Microsoft Azure is Microsoft’s cloud-computing platform.

Instead of purchasing and operating all of the physical infrastructure yourself, you can consume:

• computing power
• storage
• databases
• networking
• application platforms
• security services
• AI services

from Microsoft’s global cloud infrastructure.

A business might use Azure for one application.

Another might use it for almost its entire server estate.

Both can be perfectly sensible approaches.

Azure does not have to be an:

all-or-nothing cloud migration.

Azure vs Microsoft 365

This is one of the first distinctions businesses should understand.

Microsoft 365

Primarily provides productivity and collaboration services such as:

• Outlook
• Exchange Online
• Teams
• SharePoint
• OneDrive
• Word
• Excel

Microsoft Azure

Provides broader cloud infrastructure and platform services such as:

• virtual machines
• cloud networking
• databases
• application hosting
• storage
• backup
• disaster recovery
• virtual desktops
• AI

A business may therefore use:

Microsoft 365 for email and collaboration

while:

Azure hosts the application employees use to run the business.

Microsoft Entra ID provides identity and access capabilities across both environments.

Understand IaaS, PaaS and SaaS

Azure becomes much easier to understand when you know the three main cloud models.

Infrastructure as a Service — IaaS

You rent infrastructure.

Examples include:

• Azure Virtual Machines
• disks
• virtual networks

Microsoft manages the physical data centre, hardware and virtualisation layer.

You still manage more of the stack, including:

• operating system
• applications
• configuration
• security updates

Microsoft’s current shared-responsibility guidance specifically places operating-system responsibility with the customer in IaaS.

Platform as a Service — PaaS

Microsoft manages more of the underlying platform.

Examples include:

• Azure App Service
• Azure Functions
• Azure SQL Database

You can focus more on:

• application
• data
• access
• configuration

rather than maintaining complete Windows or Linux servers.

Software as a Service — SaaS

You consume a completed application.

Microsoft 365 is the obvious example.

The provider manages most of the underlying technology.

But the customer still remains responsible for things such as:

• users
• identities
• permissions
• data handling
• configuration

That last point matters enormously.

Cloud does not remove responsibility.

It changes where responsibility sits.

1. Azure Virtual Machines

Azure Virtual Machines are cloud-hosted Windows or Linux computers.

They can be useful for:

• legacy applications
• application servers
• databases
• development
• remote services
• specialist workloads

The main advantage is that you do not need to purchase the physical server underneath them.

But moving:

physical server → Azure VM

does not automatically modernise the workload.

You may simply have moved the same old server into Microsoft’s data centre.

The operating system may still need:

• patching
• monitoring
• antivirus
• backups
• application maintenance

That is why Azure design should ask whether the workload really needs a VM—or whether a managed PaaS alternative would be better.

2. Azure Storage

Azure provides multiple storage services for different workloads.

These can support:

• application data
• backups
• files
• archives
• object storage

Storage design needs to consider:

• performance
• redundancy
• retention
• access
• cost

A rarely accessed archive and a heavily used production database should not automatically use the same storage approach.

3. Azure Backup

Azure can provide off-site backup for supported workloads.

That can reduce dependence on:

• local NAS devices
• backup disks
• equipment in the same building

But remember:

cloud backup still needs a recovery strategy.

You should understand:

• retention
• recovery points
• restore process
• ransomware resilience
• recovery time

A backup you have never restored is still partly theoretical.

4. Azure Site Recovery and Disaster Recovery

Azure can also support disaster-recovery designs where workloads can be replicated and recovered elsewhere.

That can help protect against:

• hardware failure
• data-centre failure
• site loss
• major infrastructure incidents

But Azure does not automatically make an application highly available.

Microsoft’s current reliability guidance explicitly treats reliability as a shared responsibility: Azure provides resilient platform capabilities, but customers still need to design workloads appropriately.

You still need to define:

RPO — how much data can we lose?

and:

RTO — how long can we be offline?

5. Azure Virtual Desktop

Azure Virtual Desktop can provide Windows desktops and applications from Azure.

It can be useful where employees need:

• centralised desktop environments
• remote access
• access to specialist applications
• consistent workspaces

But it is not automatically the best answer for every business.

