Tag: VMware to Azure Migration Guides

The first step in migrating VMware VMs to Azure is to discover VMs using the Azure Migrate: Discovery and Assessment tool.

The Azure Migrate: Discovery and assessment tool is an Azure appliance you deploy in vCenter. When you deploy it, it continuously discovers VMware VM workloads and gathers performance information.

Specifically, this lightweight Azure Migrate tool gathers information about VM performance, applications running on the VMs servers, their dependencies, and databases.

Deploying this tool is the first step in preparing your VMware environment for a successful migration to Azure Cloud. In the remaining tasks in this guide, I’ll walk you through the steps to review the requirements for deploying this tool.

There are also steps to prepare your Azure account and VMware environment, deploy the Azure Migrate: Discovery and assessment tool appliance in vCenter, and initiate the discovery.

Let’s get this started!

Task 1: Configure Site-to-site VPN

Whenever I perform an on-premises VM to Azure migration, I first set up a site-to-site (S2S) VPN connection from the on-premises site to the Azure vNET, where the VMs will be migrated.

This is because, during the migration process, VMs you migrate to Azure can work with on-prem VMs that have yet to be migrated.

For example, migrating one VM to Azure first may be more efficient if you have a database and an app hosted in two VMs. In this scenario, you may not have enough windows to change both VMs on the same day.

So, say you move the database VM first. After the move, you can configure the app to continue using the migrated database VM. However, this would be impossible if you do not have a VPN connection to Azure.

Another great example is migrating Domain Controllers. You will likely be unable to migrate all your DCs to Azure in one change window.

If this happens, migrated DCs will continue replicating with on-prem DCs using the S2S VPN connection.

So, before proceeding with task 2 below, I strongly recommend creating a site-to-site VPN (complete steps 1 to 9) connection between your on-prem and Azure virtual network.

Task 2: Review the Discovery Prerequisites

Use the table below to ensure your environment meets the requirements for deploying the Azure Migrate: Discovery and assessment tool.

Before moving on, based on the information in the table above, confirm the following and remediate any issues:

1. Your vCenter server has at least 32 GB of RAM, 8 vCPUs, and 80 GB of storage.
2. Also, check that the vCenter server has an external virtual switch and access to the internet.
3. Check that port 443 is open on the vCenter server and all ESXi hosts it manages.
4. Confirm that your vCenter server is running at least version 5.5
5. Review the Windows, Linux, and SQL server requirements using the links provided in Table 1.0

Task 3: Prep the Azure Account

Later in this guide, you’ll create an Azure Migrate project and register an Azure Migrate appliance. To perform these tasks, you require an Azure account with the permissions detailed in the table below.

If you created the Azure account you’re using for this project, your account will be assigned “Owner” permission at the subscription level.

You could use this account to migrate in a lab or test environment. However, security best practices require applying the principle of least privilege for production migration.

I strongly recommend creating another Azure account dedicated to the migration project to meet this requirement. In the following sub-tasks, I have explained how to create an Azure account and grant it the least privileges required for the migration.

Task 3.1: Create an Azure Account

1. Search for and open Microsoft Entra ID. Then, click +Add > Users > Create new user.

2. On the new account window, complete the required fields and click Review + create. Then, click Create.

Task 3.2: Grant the Account the Required Permissions

Run the following PowerShell commands from Azure Cloud Shell to grant the account “Application Administrator” role in Microsoft Entra and “Contributor” to your subscription.

#1. Get the user the user's ID
$userID = (Get-AzADUser -UserPrincipalName <[email protected]>).Id
#2. Get the Azure Subscription Id - change AZ-100 to the first few text in the subscription name
$subscriptionId = (Get-AzSubscription | Where-Object {$_.Name -like "*AZ-100*"}).Id
#3. Assign the Contributor role to the user in the subscription
$roleDefinition = Get-AzRoleDefinition -Name "Contributor"
New-AzRoleAssignment -ObjectId $userID -RoleDefinitionId $roleDefinition.Id -Scope "/subscriptions/$subscriptionId"

To grant the user the “Application Administrator” role, open the user’s properties in Microsoft Entra ID, click “Assigned roles,” check “Application Administrator,” and finally, click the Add button.

Before proceeding, confirm that the user has the “Contributor” role in the subscription.

Task 4: Create VMware and Server Accounts

The Azure Migrate discovery appliance is a VMware appliance you deploy in vCenter. You require a vCenter account with these permissions to deploy it.

