Moving the Last On-Premises Servers to Azure: A Three-Server Small-Business Migration, Step by Step, with the Cost Drivers
The last rack in a 20–500-seat US business usually holds three servers: a file server, an application server with a SQL database behind a line-of-business app, and a domain controller that also runs DNS and DHCP. This is the migration we run for that trio, in order: an Azure Migrate assessment, a small landing zone with a VPN and Bastion, replication and cutover, then backup and recovery. Azure prices change often, so this article describes what drives the bill rather than printing figures.
The trio, and what each one becomes
The file server has three futures. If the data is documents, it goes to SharePoint and OneDrive and the server disappears. If an SMB share has to remain, Azure Files provides one, with identity-based access through on-premises AD DS, Microsoft Entra Domain Services, or Microsoft Entra Kerberos for hybrid and cloud-only identities; one identity source per storage account, and with Entra Kerberos clients need no domain controller connectivity to authenticate (Microsoft, September 2026). If the office needs a local cache, a Windows file server with Azure File Sync keeps a copy of the Azure file share on-premises and tiers cold files to Azure (Microsoft, August 2026). The design choices are in Azure Files done right.
The application server moves as an Azure VM first. Rewriting it for App Service or Azure SQL is a second project.
The domain controller has three options: a domain controller VM in Azure, Entra Domain Services, or retirement. Microsoft's Architecture Center guidance for a DC in Azure (June 2026): keep the AD database, logs and SYSVOL on a separate data disk with host caching set to None, use a static private IP, and run at least two DCs across availability zones or an availability set. Retirement is covered in retiring on-premises Active Directory.
Step 1: Azure Migrate discovery and assessment
Azure Migrate discovers the servers and collects performance data for a few weeks, then produces an assessment. The choices that matter (Microsoft, February 2025):
- Sizing. Performance-based sizing recommends a VM from observed CPU and memory use and a disk from observed IOPS and throughput; as-on-premises sizing copies the current server. Use performance-based.
- Comfort factor. A multiplier applied to observed utilization before sizing, to leave room for growth.
- Savings options. Pay-as-you-go, an Azure Reservation for one or three years, or an Azure Savings Plan for one or three years. Model both for servers that run all day.
- Azure Hybrid Benefit. Tick it if you hold Windows Server licenses with Software Assurance, and the VM is priced without the Windows license.
- Readiness. Each server comes back Ready, Conditionally ready, Not ready, or Unknown, with the reason.
Azure Migrate Datacenter Discovery and Assessment ($1,950 per project, 2 weeks) delivers the sized design, the readiness findings and the monthly estimate from the calculator.
Step 2: A small landing zone, a VPN and Bastion
Three servers do not need an enterprise landing zone, but they need the small one: a subscription with a budget alert, resource groups per workload, one virtual network with separate subnets for servers and Bastion, network security groups that allow only what the app needs, and tags for owner and cost center. What is an Azure landing zone explains why the structure matters at this size.
Connectivity is a site-to-site VPN from the office firewall to an Azure VPN gateway, so the office and Azure subnets route to each other and hybrid joined devices keep line of sight to the domain controller. Azure Site-to-Site VPN and ExpressRoute Implementation is $2,450 per project.
Administration goes through Azure Bastion, a managed service that provides RDP and SSH to the VMs over TLS from the Azure portal, so no VM carries a public IP address; it comes in Developer, Basic, Standard and Premium SKUs (Microsoft, February 2026). Finish with a Recovery Services vault for backup, and point the virtual network's DNS at the domain controller.
Step 3: Replicate, test, cut over
The replication method depends on where the servers run (Microsoft, May 2025). Physical servers use agent-based replication: a replication appliance plus the Mobility service on each server. Hyper-V VMs replicate agentless with the Site Recovery provider on the host; VMware VMs replicate agentless through the Azure Migrate appliance.
Run a test migration into an isolated subnet first and have the application owner run month-end. Then cut over in this order:
- Domain controller. Rather than replicating it, promote a new domain controller VM in Azure over the VPN, move the FSMO roles, and point DHCP and DNS at it.
