Mainframe to Azure Migration Services

Section 02

Technical Deep Dive

1. The Compute Layer: Azure Kubernetes Service (AKS) vs VMs

While you can run emulators on Virtual Machines (VMs), the modern approach is to containerize the re-hosted or refactored application and run it on AKS.

• Benefit: Auto-scaling based on CPU/Memory load (handling end-o-month spikes).
• Challenge: Mainframe apps are often stateful. You need to externalize state to Redis or a database to make them cloud-native.

2. High Availability (HA) & Disaster Recovery (DR)

Mainframes use Parallel Sysplex for HA. In Azure, you achieve this using Availability Zones and Region Pairs.

Architecture Pattern:

• Active-Active: Run instances in East US and West US.
• Data Sync: Use Azure SQL Geo-Replication to keep data in sync (with some lag).
• Traffic: Use Azure Front Door to route traffic.

3. Integration: Logic Apps & Service Bus

Unlock legacy data by wrapping COBOL transactions in APIs.

• Use Azure Logic Apps to orchestrate workflows that trigger mainframe transactions.
• Use Azure Service Bus to decouple the high-speed mainframe from slower distributed systems.

Section 03

Migration Approaches

1. Rehosting (Emulation)

Use Micro Focus Enterprise Server or TmaxSoft OpenFrame to run COBOL/JCL unmodified on Azure VMs.

Pros: Fast migration (6-12 months)
Cons: High ongoing licensing costs, no true modernization

2. Refactoring to .NET

Convert COBOL to C# using automated tools, deploy to Azure App Service.

Pros: True cloud-native, lower long-term cost
Cons: 2-3 year timeline, high risk

3. Hybrid (Strangler Fig)

Gradually extract services from mainframe, run hybrid with Azure Arc.

Pros: Lowest risk, incremental learning
Cons: Requires mainframe expertise for 5+ years

Section 04

The Azure-Specific Gotcha

Azure SQL Managed Instance does not support all DB2 z/OS features. Expect significant schema redesign for:

• Triggers with SIGNAL/RESIGNAL
• Advanced partitioning strategies
• Temporal tables (AS OF queries)

Budget 30-40% more time for database migration vs. AWS RDS/Aurora.

---

How to Choose a Mainframe to Azure Migration Partner

If you want to keep COBOL/PL/I code as-is: Raincode. Their compilers allow you to run mainframe code natively on Azure without emulation overhead.

If you need a comprehensive managed service: Infosys. Their Cobalt platform provides end-to-end migration and ongoing managed services.

If you are in Healthcare or Finance (regulated): Cognizant. They specialize in compliance-heavy industries and have pre-built Azure landing zones for HIPAA/SOC2.

If you need fast replatforming: Astadia. They are the Azure "FastPath" partner and can get you migrated in record time (but expect less refactoring).

Red flags:

• Vendors who suggest "Lift and Shift" without addressing batch I/O performance on Blob Storage
• No plan for RACF-to-Entra ID security mapping
• Ignoring ExpressRoute requirements for hybrid scenarios
• No experience with Azure NetApp Files (critical for high-IOPS workloads)

---

Section 05

When to Hire Mainframe to Azure Migration Services

1. Microsoft EA (Enterprise Agreement) Commitment

Your company signed a massive Azure consumption agreement. You need to migrate workloads to meet the commitment or risk wasting pre-paid credits.

Trigger: Azure Consumption Mandate from Finance.

2. PowerBI Analytics Demand

Business stakeholders want to run PowerBI dashboards on mainframe data. ETL from DB2 to Azure SQL Data Warehouse is painful in a hybrid setup.

Trigger: "Why can't we see this data in PowerBI?"

3. Office 365 / Dynamics Integration

You are already on the Microsoft ecosystem. Integrating mainframe data with Dynamics CRM or Office 365 workflows requires constant API bridges.

Trigger: "It takes 2 weeks to sync customer data to Dynamics."

4. MIPS Cost Explosion

IBM sent the MIPS pricing renewal. The cost increased 15% YoY, and your CFO is demanding a move to OpEx.

Trigger: Mainframe licensing renewal shock.

5. Disaster Recovery Gap

Your DR plan relies on a secondary data center. Azure offers geo-redundant DR at a fraction of the cost.

Trigger: DR test failure; inability to meet RTO/RPO SLAs.

---

Section 06

Total Cost of Ownership: Mainframe vs Azure

Hidden Costs NOT Included:

• ExpressRoute: $5K-$20K/month for dedicated network link during migration.
• Parallel Run: Running Mainframe + Azure simultaneously for 6-12 months doubles operating costs.
• Security Audit: RACF-to-Entra ID mapping requires dedicated security consultants.

