- Only users that manage the production environment by using the Azure portal must
connect from a hybrid Azure AD-joined device and authenticate by using Azure Multi-
Factor Authentication (MFA).
- The Network Contributor built-in RBAC role must be used to grant permissions to the
network administrators for all the virtual networks in all the Azure subscriptions.
- To access the resources in Azure, App1 must use the managed identity of the virtual
machines that will host the app.
- RBAC roles must be applied at the highest level possible.
Resiliency Requirements
Litware identifies the following resiliency requirements:
- Once migrated to Azure, DB1 and DB2 must meet the following requirements:
✓ Maintain availability if two availability zones in the local Azure region fail.
✓ Fail over automatically.
✓ Minimize I/O latency.
- App1 must meet the following requirements:
✓ Be hosted in an Azure region that supports availability zones.
✓ Be hosted on Azure virtual machines that support automatic scaling.
✓ Maintain availability if two availability zones in the local Azure region fail.
Security and Compliance Requirements
Litware identifies the following security and compliance requirements:
- Once App1 is migrated to Azure, you must ensure that new data can be written to the
app, and the modification of new and existing data is prevented for a period of three
years.
- On-premises users and services must be able to access the Azure Storage account that
will host the data in App1.
- Access to the public endpoint of the Azure Storage account that will host the App1
data must be prevented.
- All Azure SQL databases in the production environment must have Transparent Data
Encryption (TDE) enabled.
- App1 must NOT share physical hardware with other workloads.
Business Requirements
Litware identifies the following business requirements:
- Minimize administrative effort.
- Minimize costs.