Similarly, Azure Migrate needs a read-only vCenter account to discover VMware VMs (servers). Finally, to allow Azure Migrate to discover installed applications and agentless dependency analysis in VMware servers, enable the Guest operations Privilege in the account.

Azure Migrate also requires a local or domain account on with local administrator permission on Windows server and on Linux servers, a sudo user account with permissions to execute ls and netstat commands.

Based on the abovementioned requirements, I will create a local vCenter account with these permissions. This account will be used for OVF deployment and agentless discovery.

Similarly, I will create a domain account – my test environment is a Windows environment – and add the account to the local administrators account for the VMware VMs running Windows Server.

Task 4.1: Create a Local vCenter Account

In this sub-task, I’ll create a vCenter user and add the account to the vCenter local administrators group.

1. Sign in to vCenter via a browser, click the menu, and choose Administrator.

2. Then, on the Single Sign On section, click Users and Groups, then, click ADD under the Users tab.

2. Enter the account details and click ADD.

3. To add the newly created user to the Administrators group, click Global Permissions under Access Control, then click ADD. After that, select the options in my second screenshot below and click OK.

Before moving on to Task 4.2, confirm that the account is in the list.

Task 4.2: Create a Windows Domain Account

Open PowerShell as administrator and run these commands. Run #1 and 2 in a Domain Controller and #3 on the Windows VMware VM. If the VMware VM is a Domain Controller, run command #4 to add the user to the domain’s administrators group

#1. Set the variables - change $ADLocation variable to the DN of the OU you want to create the account
$Username="azure-mig-dsad"
$ADLocation = 'OU=Service Accounts,DC=lab,DC=infopressmedia,DC=com'
$Credential = (Get-Credential -UserName $Username -Message "Enter the password for the $Username")
#2. Create the user
New-ADUser -Name $Username -Path $ADLocation -PasswordNeverExpires $true -AccountPassword $Credential.Password -Enabled $true
#3. Add the Windows domain account to the Windows VMware VM's local administrators account - run this command on each Windows VMware VM 
Add-LocalGroupMember -Group "Administrators" -Member "labazure-mig-dsad"
#4. Add the Windows domain account to the Windows domain administrators group
Add-ADGroupMember -Identity "Administrators" -Members azure-mig-dsad

If you have Linux Servers in your VMware environment, see the Linux servers section in Create an account to access servers.

The Azure Migrate agentless migration uses Vmware tools to discover applications installed on the VMware servers you’re migrating. So, it is important to confirm that the latest VMware tools are installed on all VMs you intend to migrate.

Agentless dependency analysts will fail if a VM is not running VMware tools.

Task 6: Create an Azure Migrate Project

Now that you’ve prepared the VMware environment, creating an Azure Migrate project is time. Follow these steps to create an Azure Migrate project.

1. Sign in to your Azure account, search Azure Migrate, and open the resource.

2. On the Getting started tab, click discover, assess, migrate in the Servers, databases and web apps section. After that, click Create project.

3. Then, on the Create project window, select the subscription and resource group (RG) to create the project under. Then, enter a name and select the Azure region to create the project.

If you do not have an existing RG or want to create a new one, click Create new under the Resource group drop-down.

4. After entering the details, click Create, then wait for the project to be deployed. When the project is fully created, proceed to Task 6 below.

Note that the Azure Migrate project has two section: 1, Azure Migrate: Discovery and assessment and 2, Migration and modernization.

Task 7: Download the Appliance’s OVA File

Task 7.1: Generate the Project Key

1. On the Azure Migrate: Discovery and assessment section of the Azure Migrate project, click the Discover drop-down and choose Using appliance.

2. Then, click the Are your servers virtualized? drop-down and choose Yes, with VMware vSphere hypervisor.

3. After that, on the 1: Generate project key, enter a name for the VMware appliance in the Name your appliance field, then click Generate key.

When you click Generate key, Azure will start creating the required Azure resources – DO NOT close the windows while the resources are being created.

Azure create two resources – a Recovery Services vault and a
Key vault – in the region you created the resource group.

3. When Azure finishes creating the resources, it will generate the project key. Copy the key and save it in a file.

Task 7.2: Download the OVF File

To download the Azure Migrate Discovery appliance VM OVF file, choose the “.OVA file” option in 2: Download Azure Migrate appliance and click the dowload link.

