Overview
HABInsurance is an insurance company that operates in three states and provides home, auto, and boat insurance. The company has a head office and three regional offices.
Existing Environment:
HABInsurance hosts its primary workloads in an on-premises datacenter located at the head office. The regional offices connect to the datacenter over VPN connections via the internet.
Network
The on-premises datacenter uses a flat network topology. All servers are deployed in a single subnet.
Internet access is provided through a centralized firewall. There is no existing ExpressRoute connection.
Identity
HABInsurance has two Active Directory forests: main.habinsurance.com and region.habinsurance.com.
Some users exist in both forests, but there is no trust relationship between the forests.
Applications
The company's primary internal system is the Insurance Processing System (IPS). IPS is an ASP.NET application written in C# and hosted on IIS servers running Windows Server in the on-premises datacenter.
IPS has a three-tier architecture: Web tier hosted on IIS servers Business logic API tier hosted on IIS servers Data tier hosted on database servers
The application has the following characteristics: The web and API tiers are stateless Session state is stored in the database tier
The application supports horizontal scaling
The application currently uses Windows authentication internally
Data platform
Customer data is stored in a Microsoft SQL Server database named IPSCustomers. The database size is approximately 500 GB and is expected to grow by 20 percent annually. Workload patterns vary significantly during the day.
Insurance forms and documents are stored in a MongoDB database. The application uses MongoDB APIs and drivers extensively. The company requires minimal code changes during migration.
File storage
The company stores approximately 10 TB of Human Resources (HR) data on a NAS device at the head office. The data is accessed by using the SMB protocol and NTFS permissions must be preserved.
Users in regional offices frequently access this data.
Requirements
General
HABInsurance plans to migrate its workloads to Azure. The company has purchased an Azure subscription.
The solution must minimize administrative overhead and support future scalability.
Identity requirements
The company must implement a hybrid identity solution that integrates with Microsoft Entra ID.
All users must have a single identity across both forests.
The solution must support synchronization of both forests to Microsoft Entra ID.
The company plans to use administrative units to delegate management.
Users must be able to access Microsoft 365 services by using the same credentials as on-premises resources.
Application requirements
The IPS application must be migrated to Azure with minimal code changes.
The web and API tiers must automatically scale based on CPU utilization.
The compute platform must provide an SLA of at least 99.95 percent.
The solution must support future migration to containers.
The company plans to implement a customer self-service portal and expose selected APIs securely to external users.
Data requirements
SQL database
The IPSCustomers database must be migrated to a fully managed Azure database service.
The solution must support independent scaling of compute and storage.
The solution must support variable workloads and optimize cost during periods of low usage.
The solution must minimize downtime during scaling operations.
The solution must support automated backups and high availability.
Document database
Insurance forms and documents must be migrated to an Azure service that supports MongoDB APIs.
The solution must require minimal application changes.
The solution must support global distribution in the future.
File storage
HR data must be migrated to Azure.
The solution must support SMB access and preserve NTFS permissions.
The solution must allow hybrid access from on-premises and Azure.
The solution must support efficient initial data transfer of 10 TB.
Networking requirements
The company plans to establish secure connectivity between the on-premises datacenter and Azure.
The solution must support private access to Azure PaaS services.
The company may implement ExpressRoute in the future.
Security requirements
The company plans to integrate internal and third-party applications with Microsoft Entra ID.
Users must be able to grant consent to applications, but administrative approval must be required for high-privilege permissions.
The solution must support conditional access policies.
High availability and disaster recovery requirements
The IPS application must be highly available within a region.
The company plans to deploy IPS to multiple Azure regions in the future.
The solution must ensure application availability during regional outages.
The solution must minimize performance impact for users accessing the application globally.