Assessment (months 1-2). Run agentless discovery — Azure Migrate or AWS Application Discovery Service — for inventory, utilization, and dependency signals. Then interview: application owners, the operations team, and the compliance officer. Tooling tells you a server exists and how busy it is; only people tell you that the regulated reporting system's output goes to a supervisor on a defined schedule, that the batch job's 6am deadline is contractual, and that one box has not been rebooted since 2019 because nobody is confident it will come back. Produce one row per application with owner, dependencies, utilization, license position, regulatory relevance, and a proposed R.

R assignments. Policy administration on Oracle: rehost initially, with the vendor's supported configuration, and check Oracle licensing in cloud early because it can dominate the business case and occasionally reverses a platform decision. Customer portal on .NET and IIS: replatform to App Service or Elastic Beanstalk/containers — this is where Azure has a genuine advantage for a Windows estate and where Hybrid Benefit applies. Claims workflow: repurchase the SaaS version if data export and integration check out, removing a workload permanently. Active Directory: replatform to a hybrid identity model, extended into Entra ID or AWS Managed Microsoft AD, done in wave zero because everything depends on it. Document archive: replatform to object storage with lifecycle and immutability. Departmental apps: expect a third to retire, a third to repurchase, a third to rehost. Regulated reporting: rehost first, modernise later, because changing a system a regulator reads during a migration compounds two risks.

Landing zone (months 2-4). Separate accounts or subscriptions for production, non-production, shared services, security, and log archive, grouped under OUs or management groups. Hybrid identity established first. Hub-and-spoke network with an inspected egress firewall, dual private circuits ordered in month one because lead times are measured in weeks. Centralised logging into an immutable archive that production credentials cannot reach. Guardrails: allowed regions only, public storage access blocked, encryption required, mandatory tagging including data classification and application owner, and no unmanaged administrative access to production. Establish these before wave one, because retrofitting governance onto live workloads costs quarters.

Waves. Wave zero: identity and network foundations. Wave one (months 5-7): the departmental applications and the file shares — deliberately low stakes, designed to teach the team the cutover runbook, DNS handling, firewall change process, and hypercare rhythm where a mistake costs an afternoon. Wave two (months 8-12): the customer portal and the document archive, both meaningful but tolerant of a short outage window. Wave three (months 12-16): policy administration and the regulated reporting systems, moved with rehearsed cutovers, continuous database replication to keep downtime inside an agreed window, and a written rollback plan. Two months of contingency remain before lease expiry, which will be used, because they always are.

Document archive. Ninety terabytes over a shared link is weeks of perfect transfer nobody achieves, so use physical transfer devices — Data Box or Snowball — with a delta sync afterwards for what changed in transit. Land in object storage with a lifecycle policy moving documents to cool then archive tiers by age, and apply immutability with a retention lock matching the 10-year requirement. Verify retrieval time against the business's actual access expectations before committing to the deepest tier, and document the restore procedure, because a regulator asking for a document in year seven is a scenario that must have a rehearsed answer.

The CFO memo. Three parts. First, the business case shape: current data center cost including lease, power, hardware refresh, and the operations staff time nobody currently counts, against projected cloud steady-state cost after commitments and Hybrid Benefit. Second, the migration bubble, drawn as a curve: costs rise from roughly month five as both estates run, peak around months ten to fourteen, and fall below the current baseline only after the second data center closes. State the peak figure explicitly, because a number in a memo in month two is a plan and the same number discovered in month ten is a crisis. Third, the one number that matters — the date after which the lease cost disappears — because that is what the board actually bought. Close with the two decisions you need from them: approval of the contingency budget, and a named executive sponsor for the workloads whose owners will resist. Asking for decisions rather than approval is what turns a memo into a working relationship.