Task 7.3: Verify the OVF File

After downloading the OVF file, before importing it to your vCenter server, verify the file’s security using these steps:

1. Open Command Prompt as administrator. Then, run the command below to generate the hash for the downloaded OVA file.

CertUtil -HashFile  

I ran the command below to generate the has for my OVA file.

CertUtil -HashFile "D:Azure MigrateMicrosoftAzureMigration.ova" SHA256

2. Note the has file and compare it to the hash for the latest OVA file. The first screenshot below, shows the hash file from the previous link – the latest OFA file as of September 2024 when I wrote this guide.

Meanwhile, the second screenshot shows the has of my downloaded OVA file. The has of the two files are the same, so my downloaded file is safe!

Task 8: Set Up the Appliance in vCenter

Task 8.1: Configure the Appliance in vCenter

1. Sign in to vCenter with an account that has the permission to create VMs using OVA files.
2. After that, upload the OVA file into vCenter, then, wait for the file to upload.

3. Once the OVA file is uploaded to vCenter, right-click the vCenter location you want to deploy the OFA file and choose Deploy OVF Template.

4. Then, on the first page of the wizard, use choose the second option and use the UPLOAD FILES button to select the OVA file from the folder you saved it in your computer. Once the file is verified, click Next.

5. Give the Azure Appliance a name and select the vCenter location to deploy it – I’m deploying mine in my vCenter cluster. After the compactibility test, click Next again to progress to the next stage.

6. After that, wait for vCenter to display information about the template, then click Next.

7. Finally, select the datastore, VM Network, and click FINISH to deploy the Azure Migragrate VM appliance. Wait for the appliance to be set up in vCenter.

The Azure Migrate appliance is assigned 32 GB of RAM and 4 CPUs.

Since I’m running this migration in my home lab – the vCenter server does not have up to 32 GB – I modified the appliance’s VM RAM to 8 GB and 2 vCPUs.

Task 7.2: Configure the Appliance

1. Power up the Azure Migrate appliance. Then, click on it to open the console.

2. On the VM’s console, accept the license agreement, and set a password for the local administrator account. The Server will be assigned an IP address by your DHCP server.

However, to be able to access the appliance from a consistent IP address, log in to the VM with the local administrator account and assign it a static IP address.

If you want to access the appliance via its name instead of IP address, create a host A record. I will be managing mine via its IP address.

3. From a browser on any PC that can reach the Azure Migrate VM appliance’s IP address, open its IP on port 44368.

The browser will display a warning, click Advanced and proceed. Then, sign in with the local administrator credentials of the appliance.

https://192.168.0.116:44368/

4. Once you sign in, accept the Azure Migrate licence agreement. After that, the appliace will test connection to and time synch with Azure.

Task 8.3: Register the Appliance in Azure Migrate

To register the vCenter appliance with Azure, follow these steps:

1. Enter the project key you copied in Task 6.1, step 3 in the registration field, and click Verify. The key will be verified, and the appliance will initiate an auto-update. According to the notes, this may take up to 5 minutes.

If you did not save the project key earlier, open the follow my numbering in screenshots 3-6 below.

2. When the appliance auto-update is completed, the login button will be activated. Sign in to your account account by clicking the Login button.

Sign in with the Azure account you created for migration purposes in Tasks 3.1 and 3.2. If the auto-update takes more than 5 minutes, wait as it may take longer than that.

3. Then, from the pop-up, click Copy code and login.

4. Paste the code and click Next.

5. Then, sign in to Azure with the account you created for the migration. After signing in, wait for the appliance to register in Azure.

If required, after siggning in, follow the steps to download Microsoft authenticator app and set up 2FA.

If the appliance registration fails, click the error details, wait about 5 minutes, and then click and click Re-try.

6. When the appliance is successfully registered to Azure, download and install the VMware Virtual Disk Development Kit.

7. After downloading the file, extracting the zip, and copying them to C:Program FilesVMwareVMware Virtual Disk Development Kit, click Verify.

All sections of 1. Set up prerequisites should now be green. Progress to Task 8.

Task 9: Start Azure Migrate Continuous Discovery

Task 9.1: Set up vCenter Server Details

1. Scroll to 2. Manage credentials and discovery sources section. Then, in Step 1: Provide vCenter Server credentials for discovery of VMware VMs​, click Add Credentials.

2. Then, on the pop-up window, enter the local vCenter account you created in Task 4.1 and click Save.

3. Then, in Step 2: Provide vCenter Server details, select Add discovery source. After that, enter the vCenter server’s FQDN or IP address and click Save.

