Cloud

An Azure tenant migration that turned portal config into code

Used an acquisition-driven tenant migration to replace portal-built infrastructure with a reviewable change path, so the old portal-only process ended with the cutover.

The problem

After an acquisition, the parent company had to absorb an entire Azure tenant: subscriptions, identities, workloads, runbooks, and mailboxes. Logic Apps, Storage Accounts, SQL resources, and runbooks had been configured through the portal without an infrastructure-as-code representation. The migration needed a reviewable and recoverable path into the destination tenant.

How we worked

  1. Assess. We used PowerShell to inventory subscriptions, identities, workloads, runbooks, and mailboxes in the legacy tenant. Microsoft Graph queries helped verify policy coverage and identify orphaned resources before cutover planning.

  2. Codify. An Azure-to-Terraform export utility scaffolded the existing Azure resources into Terraform definitions. We refactored those definitions into a reviewable representation of the destination environment, while new destination resources entered Terraform from the start.

  3. Operationalize. Infrastructure changes were reviewed and applied against the destination tenant through Terraform. The tenant-to-tenant migration of users and groups ran alongside the infrastructure work so identity coverage and resource ownership could be checked before cutover.

  4. Enable. The destination team received one change path for the migrated infrastructure and future provisioning. Portal configuration was replaced by version-controlled definitions and pull-request review instead of becoming the operating model in the new tenant.

The outcome

The migration completed with the destination infrastructure represented in Terraform. Subsequent changes moved through pull-request review instead of returning to direct portal configuration.