You still need to consider:

• user profile management
• application compatibility
• printing
• performance
• licensing
• network latency

For some businesses it can be excellent.

For others, standard managed laptops are simpler.

6. Azure Networking

Azure can connect:

• offices
• cloud servers
• applications
• remote users
• on-premises infrastructure

using services such as:

• virtual networks
• VPN gateways
• private connectivity
• firewalls
• load balancers

This is where cloud architecture quickly becomes more complex.

A poorly designed network can create:

• unnecessary exposure
• poor performance
• routing problems
• unexpected costs

Treat Azure networking as infrastructure—not as a few settings somebody should click through without design.

7. Azure and Microsoft Entra ID

Identity is central to modern cloud security.

Azure and Microsoft 365 commonly use Microsoft Entra ID for:

• authentication
• MFA
• Conditional Access
• role-based access
• privileged administration

This is one area Microsoft always leaves partly with the customer.

Its current shared-responsibility model says customers remain responsible for:

• accounts
• access management
• identities
• data

across cloud models.

That means Microsoft securing the data centre does not help if:

Global Administrator has a weak password and no MFA.

8. Defender for Cloud

Azure environments can also use Microsoft Defender for Cloud to help improve security posture and protect workloads.

That may include:

• recommendations
• posture management
• workload protection
• threat detection

But tools still need:

• configuration
• monitoring
• remediation

A dashboard full of alerts nobody owns does not equal security.

9. Microsoft Sentinel

Microsoft Sentinel is Microsoft’s cloud-native SIEM and security-operations platform.

It can collect and analyse security information from:

• Azure
• Microsoft 365
• endpoints
• identity systems
• third-party platforms

For organisations with meaningful security-monitoring requirements, Sentinel can be extremely powerful.

For a tiny business with no one reviewing alerts, deploying a complex SIEM may simply create cost and noise.

Use technology proportionately.

10. Azure AI Services

Azure is now also a major platform for AI workloads.

Businesses can use Azure services for:

• generative AI
• machine learning
• data analysis
• automation
• intelligent applications

But AI introduces additional responsibilities.

Microsoft’s latest shared-responsibility model specifically notes that customers remain responsible for how AI is used, including:

• sensitive data
• prompt security
• prompt-injection risks
• compliance

while Microsoft secures the underlying AI platform.

That means:

using Azure AI does not outsource AI governance.

The Five Azure Design Questions That Matter

Microsoft’s Azure Well-Architected Framework is built around five pillars.

Those pillars are an excellent way for businesses to assess any Azure workload.

Reliability

Ask:

Will it stay available when something fails?

Consider:

• redundancy
• backups
• recovery
• availability zones
• dependency failures

Security

Ask:

Who can access it, and how is it protected?

Consider:

• MFA
• Conditional Access
• least privilege
• encryption
• network controls
• monitoring

Cost Optimisation

Ask:

Are we paying for things we genuinely need?

Azure is not automatically cheaper than on-premises infrastructure.

A forgotten VM running 24/7 still generates cost.

Review:

• oversized resources
• unused storage
• idle VMs
• reservations
• licensing
• data transfer

Cost optimisation is a continuous task, not something you do only when the first large Azure bill arrives.

Operational Excellence

Ask:

Can we operate this environment consistently?

Consider:

• monitoring
• patching
• automation
• documentation
• deployment standards
• change control

If only one engineer understands how the Azure environment works, that is operational risk.

Performance Efficiency

Ask:

Does the architecture provide enough performance without unnecessary waste?

A workload that performs badly because it was undersized is not successful.

Neither is one using enormous resources it does not need.

The correct design should balance:

performance + cost + reliability.

Azure Is Not Automatically Cheaper

This deserves its own section.

Moving into Azure changes the cost model.

You may reduce:

• physical servers
• hardware warranties
• power
• data-centre space

But you may introduce recurring costs for:

• compute
• storage
• backup
• networking
• security
• data transfer

Cloud resources are also easy to create.

That makes them easy to forget.

A test VM created for:

“just a few days”

can still be running six months later.

Cost needs ongoing ownership.