The Azure Migrate Discovery appliance will validate the vCenter and if successful, the status will display “Validation successful.”

Task 9.2: Configure Server Credentials

1. In Step 3: Provide server credentials to perform software inventory, agentless dependency analysis, discovery of SQL Server instances and databases and discovery of web apps in your VMware environment., click Add credentials

2. Then, in the Add credential pop-up, select the type, enter the details, and click Save.

In this section, you can provide multiple server credentials. In the second screenshot below, I provided the Windows Domain account credentials I created in Task 4.2. As shown in the first screenshot, you can add Linux, SQL, and Windows local credentials.

Once all these tasks are completed, opening the project in Azure displays the current state of the service health.

Task 9.3: Start VMware VM Discovery

To start discovering vCenter VM workloads, click Start discovery and wait for the discovery to complete.

The discovery should take between 20-25 minutes. When it is completed, the Discovery status should show a green tick and you canm view the discovered inventory in Azure.

Task 9.4: View Discovered VMware Data

To view the vCenter discovered inventory in Azure, follow these steps:

1. Sign in to Azure, search Azure migrate and open the resource. After that, expand Migration goals and select Servers, databases and web apps.

The Azure Migrate: Discovery and assessment should show the number of discovered servers.

2. To view the discovered servers, click on the bumber.

My home lab vCenter environment has 3 servers – a Domain Controller (IPMvDC1), the Azure Migrate appliance VM (IPMvAzureAp) and the vCener Server (IPMvVCSA1).

The only VM relevant for my migration is the DC. As seen in the above screenshot, the Azure Migrate discovery tool found 9 apps in the Domain Controller.

3. To view the discovered applications and the roles and features installed on the server, click the application hyper-link.

Fianlly, to view the Windows Server roles installed on the server, click the Roles and features tab.

This is a simplified scenarior compared to a real-world that may include Linux servers, SQL, other database servers and other applications. Howver, by following this guide, you should have completed the discovered phase of the Azure Migrate process.

To learn more, read how discovery works.

With the discovery stage completed, proceed to the part 2 of this guide, assessing discovered VMs .

After discovering your on-premises VMware workloads, the next step is to assess them for Azure migration readiness, costs estimates, and identify risks. This second part walks you through the steps to complete these tasks.

Overview of Workload Assessment

As I mentioned in my introduction, the purpose of running and assessing VMware VM workloads is to review their readiness for Azure migration, estimate costs, and identify risks.

The Azure Migrate assessment tool can evaluate your discovered workloads for Azure VM, Azure SQL, Web apps on Azure or Azure VMware Solutions migration. These 4 options are available from the Assess drop-down on the Azure Migrate project.

It goes without saying that assessment is performed on discovered VMware workloads. So, before proceeding with the steps in this guide, you must have completed part 1 of this series.

Meanwhile, you can perform an assessment on individual workloads. Alternatively, you can create groups to collect machines to assess and migrate together.

I like to create groups because it makes assessment and migration efficient.

Finally, you can run two types of assessments: as-is on-premises or performance-based. Performance-based assesement is recommended, so I usually run this assessment.

Task 1: Plan Assessment Grouping

Decide how you want to group servers for migration. The most common grouping is by operating system.

Alternatively, you can group servers by applications. Once you decide how to group VMware servers for migration, create a table with the group names and the VMware servers that belong to the group.

Task 2: Create Assessment Groups

1. Sign in to Azure and open the Azure Migrate project: search for and open Azure Migrate, then expand Migration Tools and click Servers, databases, and web apps. The project you created in part 1 will be selected.
2. Then, on the project details, click the number under Discovered servers.

3. On the top left corner of the discovered servers list, click Create group.

4. On the Create group page, name the group and select the options shown in my screenshot below. Then, check all the servers you want to add to the group and click Create.

After creating the group, stay on the Discovered Servers page.

I creating another group for my Linux (Ubuntu) servers.

Task 3: Run an Azure Migrate Assessment

1. Click the Assess drop-down and click on the type of workload you want to assess. I’m assessing VMware VMs for migration to Azure VMs, so I’ll select Azure VM.

2. On the Basic page of the Create assessment wizard, confirm that Assessment type is Azure VM and Discovery source is Server discovered from Azure Migrate appliance. To modify the assessemnet settings, click the Edit button next to it.

