Hosting a server in Azure does not hand all security over to Microsoft. According to Microsoft's page on shared responsibility in the cloud, "for all cloud deployment types, you own your data and identities," and you remain responsible for your accounts, your devices and the components you control. For a virtual machine, that includes the operating system, its updates and its configurations.
Short answer
You describe your current server and what it does: your request is reviewed by the Courtier TI team, then entrusted to the IT services company that will prepare your quote. The choice between keeping, replacing or moving the server is made with you.
What the quote should cover
- An inventory of the current server: roles, applications, data, users and dependencies
- The choice of hosting region and the reasons for it
- Sizing of the virtual machines and storage
- Secure remote access, without exposing the server directly to the Internet
- Backups, restore tests and, if needed, a disaster recovery plan
- Migration, testing and cutover, with a rollback plan
- Management after go-live: updates, monitoring and tracking of recurring costs
Keep, replace or move the on-site server
Not every workload benefits from becoming a virtual machine. A server used only for file sharing can sometimes be replaced by SharePoint and Teams, with no server to manage. Line-of-business software that requires Windows Server, a local database or a hardware-bound licence often calls for a virtual machine. Some equipment, such as a camera system or a plant controller, is better left on site.
The quote should therefore start from an inventory, then propose a justified option for each role of the server. Check with the publisher of each business application that it is supported on a cloud virtual machine and that your licence allows it.
What a cloud server project involves
- Inventory: what the server does, who uses it, what data it holds and what it depends on.
- Design: region, virtual machine size, storage, network, remote access and backups.
- Account security: separate administrator accounts protected by multi-factor authentication.
- Migration and testing: copying or rebuilding the server, then checks by users.
- Cutover: a planned switch, with a rollback plan if a problem occurs.
- Ongoing management: updates, monitoring, backups and cost tracking.
Hosting region and personal information
The list of Azure regions includes two regions in Canada: Canada Central, located in Toronto, and Canada East, located in Quebec. They do not offer the same options: according to that list, Canada Central supports availability zones, while Canada East does not. Ask which region is proposed, why, and where backups will be kept.
If the server holds personal information, Quebec's Act respecting the protection of personal information in the private sector requires a privacy impact assessment for a project to overhaul an information system (s. 3.3) and before communicating that information outside Québec (s. 17). Section 17 also covers entrusting the storage of that information to someone outside Québec: hosting in Toronto, for example, must therefore be assessed. The mandate given to the provider must also be in writing (s. 18.3). The Canadian Centre for Cyber Security's baseline cyber security controls also call for evaluating the legal jurisdictions where providers store or use your sensitive information (BC.10.3).
Remote access and backups
A cloud server with remote desktop open directly to the Internet attracts intrusion attempts. Microsoft describes, for example, Azure Bastion, which provides RDP or SSH connectivity without the virtual machines needing a public IP address. A virtual private network is another option. The quote should state the chosen method and who has access.
The server must also be backed up. According to Microsoft, Azure Backup provides isolated backups to guard against unintended destruction of virtual machine data. Microsoft adds, however, that this service focuses on backup and restore: disaster recovery and failover are handled by another service. Ask what is planned for each. See also our Data backup page.
Questions to ask yourself before requesting a quote
- What does the server do today, and how many people use it?
- Which business applications run on it, and does their publisher support cloud hosting?
- Does the server hold personal information or customer data?
- Do your employees work remotely, and from which devices?
- Who will manage the server after the migration: an internal resource or an IT services company?
- What monthly budget is acceptable for recurring costs?
Risks and pitfalls to avoid
- Copying the server as is without asking whether some roles could be retired
- Opening remote desktop directly to the Internet
- Forgetting that operating system updates remain your responsibility or your provider's
- Not tracking costs: according to Microsoft, a budget alert notifies you when the threshold is exceeded, but does not stop consumption
- Using the same account to administer Azure and your internal network: the Centre calls for these accounts to be separate and protected by two-factor authentication (BC.10.5)
What to specify in your request
- The role of the current server, its age and the software it hosts
- The approximate data volume and number of users
- Your data location requirements, for example in Quebec or in Canada
- How employees should connect, at the office and remotely
- Your expectations for backup and recovery after an incident
- Whether you want ongoing management of the server after the migration
- Requirements from a client, an insurer or a contract that must be met
You can then describe your project: the team will contact you to clarify your needs and provide a quote.
Frequently asked questions
Does a cloud server cost less than an on-site server?
It depends on your situation. A cloud server avoids buying hardware, but brings recurring costs: virtual machines, storage, backups, licences and management. Ask for a quote that itemizes each of these and explains what makes the bill vary.
Does our data have to stay in Quebec?
The Act does not prohibit hosting outside Québec, but it requires a privacy impact assessment before communicating personal information outside Québec (s. 17). Azure offers a region located in Quebec, Canada East, according to Microsoft's list of regions. Also check where backups are kept.
Does Microsoft take care of the server's security?
Partly. Under Microsoft's shared responsibility model, Microsoft protects the data centres, the physical network and the physical hosts, among other things. Your data, accounts, devices and configurations remain your responsibility or your provider's.
Will our employees be able to reach the server remotely?
Yes, provided secure access is planned, such as a virtual private network or a service that avoids exposing the server to the Internet. Protect that access with multi-factor authentication and limit it to the people who need it.
Do we still need to back up a server in Azure?
Yes. Hosting a server in Azure does not, by itself, protect it against deletion, ransomware or a configuration error. Microsoft presents Azure Backup as a way to protect data against accidental deletion, corruption or ransomware. Ask where copies are kept and how restores are tested.