Azure Is Not Automatically More Secure

Azure provides extremely capable security controls.

But security still depends on:

• configuration
• identities
• permissions
• patching
• network design
• monitoring

Microsoft’s current shared-responsibility model is explicit that customers retain responsibility for their:

• data
• identities
• access management
• configuration

even in cloud environments.

So:

Azure = secure platform

does not automatically mean:

our Azure workload = securely configured.

Azure Is Not Automatically More Reliable

Azure’s underlying infrastructure is highly resilient.

But application reliability depends on architecture.

A single Azure VM with:

• one disk
• one region
• no recovery plan

still has single points of failure.

Microsoft explicitly frames cloud reliability as a partnership between Azure’s platform capabilities and the way the customer designs the workload.

Use the resilience features your workload actually requires.

Lift-and-Shift vs Modernisation

One of the most common Azure strategies is:

lift and shift.

Take the existing server.

Turn it into an Azure VM.

That can be a perfectly sensible first migration step.

But it often preserves:

• old architecture
• old software
• old management overhead
• unnecessary operating-system maintenance

Longer term, some workloads may benefit from moving towards:

• managed databases
• App Service
• Functions
• other PaaS technologies

The aim is not to use PaaS because it sounds modern.

It is to reduce management burden where there is a genuine benefit.

Hybrid Cloud Is Often the Right Answer

Azure does not mean every server must disappear from the building.

A typical business may use:

Microsoft 365 in the cloud

Azure for one business application

local specialist equipment

local printers

cloud backup

That is a hybrid environment.

And that can be entirely appropriate.

Use the cloud where it improves:

• resilience
• access
• scalability
• management
• security

Keep workloads elsewhere when that genuinely makes more sense.

Is Azure Suitable for Small Businesses?

Yes—but usually selectively.

An SME might use Azure for:

• one specialist server
• application hosting
• backup
• disaster recovery
• Azure Virtual Desktop
• development/testing

without building a huge cloud estate.

The mistake is assuming:

small business = simple Azure.

A small company can still build an expensive or insecure Azure environment if resources are poorly designed.

Keep the architecture proportionate.

When Azure May Not Be the Best Answer

Azure may be less attractive where:

• workload is simple and already works well
• internet connectivity is unreliable
• very low latency is required locally
• specialist hardware needs direct local access
• Azure cost would exceed the business value
• application vendor does not support cloud hosting

Cloud adoption should solve a real problem.

Do not move something because:

“We should probably be in Azure.”

Questions to Ask Before Moving a Workload

Before approving an Azure migration:

1. What business problem are we solving?
2. Does the workload genuinely benefit from cloud?
3. Should it be IaaS or PaaS?
4. What happens if the service goes offline?
5. What are the RPO and RTO?
6. Who manages the operating system?
7. How is access protected?
8. How is it backed up?
9. How will it be monitored?
10. What is the realistic three-year cost?
11. How will spending be controlled?
12. Can we move away later if requirements change?

Those questions are more important than choosing a particular VM size.

A Practical Example

Suppose a business has an ageing physical server hosting one line-of-business application.

Option A:

Buy another physical server.

Option B:

Move the existing server into an Azure VM.

Option C:

Move the application to a vendor-supported SaaS/PaaS platform.

All three may be valid.

The correct decision depends on:

• application support
• performance
• resilience
• cost
• management

Azure is an option.

Not the objective.

How Hamilton Group Can Help

Hamilton Group can help businesses design Azure around actual operational requirements instead of migrating systems simply because cloud sounds modern.

We can assist with:

• Azure readiness assessments
• cloud migration
• Azure Virtual Machines
• Azure Virtual Desktop
• Azure Backup
• disaster recovery
• hybrid infrastructure
• cloud networking
• Microsoft Entra ID
• Defender for Cloud
• Microsoft Sentinel
• Azure cost optimisation
• Microsoft 365 integration
• ongoing managed cloud support

The aim is not:

“Move everything to Azure.”

It is:

“Use Azure where it provides clear improvements in resilience, security, performance, flexibility or cost.”

Visit hgmssp.com or call 0330 043 0069 to discuss Microsoft Azure and cloud infrastructure.