On the Assessment settings use the second screen below as a guide. To read about these settings, visist the run an assessment section of the Microsoft guide.

3. Then, on the Select Servers page, name the assessment, after that, under Select or create a group, choose Use existing and select the group you created in Task 2. To proceed, click Next, then review the new assement and click Create assessement to create it.

Task 4: Review the Assessment Results

The result of the Azure Migrate assessement allows you to review VMware VMs for readiness, estimate cost of hosting the VM in Azure and resolve any identified issues.

Follow the steps in the following sub-tasks to review your Azure Migrate assessement results.

Task 4.1: Review VM Readiness for Migration

1. On the Servers, databases and web apps > Azure Migrate: Discovery and assessment page, click the number under Groups.

2. After that, click Assessments and then, the group name to open it. The assessement’s group overview page displays a summary of the categories.

3. To drill down to the Readiness category, click Azure readiness.

4. On the readiness page, you can view detailed information about recommended Azure VM size, other information about the VM.

Task 4.2: Review Cost Estimates

1. To review the cost assessement, click Cost details.

2. Then, review the estimated cost of running each VM in Azure, including Hybrid benefits (if you selected this option when you created the assessment).

To review a detailed cost analysis of a VM, click on it. You can also export the results.

On the detailed analysis page of the VM I opened, Azure recommended using the Azure Migrate tool, stating, “ This machine is suitable for lift and shift migration to Azure.”

Task 4.3: Review and Resolve Issues

If any VM’s status shows Ready with conditions, Not ready, or Readiness unknown, click those sub-categories, then click the VMs with issues and actions to take to fix the issues.

Alternatively, click the Resolve issues to display all issues and remediation actions. Then, to view the details of an issue, click on the link in the Affected object column.

Once you have analysed all your discovered VMware VM workloads, proceed to part 3 of this guide – run server dependency mapping.

Welcome to the next stage of your VMware to Azure migration journey. In this part of the guide, you’ll complete server dependency mapping.

Overiew of Dependency Mapping

Servers have dependencies in production and real-world environments. For example, an application server may depend on a database server.

Furthermore, a server may require some firewall ports to be opened to communicate with other servers.

The Azure Migrate dependency analysis identifies discovered on-premises servers and their inter-dependencies. After running your dependency analysis and mapping, you can plan your migration by:

1. Identify servers that you must migrate together
2. Modify your Azure assessment groups to improve migration success
3. Determine servers that must be decommissioned because they’re not in use.

Dependency analysis helps you plan your migration and reduce surprise service outages. Azure Migrate supports two types of dependency analysis: agentless and agent-based.

In this guide, I will explain how to perform agentless dependency mapping.

Task 1: Perform Agentless Dependency Mapping

Agentless dependency analysis supports VMware, Hyper-V, and servers running on public clouds like AWS and GCP. The steps below explain how to complete agentless dependency analysis on VMware discovered VMs:

1. On the Servers, databases and web apps > Azure Migrate: Discovery and assessment page, click the Dependency analysis drop-down and choose Add servers.

2. On the Dependency analysis – Add servers page, only discovered servers that have been validated as ready for migration will be available. Check all the servers on which you want to run dependency analysis, then click Add servers.

Task 2: View Server Dependencies

1. Once the previous task is completed, expand Manage, then click the Discovered servers menu. To display a server’s dependencies, click View dependencies.

2. The last action will display the server’s dependincy mapping. The dependincy mapping for my domain controller shows that 6 clients are connected to the server.

To view the clients, click the arrow next to the node.

Furthermore, the mapping shows that there are 15 processes running on the DC and 6 ports that apps and other servers use to connect to the server.

To view the detailed dependency mapping for the server, click on it to expand it. The screenshot below shows that there is 1 Inbound Connection and 6 Outbound Connections.

However, there is no other machine that depends on this VM to function.

The TCP/IP inbound and outbound connect will help you plan the Network Security Grouy inbound and outbound rules for the Azure Virtual network this VM will be migrated into.

Task 3: Refine Grouping Based on Dependency Analysis

Based on the dependency mapping you performed in Task 2, refine the group you created earlier.

To add or remove servers from a group:

1. Click the number beneath Groups

2. Then, click on a group’s name and finally, click Add machines or Remove machines.

After completing dependency mapping for all the VMware workloads you intend to migrate, it is time to migrate the VMs to Azure. For the steps, proceed to part 4 of this guide.

