For a decade we built private clouds with Hyper-V and System Center Virtual Machine Manager: host groups, clouds, templates, library shares, desired state that was really “a well-run VMM.” Azure is not VMM in someone else’s datacenter — but the skills transfer if you map concepts honestly and unlearn the rest. This post is that translation layer for architects who shipped 400-server virtualization programs and now own landing zones.
Concept map
| Private cloud (VMM-ish) | Azure |
|---|---|
| Host groups / clouds | Management groups, subscriptions, resource groups |
| Library templates | Images, Shared Image Gallery, ARM/Bicep modules |
| Hardware profiles | VM sizes, reservations, spot where appropriate |
| Logical networks | VNets, subnets, NSGs, peerings |
| Storage classifications | Disk SKUs, storage accounts, tiers |
| Orchestration (SCORCH/runbooks) | Azure Automation, Logic Apps, Functions, GitHub Actions |
| SCOM packs | Azure Monitor, activity logs, Defender signals |
| Chargeback scripts | Cost Management, tags, budgets |
What transfers cleanly
- Capacity thinking — oversubscribe reality, noisy neighbor, storage latency
- Image discipline — golden images, patch rings, drift
- RBAC anxiety — who can create what; least privilege
- Network segmentation — east-west is still a thing
- Change control — production is production
What to unlearn
- Pet servers as the default unit of delivery — prefer scale sets / cattle where apps allow
- “The cluster is the boundary” — identity and management group design matter more
- Infinite on-prem bandwidth assumptions between tiers
- Manual portal clicking as an operating model — IaC or accept snowflakes
- DR as a second identical rack — ASR and region pairs change the drill
A learning path we use with teams
- Rebuild one app tier in a sandbox subscription with Bicep/ARM
- Wire diagnostics to Log Analytics
- Tag for cost and enforce a budget alert
- Add Azure Policy deny for public IPs where required
- Only then migrate a real workload
Skipping to production lift-and-shift teaches the wrong muscle memory.
Identity remains the hard part
VMM admins who never owned AD federation will hit Azure AD hard. Hybrid join, service principals, managed identities — budget learning time equal to “how do I make a VM.”
Extended practice notes (2021)
The remaining gap between a short checklist and a usable field note is usually scenario detail. In practice, the same engagement type described above still requires explicit answers to: what is in scope this quarter, what is deferred with a date, who can halt a wave, and how success is measured in production — not in a lab.
We document those answers before the first production change. When stakeholders disagree, the disagreement is resolved in writing, not on the bridge at cutover. That habit is independent of whether the workload is mail, identity, virtualization, desktop delivery, or security hardening.
Repeatable detail also includes communication: who tells users what changes, when the freeze starts, where status is posted, and how exceptions are requested. Technical excellence without communication still produces an outage from the user's point of view.
If you're facing this
If your private-cloud team is told to “just use Azure,” give them a concept map and a sandbox, not only a credit card. We coach VMM/Hyper-V estates into Azure landing-zone operations — bring how you structure clouds today and which apps move first.