Azure Solutions Architecture · AZ-305 · Architecture Case Studies · by Raushan Ranjan, MCT
The Problem: Migrating a Legacy System and Launching a New One
Fabrikam Residences is a rapidly growing building contractor with an immediate need to modernize its IT infrastructure. The company has two main challenges:
- Project Management (PM) Software: The existing on-premises system is outdated, insecure (relying on FTP), and has a single point of failure in its SQL Server database. The company needs to migrate this system to a secure, resilient cloud environment.
- New Home Technology Solution: They are launching a new, in-house business line for home automation, which requires a scalable, highly available solution for data ingestion, real-time alerting, and a new customer-facing website.
1. Project Management Software Solution
Why I Chose Each Component
Compute: Azure Virtual Machines (VMs) The existing application is a third-party Windows application that runs on an NLB cluster with a SQL Server backend. The easiest migration path, without re-engineering the application, is to "lift-and-shift" the application's components to Azure VMs. This directly replaces the on-premises servers, maintaining compatibility with the existing software. We will use two VMs for the application, mirroring the on-premises NLB cluster, and a separate VM for the SQL Server backend.
Database: Azure SQL Database (Business Critical Tier) The current SQL Server has a single point of failure. We need to increase its resilience. Azure SQL Database is a fully managed service that provides built-in high availability and automated backups. We'll choose the Business Critical service tier because it offers the highest level of resiliency, faster failover times, and built-in replicas to ensure there is no single point of hardware failure. This choice directly addresses the company's requirement to avoid losing access to the database.
File Transfer: Azure Blob Storage & Azure Functions The existing FTP process is insecure and inefficient. We will replace it with a more secure, event-driven solution. Field superintendents will upload their change files to an Azure Blob Storage container, which is a highly secure and scalable service for storing unstructured data. To replace the daily scripts, we'll use a serverless Azure Function. We'll configure the function to be triggered by a "blob created" event from the Blob Storage container. This means the change files will be processed immediately upon upload, not just once a night, a key requirement. This is more secure and efficient than a scheduled FTP script.
Storage: Azure Files The current file share for images and documents is a NAS appliance. We'll replace this with Azure Files, a fully managed file share service in the cloud. We can mount the Azure Files share on the Azure VMs using the SMB protocol, making it appear as a mapped drive just like the on-premises solution. This ensures a seamless transition for the application and users.
Well-Architected Framework: Reliability and Security:
This design greatly improves the reliability of the PM software by moving from a single on-premises datacenter to a highly available cloud platform with redundant database and file storage services. It enhances security by eliminating the use of FTP, a notoriously insecure protocol, and replacing it with secure Azure services (Blob Storage) and a modern, encrypted database service (Azure SQL Database).
2. New Home Technology Solution
Why I Chose Each Component
Data Ingestion: Azure IoT Hub The company needs to collect continuous data from home sensors. Azure IoT Hub is the ideal service for this purpose. It is a highly scalable, secure, bi-directional communication service designed for connecting IoT devices (the home sensors) to the cloud. It can ingest millions of events per second, which is perfect for continuous sensor readings, and allows the company to send commands back to the devices (e.g., to adjust the thermostat).
Real-time Processing & Alerting: Azure Stream Analytics & Azure Functions For real-time alerting, we'll use Azure Stream Analytics. This service takes the incoming data stream from IoT Hub and performs real-time queries and transformations. It can be configured to trigger alerts based on specific thresholds (e.g., a security sensor being tripped). When an alert is triggered, Stream Analytics can send an output to an Azure Function, which can then send an SMS or email notification to the homeowner based on their preferences.
Relational Database: Azure SQL Database (Hyperscale) Homeowner preferences and settings are relational data, making a relational database the right choice. We need a system that is scalable and has critical redundancy. Azure SQL Database in the Hyperscale tier is the perfect solution. It can automatically and rapidly scale up to meet demand and provides high-performance, built-in redundancy that protects against single-point failures. The separate compute and storage architecture of Hyperscale allows for massive database sizes and seamless scaling.
Compute for Website: Azure App Service The new unified website will be hosted on Linux. Azure App Service is a fully managed platform that supports Linux and provides built-in auto-scaling capabilities. It can automatically handle varying loads, scaling out to meet high demand and scaling back in to save costs during low-traffic periods. This eliminates the need for manual load balancing or server management.
Authentication: Entra ID B2C The requirement to allow users to sign in without creating another account is a perfect use case for Microsoft Entra ID B2C (Business-to-Consumer). This service allows customers to sign in using their existing social accounts (like Google or Facebook) or email addresses. This provides a familiar and convenient login experience while offloading the complexities of identity management to a secure, managed service.
Security & Compliance: Microsoft Defender for Cloud & Azure Policy For weekly reports on security best practices, we'll use Microsoft Defender for Cloud. This service provides a continuous security posture assessment of all Azure resources and offers recommendations to improve security. We will use Azure Policy to enforce security controls and configuration standards across the environment. For example, a policy can be set to ensure all databases are encrypted at rest, which is a key industry best practice.
Well-Architected Framework: All Pillars
- Performance Efficiency: Services like Azure Stream Analytics, IoT Hub, and App Service are designed to handle real-time and variable loads, ensuring the system remains responsive.
- Cost Optimization: The use of scalable services like App Service and Hyperscale means we only pay for the resources we consume, avoiding over-provisioning and wasted costs.
- Reliability: The solution is highly redundant with services like Azure SQL Database (Hyperscale) and App Service's built-in scaling, ensuring the system is always available.
- Security: The design is built on a Zero Trust model, using managed security services (Entra ID B2C, Defender for Cloud) and eliminating hard-coded credentials.
- Operational Excellence: The fully managed, serverless nature of many of the services (App Service, Azure Functions) significantly reduces the operational burden on the IT team.