In this final part of my four-part series, you’ll learn how to migrate your on-premises VMware VMs to Azure using the Migration and Modernization tool.

The Migration and Modernization tool is a lightweight vCenter VM appliance that discovers VMware VMs, replicates them to Azure, and performs migration.

Deploying the vCenter appliance is similar to the steps we completed in the discovery part of this guide.

Task 1: Review Migration Prerequisites

Before proceeding with the steps below, ensure that you have:

1. Completed the steps in parts 1, 2, and 3 of this series.
2. Created an Azure Migrate project. You would have created one if you completed the preceding parts of this guide.
3. An Azure account with permission to create VMs and write to an Azure-managed disk.

Task 2: Create Azure RG, vNET and NSG

When you migrate VMs to Azure, you must place them in an Azure resource group and create an Azure Virtual Network to allow connection to and from the VM. Moreover, you require an Azure Network security group to configure firewall rules to and from the vNET.

In the following sub-tasks, you’ll create these resources.

Task 2.1: Create an Azure Resource Group

When you create an Azure Resource Group, you need to place it in an Azure region. To determine the name of the region in your location:

1. Sign in to Azure and open the Azure Cloud Shell PowerShell. When Cloud Shell opens, maximize it by clicking the expand icon.

2. Then, on the PowerShell console, run the Get-azLocation command.

Change UK to anything you believe should be in the Display name of the Azure Region.

Get-azLocation | Where-Object {$_.DisplayName -like "*UK*"} 

Note the Location of the region in which you want to migrate your VMs. In my example, I want to deploy to “UK South,” so my location is uksouth.

Once you have the region name, run the PowerShell commands below to create the Azure Resource Group.

#1. Set location and RG name variables
$RGlocation = 'uksouth'
$RGName="VMware-migration-RG"
#2. Create the Resource Group
New-AzResourceGroup -Location $RGlocation -Name $RGName

Task 2.2: Create an Azure Network Security Group

To create a network security group, run these PowerShell commands:

#1. Set variables
$NSGName="VMware-NSG"
$NSGLocation = 'uksouth'
$NSGRGName="VMware-migration-RG"
#2. Create the Network Security Group
New-AzNetworkSecurityGroup -Name $NSGName -ResourceGroupName $NSGRGName  -Location $NSGLocation

Task 2.3: Configure Firewall Rules on the NSG

Based on the information you compiled in your dependency mapping, create inbound and outbound rules on the newly created NSG. In the example below, I will create an inbound rule allowing TCP/IP port 3389 (RDP port).

1. Search Network security groups and open it from the results. After that, open the NSG you created in Task 2.2.

2. Then, expand the NSG’s Settings and click Inbound security rules > +Add.

3. Finally, configure the inbound rule using my screenshot below.

After creating the inbound rule with the above steps, it will display an alert. If you open the inbound rule, Azure displays the reason for the amber alert. In my example, the reason for the alert is that “RDP port 3389 is exposed to the Internet.”

If you’re migrating Linux VMs, you must also create another Inbound rule allowing access to port 22 so you can SSH to the VMs after migrating them.

Task 2.4: Create an Azure Virtual Network

When you create an Azure vNET, you must specify the AddressPrefix. Furthermore, after creating the vNET, you must create a subnet defining the VM network in the vNET.

This sunset must not overlap with the vNET Address or your on-premises network. Similarly, you must also create an Azure Virtual Network Gateway subnet, which VMs need to connect to external resources.

Run the PowerShell commands below to create these resources.

Change the names of the resources and IP networks to yours. For production migration, I recommend creating a separate vNET and subnet for test migration.

#1. Set Variables
$AzVirtualNetworkName="VMware-vNET"
$AzResourceGroup = 'VMware-migration-RG'
$AzRegion = 'uksouth'
$AzVMSubnet="VMsubnet"
#2. Create the virtual network
New-AzVirtualNetwork -Name $AzVirtualNetworkName -ResourceGroupName $AzResourceGroup -Location $AzRegion -AddressPrefix '172.17.0.0/22'
#3. Create VMsubnet
Add-AzVirtualNetworkSubnetConfig -Name $AzVMSubnet -AddressPrefix '172.17.0.0/24' -VirtualNetwork (Get-AzVirtualNetwork -Name $AzVirtualNetworkName -ResourceGroupName $AzResourceGroup) | Set-AzVirtualNetwork
#4. Create GatewaySubnet - the name MUST be called GatewaySubnet
Add-AzVirtualNetworkSubnetConfig -Name 'GatewaySubnet' -AddressPrefix '172.17.1.0/27' -VirtualNetwork (Get-AzVirtualNetwork -Name $AzVirtualNetworkName -ResourceGroupName $AzResourceGroup) | Set-AzVirtualNetwork

Task 2.5: Associate the Subnet to the NSG

You must associate the vNET subnets with the NSG to apply the network security group rules. Here are the steps:

1. Search Network security groups and open it from the results, then open the NSG you created earlier.
2. Then, expand Settings on the NSG’s page and click Subnets > +Associate.

