Azure EA-to-CSP migration for a healthcare provider, delivered within a month, with zero downtime.

Healthcare technology company · Microsoft Azure · Cloud Adoption Framework · Hub-and-spoke networking · ExpressRoute

Engagement at a glance

Enterprise Agreement-to-CSP migration completed within a one-month commercial deadline
50+ virtual machines, PACS medical imaging workload, production billing application
Zero disruption to production workloads through full migration
Cloud Adoption Framework-aligned governance baseline established alongside the migration

The business context

A healthcare technology business operating regulated workloads on Microsoft Azure faced a commercial event with a hard deadline: an Enterprise Agreement nearing expiry, a one-month transition window, and an obligation to migrate the entire Azure footprint to a Cloud Solution Provider (CSP) model without disrupting live production systems. In healthcare, without disruption is not a service-level aspiration. It is a patient-safety requirement. The estate carried real complexity: a legacy fat subscription with 50+ virtual machines, an active medical imaging (PACS) workload, a production billing application, and a hub-and-spoke network with dual ExpressRoute and VPN gateways. A like-for-like lift would have moved the technical debt with the resources. The business needed a migration that also laid the architectural foundation for a properly governed cloud environment.

The challenge

A one-month commercial window for a healthcare-grade Azure migration carries three compounding constraints. Clinical PACS workloads cannot be interrupted without affecting care. The production billing application cannot be interrupted without affecting cash collection.

The hub-and-spoke network with ExpressRoute and VPN gateways cannot be migrated in a single cutover without risking the connected estate. The challenge was to compress the program into the commercial window while landing in a structure aligned to the Microsoft Cloud Adoption Framework (CAF), not in a like-for-like copy of the legacy estate.

The Sundew approach

Sundew led the architecture and delivery of the full migration, working within the one-month window while ensuring zero regression in governance or network integrity.

Architecture first, before any resource is moved

Rather than mirroring the existing EA structure, the team designed a target-state architecture aligned to the Cloud Adoption Framework. A management group hierarchy, seven purpose-built subscriptions, and a CAF-compliant naming standard were established before a single resource moved, so the migration landed in a well-governed structure rather than inheriting legacy debt.

The seven target subscriptions were mapped across workload, environment, and platform boundaries:

Production billing application
Medical imaging (PACS)
Development and UAT
CI/CD
Legacy workloads, staged decommission
Platform and connectivity, future hub
Management and governance

Phased wave migration, ordered by risk

Resources moved in waves ordered by risk, lowest impact first, production last. CI/CD validated the pattern with minimal blast radius. PACS imaging moved next under scheduled maintenance to protect clinical uptime. Development and UAT moved in parallel. Production billing migrated under a controlled window with pre-move database snapshots and 24-hour post-migration monitoring. The legacy subscription was decanted progressively, with ExpressRoute and VPN gateway migrations handled as the highest-risk final step.

Governance baseline established in parallel

Alongside the migration, Sundew established the governance baseline: RBAC aligned to CAF, Azure Policy assignments enforcing compliance posture, Microsoft Defender for Cloud onboarding for security telemetry, and Log Analytics for operational observability. The client was positioned for a structured Azure landing zone implementation in the next phase, not left to retrofit governance after the fact.

The outcome

The full migration was completed within the one-month commercial deadline with zero disruption to production workloads. The client moved from an ungoverned, single-subscription legacy environment to a structured, CAF-aligned Azure estate, with a subscription architecture, naming standard, and governance baseline in place to support long-term growth.

The clinical PACS workload and the production billing application both maintained full uptime. The business cleared the EA renewal event and entered the next chapter of its Azure journey on a foundation engineered to scale, not the foundation it had been carrying.

What this means for your enterprise

If your enterprise is facing an Azure commercial event, an EA renewal, a CSP transition, a tenant consolidation, or a major reorganization, and the conversation is stuck on cost-comparison spreadsheets, this engagement is the architectural lesson. A commercial deadline is an architectural opportunity. Migrating a like-for-like copy moves the debt.

Designing a Cloud Adoption Framework-aligned target state first, and migrating to it, converts the commercial moment into a long-term governance foundation. For regulated industries, healthcare, financial services, insurance, and warranty, the governance baseline is not optional, and the cheapest moment to establish it is during the migration, not after.