Break-Even Analysis:

• Median Investment: $6M
• Annual Savings: $2.5M (MIPS + Hardware + Staffing)
• Break-Even: 2.5-3 years

---

Section 07

Mainframe to Azure Migration Roadmap

Phase 1: Discovery & Azure Landing Zone (Months 1-4)

Activities:

• Catalog all mainframe applications and datasets
• Design Azure Landing Zone (Subscriptions, VNets, Security)
• Provision ExpressRoute for hybrid connectivity
• Select Migration Strategy (Rehost vs Refactor)

Deliverables:

• Application Inventory
• Azure Architecture Blueprint
• ExpressRoute Connection Live

---

Phase 2: Pilot Migration (Months 5-8)

Activities:

• Select a non-critical application for Pilot
• Migrate DB2 dataset to Azure SQL Managed Instance
• Convert JCL to Azure Logic Apps or Control-M
• Deploy to AKS or App Service

Deliverables:

• Pilot Application Running on Azure
• Validated Migration Patterns

---

Phase 3: Wave-Based Migration (Months 9-24)

Activities:

• Group applications into "Waves" based on dependencies
• Execute migration in 3-month waves
• Run parallel testing (Mainframe vs Azure)
• Decommission mainframe applications incrementally

Risks:

• Data sync lag between DB2 and Azure SQL during parallel run

Deliverables:

• 80% of Applications Migrated
• Reduced MIPS Consumption

---

Phase 4: Decommission & Optimization (Months 25-30)

Activities:

• Cutover final applications
• Decommission mainframe LPAR
• Optimize Azure costs (Reserved Instances, Auto-Scaling)
• Implement FinOps governance

Deliverables:

• Fully Decommissioned Mainframe
• Optimized Azure Environment

---

Section 08

Architecture Transformation

---

Section 09

Post-Migration: Best Practices

Months 1-3: Security Hardening

• Entra ID Conditional Access: Implement MFA and conditional access policies that mimic RACF granularity.
• Azure Sentinel: Deploy SIEM to monitor for anomalous access patterns.

Months 4-6: Cost Optimization

• Reserved Instances: Once workloads stabilize, buy 1-year or 3-year Azure Reserved Instances for 40-60% discount.
• Auto-Scaling: Implement horizontal pod autoscaling in AKS for variable workloads.

---

Section 10

Expanded FAQs

Can we use Azure NetApp Files instead of Blob Storage?

Answer: Yes, and you should for batch workloads. Azure NetApp Files provides NFS with mainframe-like IOPS (up to 320K IOPS). Blob Storage is great for archives but terrible for high-frequency I/O. Budget $10K-$50K/month for NetApp Files.

What about RACF security?

Answer: There is no 1:1 mapping. RACF is dataset-level ("Who can read this file?"). Entra ID is role-based ("What can this user do?"). We typically implement Azure RBAC + Database Row-Level Security to achieve similar granularity. This requires a security redesign.

How do we handle bi-directional data sync during parallel run?

Answer: Use Azure Data Factory with CDC (Change Data Capture) to sync DB2 → Azure SQL in real-time. For the reverse (Azure → Mainframe), use IBM DataGate or custom MQ triggers. Expect 5-15 second lag.

Is Azure the only cloud for mainframe?

Answer: No. AWS has more mature mainframe tooling (Blu Age, Micro Focus on EC2). Azure is preferred if you are already deep in the Microsoft ecosystem (Office 365, Dynamics, PowerBI). GCP has the least mainframe tooling.

What about compliance (PCI-DSS, HIPAA)?

Answer: Azure supports all major compliance frameworks. However, you need to configure it correctly. Use Azure Blueprints for automated compliance (e.g., "PCI-DSS Blueprint"). Most failures are due to misconfiguration, not Azure's inability.

---

Section 11

Risk Factors

Identity Management (RACF to Entra ID)

Mainframe security (RACF/TopSecret) is granular and dataset-based. Azure Entra ID (Active Directory) is role-based. Mapping these permissions without opening security holes is a major audit risk.

Batch Performance on Blob Storage

Azure Blob Storage is cheap but has higher latency than mainframe DASD. Batch jobs that do millions of small I/O operations will grind to a halt unless refactored to use caching or Azure NetApp Files.

Locking & Concurrency

Mainframe DB2 has sophisticated row-level locking. Azure SQL handles locking differently (optimistic vs pessimistic). High-concurrency transaction systems may experience deadlocks if not tuned.

---

Section 12

Feasibility Analysis

Ideal candidates

• Heavy reliance on Microsoft stack (Office 365, Dynamics)
• Need for PowerBI analytics on mainframe data
• Existing Azure commit/spend agreements

Break-even cost: $1M Talent risk: High. Requires cross-skilling mainframe staff to Azure DevOps.