3. On the Associate subnet flyout, select the virtual network from the Virtual network drop-down menu. Then, choose the VMsubnet from the Subnet drop-down menu and click OK.

Note that Network security groups cannot be attached to Gateway subnets.

You can also enable this association from the vNET’s Settings > Subnets menu (click the subnet to associate).

Task 3: Download the Appliance OVA File

Having prepared the Azure environment, it is time for the main action.

In the following tasks, you’ll create an Azure Migrate discovery to prep the appliance’s OVA file. Then, you’ll use the OVA file to create the Azure Migrate appliance in vCenter.

Task 3.1: Create an Azure Migration Discovery

1. Sign in to Azure, open Azure Migrate, and click Servers, databases, and web apps.
2. After that, click Discover under Migration and modernization.

3. Then, on the Azure Migrate Discover page, select the options in my first screenshot below. Then, scroll down to the second part of the page.

Task 3.2: Download the Appliance OVA File

4. On the “1: Generate project key,” enter a name for the Azure Migrate appliance and click Generate key.

5. Once the key is generated, copy it. Then, in 2: Download Azure Migrate appliance, select “.OVA file. 12GB” and click the Download button to download the appliance’s vCenter OFA file.

Task 4: Deploy the Azure Migrate Appliance

1. Sign in to vCenter, right-click the location where you want to deploy the Azure Migrate appliance and choose Deploy OVF Template.

2. Then, on the Select an OVF template page, choose the Local file option, use the UPLOAD FILES button to select the Azure Migrate appliance OVA file, and click Next to proceed to the next page.

3. In the Select a name and folder page, give the appliance the same name as you used in Azure, then, confirm the location and click Next. After that, review the settings and select a datastore to deploy the VM.

4. Finally, select a VM network and create the VM. It will take a while to create the VM.

Task 5: Setup the Azure Appliance in vCenter

Task 5.1: Complete the Appliance’s OS Setup

Power the VM and use the steps below to configure the Azure Migrate appliance.

When you create the Azure Migrate appliance VM in vCenter, it has 32 GB of RAM and 4 CPUs. Since I am running this test deployment in my home lab, I adjusted the RAM to 16 GB and 2 vCPUs.

1. To Power on the VM, right-click it, point to Power, and choose Power On. 4

2. After that, launch the VM’s console by clicking LAUNCH WEB CONSOLE and wait for the final stages of the Windows Server deployment to load.

The getting ready screen might take a while. The VM will restart during the process.

3. When the license agreement page loads, accept the agreement. Then, type the administrator password.

4. Sign in to the appliance (Windows), assign the server a static IP address, and configure DNS servers.

When you sign in, the Azure Migrate appliance opens in the Edge browser. Minimize it. RDP is enabled by default on the applainace’s OS.

Task 5.2: Configure and Register the Appliance in Azure

1. RDP to the Azure Migrate appliance VM and login to Windows. Then, open the Azure Migrate appliance in the Edge browser.

Connecting to the server via RDP lets you copy and paste the project key in step 2 below.

Click Agree to accept the license agreement and load the appliance’s interface.

2. Scroll to Configure and Register the Appliance in Azure, enter the project key you generated in Task 3.2, and click Verify.

Once the key is verified, the appliance will check for updates and initiate registration in Azure.

3. You’ll be notified and prompted to reload the page if updates are installed. Click the Refresh button and wait for the page to reload.

After that, click the Verify button again to re-verify the project key with Azure. Then, wait for the auto update service to start.

4. When the previous step is completed, the Login button will become available. Click Login to sign in to Azure.

5. Then, click Copy code & Login on the Continue with Azure Login pop-up. Then, paste the code into the Azure sign-in page that opens in a new browser tab.

