one identity plane, one policy plane, one endpoint management plane — spanning both locations. Get those three planes right and the workloads become swappable.
Azure infrastructure assessment — before you commit
Every migration I have rescued had one thing in common: nobody did a real assessment. Someone ran the Azure Migrate scan, exported a spreadsheet, and treated it as gospel. An assessment is not a scan output — it is a decision document.
- Inventory every workload with its licensing, dependencies, RTO/RPO, and data residency requirement — not just its CPU and RAM
- Map identity dependencies: which apps still Kerberos-auth, which use LDAP, which have their own local user store
- Classify data by sensitivity before you plan storage — GDPR, HIPAA and internal IP tiers each have different Azure landing zones
- Cost model at least three scenarios: lift-and-shift, refactor to PaaS, retire. The cheapest option on paper is often the most expensive to operate
- Score every workload on business criticality and migration complexity — those two axes decide sequence, not the vendor's preferred order
Do not trust vendor documentation from 2019 as a design input. Half of it references Azure AD Connect settings that no longer exist and Intune UX that has been rewritten twice. Verify every non-trivial config in the current portal before you write it into your run book.
Identity first — Microsoft Entra ID migration
Identity is the whole game. If Entra ID is not solid, every workload you move inherits a broken trust boundary. This is the phase to over-invest in.
- Deploy Entra Connect Sync (or Cloud Sync for greenfield-ish estates) with password hash sync — even if you plan on federation, you want the fallback
- Clean up on-prem AD before you sync: stale accounts, duplicate UPNs, mismatched proxyAddresses. Bad data replicates faster than it can be fixed in the cloud
- Roll out MFA to admins first, then privileged users, then the whole tenant — never all at once
- Baseline Conditional Access: block legacy auth, require MFA for all users, require compliant device for admin portals
- Enable Privileged Identity Management for every eligible admin role — standing admin access is the single biggest blast-radius risk
Related reading: Microsoft Entra ID for small and medium businesses — the same principles, sized for a smaller estate.
Modern endpoint management with Intune
Once identity is trustworthy, endpoints become the next enforcement point. Intune (Microsoft Intune / Endpoint Manager) replaces GPO as the primary policy plane — treat GPO as legacy from day one.
Autopilot for new devices
Every new laptop ships with Autopilot, no imaging server. The user unboxes, signs in with their Entra ID, and Intune builds the device.
Compliance policies drive Conditional Access
'Compliant device' is only meaningful if Intune actually enforces the rules — disk encryption, minimum OS, EDR present. Never trust just the enrollment flag.
Co-management, not full ripping
Existing SCCM/ConfigMgr fleets co-manage into Intune workload by workload. Compliance and Conditional Access move first; app deployment last.
BYOD via App Protection Policies
Personal phones and tablets get MAM without enrollment — the corporate data is protected inside Outlook and Teams, the device stays personal.
Field notes from the last big rollout: migrating 500 users to Intune — lessons learned.
Microsoft 365 migration strategy — workloads in the right order
With identity and endpoints locked in, workloads become almost boring — which is exactly what you want. The order matters more than any individual cutover technique.
- Exchange Online first — a mailbox migration exposes every identity, licensing and Conditional Access problem you missed. Better to find them here than during SharePoint cutover
- OneDrive for Business as the file-share replacement — enable Known Folder Move so Desktop, Documents and Pictures roam automatically
- SharePoint and Teams last — SharePoint migrations are the longest, and Teams sits on top of both Exchange (calendaring) and SharePoint (files)
- Retire on-prem Exchange when the last shared mailbox and calendar delegation is verified — not before, and keep one hybrid server for management until you fully cut sync
- Kill legacy protocols the moment you can: POP, IMAP, basic auth for SMTP AUTH. Every day they stay on is a day of brute-force attempts
Zero Trust architecture — the connective tissue
Hybrid networks quietly break every assumption of the old "inside the firewall equals trusted" model. Zero Trust is not a product — it is the operating principle that keeps hybrid safe: every request verified, no implicit trust from location.
- Verify explicitly: user identity, device compliance, location, session risk — evaluated on every access request
- Least-privilege access: PIM for admin roles, just-in-time elevation, no standing production access for engineers
- Assume breach: segment east-west traffic in Azure with NSGs and Azure Firewall, log everything to Sentinel, alert on the deltas
- Protect data at the object level: sensitivity labels in Purview travel with the file into email, chat and external shares
- Retire the VPN mindset: Entra Private Access and Global Secure Access replace the always-on tunnel with per-app, identity-aware access
Zero Trust cannot be bolted on after migration. Every workload you move should ship with its Conditional Access, its logging and its network segmentation from day one. Retrofitting these later is where most "we'll harden it in phase two" projects die.
FAQ
Should I migrate everything to Azure at once?
No. A big-bang migration is where most projects fail. Start with identity, then endpoints, then workloads in order of business risk. Hybrid is not a fallback — it is the target state for most enterprises for years.
What is the biggest mistake in a hybrid cloud migration?
Treating it as a network project. It is an identity project. If Entra ID, Conditional Access and Intune are not in the right shape before you move workloads, you inherit every on-prem trust assumption into the cloud.
How long does a real Microsoft 365 migration take?
For 200–1000 users: 4 to 9 months if identity and endpoints are already modern. 12 to 18 months if you are also detangling legacy AD, file shares and mixed device ownership at the same time.
Do I still need on-premises Active Directory after migration?
Usually yes for a few years. Line-of-business apps, printers and RADIUS still lean on it. Plan the AD sunset as its own project once the last dependency is retired, not as day-one scope.
How does Zero Trust fit into a hybrid model?
Zero Trust is what makes hybrid safe. Every access request — cloud or on-prem — is verified against user, device, location and risk signals. It replaces the old 'inside the firewall = trusted' model that hybrid networks quietly break.
Key takeaways
- Do the assessment as a decision document, not a spreadsheet export.
- Identity first — Entra ID, MFA, Conditional Access and PIM before any workload moves.
- Endpoints via Intune and Autopilot; treat GPO as legacy.
- Workloads in order: Exchange, OneDrive, SharePoint, Teams — never all at once.
- Zero Trust is the operating model that makes hybrid safe. Bake it in per workload, not as a phase-two afterthought.
Related reading: more on Entra ID and Intune specialties, past enterprise migration projects, more deep dives into Microsoft 365 and Azure, and consultation on cloud readiness assessments.
Planning a hybrid cloud migration or an Azure landing-zone build? This is what I do in production.
Let's talk →