- Client
- Multi-regional defence supplier
- Sector
- Defence
- Services
- Azure Migration, Security Enhancement
- Year
- 2025
- Timeline
- 9 months
- Read time
- 5 min read
12
Legacy sites consolidated into one Azure tenant
40%
Reduction in run-rate infrastructure costs
99.95%
Availability across the estate since cutover
01 · The challenge
What we walked into
The supplier operated twelve regional sites on hardware past end-of-life, each with its own Active Directory forest, its own backup regime, and its own way of working. Three sites ran line-of-business applications that could not tolerate more than a few minutes of downtime, and the whole estate fell under a security accreditation that was due for renewal.
A big-bang migration was never on the table. The estate had to consolidate one region at a time, keep every site running through each cutover, and produce the evidence trail the accreditation demanded.
02 · Our approach
How we got there
- 01
Discover and map the estate
Six weeks of discovery across all twelve sites, covering application dependency mapping, network baselining, and a gap analysis against the target accreditation standard.
6 weeks
- 02
Design the landing zone
An Azure landing zone with policy-as-code guardrails, hub-and-spoke networking, and segregated identity, with the accreditation requirements built in from day one so nothing had to be unpicked later.
8 weeks
- 03
Migrate region by region
Workloads moved in operational waves, each rehearsed with Azure Site Recovery and cut over inside agreed maintenance windows. No site went dark, and no deadline slipped.
16 weeks
- 04
Harden and hand over
Security baselines tuned in Microsoft Defender for Cloud, monitoring and runbooks handed to the in-house team, and the accreditation evidence pack written as we went, so it was finished when the migration was.
7 weeks
03 · The outcome
What changed
Twelve sites now run as one accredited Azure estate. Run-rate costs are 40% lower, availability has held at 99.95% since cutover, and the in-house team runs the platform day to day with the monitoring and runbooks we left behind.
One tenant, one identity
Twelve Active Directory forests consolidated into a single Microsoft Entra ID tenant with centralised conditional access.
Accreditation passed first time
Because the evidence was gathered as we went, the renewal audit came and went without turning into a project of its own.
Downtime contained to windows
Every cutover was rehearsed and reverse-tested before execution. The estate stayed operational throughout the programme.
Run-rate down 40%
Retiring duplicate hardware and licences cut run-rate costs by 40% without reducing capability.
“They planned the whole programme around our operational calendar, so we never had to choose between the migration and the day job. When the auditors arrived, the evidence was already there.”
Technologies
- Azure Landing Zone
- Microsoft Entra ID
- Azure Site Recovery
- Microsoft Defender for Cloud
- Azure VPN Gateway
- Azure Monitor
A note on confidentiality
Much of our work takes place in regulated and security-sensitive sectors, where the details of a client's environment are confidential by default. In line with our commitments to those clients, identifying details in this case study have been anonymised or generalised, while the work, the decisions, and the outcomes are described as delivered.
If you would like to know more about this engagement, we are happy to discuss it further and can share additional information on request.