After that, log in to Azure with the account you created in part 1 of this guide. When you finish signing in, close the browser and return to the Azure Migrate appliance’s browser tab.

6. The appliance will register with Azure and throw an error about the VMware Virtual Disk Development Kit not being installed.

You have downloaded this kit in part 1. Copy the file to C:Program FilesVMwareVMware Virtual Disk Development Kit. After copying the files, click the Verify button again, and it should return all green.

7. Also, add the vCenter account and account with admin permission on the VMs you’re migrating and a vCenter server to the appliance.
8. Finally, sign in to Azure, open Azure Migrate, and confirm that the appliance has been registered in the Azure project.

Task 6: Replicate VMware VMs to Azure

1. From the Azure Migrate > Servers, databases and web apps page, click Replicate under the Migration tools section.

2. In the Specify intent, Replicate page, select the options as shown in my screenshot below and click Continue.

3. In the Select the virtual machines to be migrated page, “Import migration settings from an assessment?” drop-down, choose No, I’ll specify the migration settings manually.

4. Then, on the Configure settings and target properties for migration page, choose the region and resource group you created in Task 2.1.

After selecting the region and resource group, choose the Virtual network and VM subnet you created in Tasks 2.24 and 2.5. When you finish, click Next.

Select the vNET and subnet you created for production migration in the Test Migration section.

5. On the next page, choose Automatically select matching configuration in the Azure VM Size. After that, select the disk replication options if required.

6. Finally, tag the VM if required, then review and start replication.

Task 7: Track and Monitor Replication

To track the replication job status:

1. Click the Overview button in the Migration and modernization section.

2. On the Azure Migrate: Migration and modernization page, click the Jobs menu.

3. Finally, to view the status of the replicated VMs, click the Replications tab. Wait for the VM’s replication status to reach 100% before proceeding to Task 8.

To check for replication events, including errors, click the Events menu.

Task 8: Run a Test VMware VM Migration

To run a test migration of a VM:

1. Right-click the menu button and choose Test Migration.

2. Finally, select the test migration vNET, subnet and click Test Migration.

Task 9: Migrate VMware VMs to Azure

1. From the Azure Migrate: Migration and modernization, Replications tab, click the menu of the VM you want to migrate and choose Migrate.

2. Then, on the VM’s Migrate page, select whether to shut down the source VM and click Migrate.

3. To view the migration’s progress, click the notifications icon, then click the job for more details.

Azure displays the status of each segment of the migration task.

4. When the migration is completed, proceed to Task 10 below.

Task 10: Review the Migrated VM

1. Search virtual machine and open the resource.

2. Then, click the VM you just migrated.

3. Expand Networking on the VM’s menu and click Network Settings. The VM should be assigned a Private IP address from the subnet you created earlier.

However, it will not have a public IP address. So, you cannot connect to the VM unless you have a Site-to-Site or Point-to-Site connection from your on-prem network to the Azure vNET.

To add a Public IP address, click the Configure button below Public IP address.

4. On the IP configurations page, click the IP resource, then, on the fly-out windows, check Associate public IP address and create a new public IP address or select an existing one.

5. After associating the public IP to the VM, open the VM and click Connect from the Connect menu. Then, choose whether to connect via the VM’s private or public IP and whether to connect via SSH using Azure CLI or Native SSH.

The validation failed because I did not open port 22 on the NSG. I will configure an Inbound rule allowing port 22, then repeat the connection configuration.

My validation worked after adding the inbound rule to allow port 22 via the NSG! Then, I could connect to the VM via Azure CLI SSH.

Once Azure finishes the configuration, it opens Azure CLI, and since my Azure CLI was on PowerShell, it prompted me to Switch to Bash in Cloud Shell.

And bingo, I’m connected to the VM’s session via Azure CLI using my Azure account.

Series Conclusion

Migrating VMware VM workloads to Azure is a four-step process. In the first step, you’ll deploy the Azure Discovery and Assessment appliance.

After deploying and configuring the appliance, you will perform a discovery of your VMware workload. Then, the workloads will be assessed to determine the Azure resources that the on-prem workload can be migrated into, and the cost of running the workload in Azure will be estimated.

The next step is performing a dependency analysis.

Once all these tasks are completed, you’ll deploy an Azure Migration and modernization appliance, configure the appliance, run a test migration, and finally, migrate the VMware VMs to Azure.

The easiest way to remember the four steps is by using the acronym DADM:

Discovery, Assessment, Dependency analysis, and Migration.