- Application server. In a weekend window: stop the services, run the final replication delta, migrate, change DNS, start the services, test.
- File server last, with a final delta by robocopy or Azure File Sync, and the old shares set read-only for a week.
Keep the on-premises servers powered off but intact for thirty days after the last cutover. Windows Server Migration to Azure from a Physical Server is $850 per server; Hyper-V to Azure Virtual Machine Migration and File Server Migration to Azure Files and SharePoint are each from $4,950.
Step 4: Backup and recovery
Azure Backup for VMs stores recovery points in the Recovery Services vault. A backup takes a snapshot and transfers the data to the vault with no impact on the production VM; the policy chooses between an agent-based application-consistent backup and an agentless crash-consistent one, and sets retention. Microsoft charges per protected instance plus the storage the recovery points occupy, starting after the first successful backup (Microsoft, January 2026). Back up your Physical or Virtual Servers using Azure Backup ($90 per server + $500 tenant fee, 2 days) sets the vault, the policies and the first restore test.
If the servers must survive a regional outage, Azure Site Recovery replicates them to a second region with a recovery plan for failover and failback (Microsoft, September 2026). Most three-server businesses need a tested restore, not that. Azure Site Recovery Disaster Recovery Implementation is $150 per server + $2,500 tenant fee for those that do.
What runs the monthly bill
We do not print Azure prices because they change; the Azure pricing calculator has current figures. The drivers:
- Compute hours. VM size multiplied by hours running. Right-size from the assessment and commit with a reservation or savings plan for servers that run around the clock; see how the commitments work.
- Windows Server and SQL Server licensing. Azure Hybrid Benefit removes the Windows license from the VM rate if you have Software Assurance or a subscription; Azure Hybrid Benefit explained covers what qualifies, and the Windows Server calculator compares the two.
- Managed disks. Type and size, whether the VM runs or not. Premium SSD for the SQL data disk only.
- Backup. Protected instances plus recovery point storage; retention is the lever.
- Networking. VPN gateway hours by tier, Bastion hours by SKU, public IP addresses, and data leaving Azure.
- Azure Files. Capacity and, on some tiers, transactions.
- Entra Domain Services, if chosen, billed per managed domain.
- Leftovers. Orphaned disks, snapshots from test migrations, logs nobody reads.
All of these are Microsoft's metered charges on your Azure subscription. Azure performance and cost optimization assessment ($500 per project) reviews the first three months of bills.
Timeline, and the Windows Server 2016 deadline
Weeks one and two: discovery and assessment, license inventory, application owner interviews. Week three: landing zone, VPN, Bastion, vault. Weeks four and five: replication, test migration, fixes. Week six: cutover weekend. Weeks seven and eight: restore test, monitoring, decommission. Most of the calendar is spent waiting on performance data and the application vendor.
The usual trigger is a support date. Windows Server 2016 reaches end of support on 12 January 2027; a server on it either upgrades in place, buys Extended Security Updates, or moves to Azure as a new Windows Server 2025 VM with the application reinstalled, which for a three-server business is often the least work.
Frequently asked questions
How much does it cost to move a small business server to Azure?
Two numbers: the project (our fixed prices are above) and the monthly Azure consumption, which depends on VM size, hours, disks, backup, networking and whether Azure Hybrid Benefit applies. Run the assessment and the pricing calculator.
Should I move my file server to Azure Files or to an Azure VM?
Azure Files if you need an SMB share; a VM with Azure File Sync if the office needs a local cache; SharePoint and OneDrive if the data is documents.
Do I still need a domain controller in Azure?
Only if servers or devices still authenticate against Active Directory. If they do, run a DC VM in Azure or use Entra Domain Services; if they do not, retire the domain instead of moving it.
Can I use my existing Windows Server licenses in Azure?
Through Azure Hybrid Benefit, if the licenses have Software Assurance or are subscription licenses. Otherwise the VM rate includes Windows.
How long does a three-server migration take?
About eight weeks, with one cutover weekend. Two weeks of that is performance data collection for sizing.
