Migrate from Microsoft Azure to SIAX

1. 1

   Inventory per workload and sort into three piles

   Export the resource list per resource group and include the actual cost per resource for the last three months. Then sort each workload into move, keep, or retire. Many teams find resources at this step that no one uses anymore, and those should be shut down regardless of what you decide about the rest.

2. 2

   Decide what stays in Azure

   Entra ID normally stays, especially if you run Microsoft 365. The same goes for Functions and Logic Apps with deep Azure integration, where a rewrite costs more than it saves. Write down the decision and the reasoning, so you don't have to relitigate it every time someone wonders why the Microsoft bill didn't go to zero.

3. 3

   Match each workload to the right target

   App Service and Container Apps become App Hosting from 99 kr. Virtual machines become VPS from 59 kr, or a dedicated server from 890 kr when you need guaranteed cores. Azure Database for PostgreSQL becomes Managed Postgres from 89 kr. Blob Storage becomes object storage for 25 kr per 100 GB, and Azure Backup becomes our backup for 19 kr per 100 GB. Size according to actual usage, not the VM size someone picked three years ago.

4. 4

   Migrate the databases

   Check the version level and extensions in Flexible Server before you start. Take a pg_dump and run pg_restore against Managed Postgres for smaller databases, and set up logical replication for the larger ones. Verify row counts and key aggregates against the source before you repoint the application, and keep the Azure instance readable for a period afterward.

5. 5

   Move blob data and account for the egress

   Copy data with rclone or azcopy against our S3-compatible endpoint and verify checksums. Measure the data volume first: outbound traffic from Azure is billed per gigabyte, and a few terabytes becomes a real invoice. Run the transfer in batches with a final sync at the end so the last window is short.

6. 6

   Rebuild networking and authentication

   VNet, NSG, Private Link and ExpressRoute have no equivalent with us. Private traffic between environments is solved with WireGuard or Tailscale plus firewall rules. Code that uses managed identity and DefaultAzureCredential must switch to real keys in a secrets manager, with a rotation routine you own yourself. This is usually the biggest code effort in the whole move.

7. 7

   Cut over per workload and decommission properly

   Move one workload at a time and let it run in parallel until the metrics look stable. Lower the TTL before each DNS switch. Once everything is verified, tear down the Azure resources — but check your Reserved Instances and Savings Plans first, since commitments keep being billed even after the resources are gone.

• Entra ID has no equivalent with us. Either you keep it as your identity provider, which works fine, or you run Keycloak or Zitadel on your own server and take over operating your login. The latter is its own project, not a step in this one.
• Azure Functions and Logic Apps have to be rewritten. Triggers and bindings don't exist, so queue handling, timers and HTTP endpoints become explicit code in a long-running service. The result is often simpler, but it's a rewrite, not a move.
• Managed identity disappears. Any code that relies on Azure automatically handing out short-lived tokens needs real credentials and a rotation routine.
• Outbound data traffic from Azure costs money when you move out. Measure the volume before you commit to a budget, especially for blob storage and database dumps.
• Azure has ISO 27001 and SOC 2. We don't. If your customer contract or procurement process requires a certified vendor, that's a blocker, and it should be discovered now, not at contract review.

Two application servers, one Postgres, 500 GB of object storage and 100 GB of backup: two VPS at 59 kr each, Managed Postgres from 89 kr, object storage 125 kr and backup 19 kr, so roughly 351 kr per month excluding VAT at the smallest sizes. The equivalent in Azure with two B-series VMs, a Flexible Server and blob storage runs in the range of 2,500 to 3,500 kr per month at list price excluding egress, and Microsoft's prices change continuously and vary by region and commitments.

Do we have to leave Azure entirely?

No, and most people don't. The most common outcome is that compute, databases and storage move while Entra ID and anything close to Microsoft 365 stay put. You connect the environments with WireGuard or Tailscale.

Can we keep using Entra ID for login?

Yes. Your apps with us can use Entra ID as an identity provider via OIDC just like before. We don't sell a managed identity service, so the alternative is that you run one yourselves, and for most people that isn't worth the switch.

What do we do about our Reserved Instances?

They keep being billed until the term expires, regardless of whether the resources are still around. Check the commitments early and time your cutover date against them, or you'll pay for two platforms longer than you meant to.

You don't have the same certifications as Azure. How do you handle that?

We say it plainly: we have neither ISO 27001, SOC 2 nor PCI-DSS. What we offer is GDPR compliance with data processing agreements, all data in the EU, and a stack built entirely on open source that can genuinely be audited. That's enough for many, but not for everyone, and you should choose with that knowledge.

Other migration guides