Sources
- Microsoft Learn source files on GitHub (MicrosoftDocs/azure-docs), opened: "Agentless and agent-based migration methods in Azure Migrate", ms.date 05/09/2025; "Azure VM assessments in Azure Migrate", ms.date 02/06/2025; "Azure Files identity-based authentication overview", ms.date 09/18/2026; "Azure File Sync introduction", ms.date 08/17/2026; "What is Azure Bastion?", ms.date 02/04/2026; "About Azure VM backup", ms.date 01/08/2026; "About Site Recovery", ms.date 09/23/2026
- Microsoft Learn source file on GitHub (MicrosoftDocs/architecture-center), opened: "Deploy AD DS in an Azure Virtual Network", ms.date 06/16/2026
- Microsoft Learn source file on GitHub (MicrosoftDocs/entra-docs), opened: Microsoft Entra Domain Services overview, ms.date 02/16/2026
- Azure pricing calculator, referenced; no Azure prices are reproduced here
- IT Partner blog: content/blog/new/what-is-an-azure-landing-zone.json; azure-reservations-savings-plans-pay-as-you-go-how-commitments-work.json; azure-hybrid-benefit-explained-windows-server-sql-server-2026.json; windows-server-2016-end-of-support-january-2027.json; azure-files-done-right-architecture-decisions; retiring-on-premises-active-directory-going-cloud-only-with-entra-id-and-intune.json
- IT Partner pages: content/services/ITPWW265MIGOT, ITPWW780MIGOT, ITPWW800MIGOT, ITPWW111IMPOT, ITPWW300CONOT, ITPWW750IMPOT and ITPWW740IMPOT
- IT Partner engineering notes from small-business Azure migrations, September 2026
| Cost driver | What sets it | How to keep it down |
|---|---|---|
| VM compute | Size and hours running | Performance-based sizing; reservation or savings plan for always-on servers |
| Windows Server license | Whether Azure Hybrid Benefit applies | Existing licenses with Software Assurance or subscription |
| SQL Server license | Edition, cores, Azure Hybrid Benefit | Standard edition where it fits; right-size cores |
| Managed disks | Type and provisioned size | Premium SSD only for the database disk |
| Backup | Protected instances and recovery point storage | Sensible retention; one policy |
| VPN gateway | Tier and hours | Smallest tier that meets throughput |
| Bastion | SKU and hours | Developer or Basic SKU |
| Outbound data | Data leaving Azure | Keep chatty workloads and their clients together |
| Azure Files | Tier, capacity, transactions | Match the tier to the access pattern |
| Leftovers | Test snapshots, unused public IPs, logs | Monthly cleanup and a budget alert |
Key takeaways
- The file server becomes SharePoint, Azure Files or a VM with Azure File Sync; the app server lifts and shifts first; the domain controller moves, becomes Entra Domain Services, or retires.
- Run the Azure Migrate assessment with performance-based sizing, a comfort factor, the reservation or savings plan option and Azure Hybrid Benefit ticked.
- A three-server landing zone is one virtual network, a site-to-site VPN, Azure Bastion instead of public IPs, a Recovery Services vault and a budget alert.
- Physical servers replicate with agents; Hyper-V and VMware replicate agentless. Cut over the domain controller by promotion, then the app server, then the file server.
- The bill is compute hours, licensing, disks, backup, networking and leftovers; Azure Hybrid Benefit and a reservation are the two biggest levers, and the Azure pricing calculator gives the number.
For the trio, the fixed prices are: Windows Server Migration to Azure from a Physical Server $850 per server (5 days), Hyper-V to Azure Virtual Machine Migration from $4,950 (6 weeks), File Server Migration to Azure Files and SharePoint from $4,950 (6 weeks), and Back up your Physical or Virtual Servers using Azure Backup $90 per server + $500 tenant fee (2 days), all paid after approval. Azure consumption is billed by Microsoft on your subscription. Book a call with the server list and we will start with the assessment.
Questions this article didn’t answer?
Thirty minutes with Mike — our CEO, not a sales rep. Bring the hard version of the question.