Migration playbook · Azure

How to migrate VMware, Hyper-V and physical servers to Azure

Use Azure Migrate to discover, assess, replicate, test and cut over servers to Azure VMs, with notes for Hyper-V hosts, physical servers and Azure VMware Solution.

Updated 4 Nov 20266 phases24 detailed steps8 official sources
Start here

Your migration plan

This moves VMware VMs, Hyper-V VMs and physical servers into Azure as virtual machines, without rebuilding them. Azure Migrate (Microsoft's migration hub) finds your servers, suggests Azure sizes, copies the disks in the background and lets you test a copy before a short cutover. Allow time for the discovery appliance to collect performance data over a full business cycle, and for the first copy of each wave to finish over your internet link.

Recommended routeAzure Migrate (agentless for VMware, host provider for Hyper-V)

Built into Azure, needs nothing installed inside VMware guests, and one appliance does discovery, sizing and replication.

Other options and when to use them
  • Azure Migrate agent-based replication: Physical servers, other hypervisors, VMs in other clouds, or VMware VMs with disks agentless cannot copy.
  • Azure VMware Solution: You must keep vSphere or VMware-only appliances, or leave a data centre faster than you can rehost. VMware licensing still applies.
Order to migrate in, and why

Build the Azure landing zone and collect performance data first, prove the method on a pilot server, then replicate and cut over applications in waves, with critical systems last. Each step depends on the one before: sizing needs a full business cycle of data, and a migrated server only works if the network and services it depends on already exist in Azure.

  1. Region, resource group, virtual networks and an isolated test networkThe project's target region is fixed once replication starts, and test migrations need a network that cannot clash with production.
  2. Discovery appliance collecting performance and dependency dataSizing and wave grouping are only as good as the data, so it needs a full business cycle including month-end peaks.
  3. Shared services in Azure: DNS and domain sign-in reachable from the new networkMigrated servers must still find DNS and their domain controllers after cutover, through a VPN, ExpressRoute or a domain controller built in Azure.
  4. Pilot: one or two low-risk servers, test-migrated and cut overMeasures how long replication takes over your link and shows the fixes each server needs.
  5. Application waves from dependency analysis, each application's servers togetherSplitting an application between your data centre and Azure adds delay on every call between its tiers.
  6. Critical systems and servers needing agent-based replication lastThey have the shortest windows or the extra setup of the replication appliance, so they move once the process is proven.
  7. Complete migration and decommission after each rollback windowComplete migration stops replication for good, so it waits until owners sign off.
Settings checklist: decide these before you copy

Built-in and third-party tools treat these differently. Tick each one off once you have decided.

Download this checklist (Excel)
  • How each tool handles it
    Built-in methodAgentless: OS disks up to 2 TB for Generation 1 and 4 TB for Generation 2 VMs, and data disks up to 32 TB. VMs move only to managed disks (Standard HDD, Standard SSD, and Premium SSD v2 for data disks), not Ultra Disk from the portal. An OS disk set up as a Windows dynamic disk is not supported: convert it to basic first.
    Azure Migrate agent-based migrationSame OS and data disk size limits, up to 63 disks per VM, onto Standard HDD, Standard SSD or Premium SSD managed disks.

    Tip: Add a disk type and size column to your inventory and flag anything over the limits before discovery finishes.

    Microsoft Learn: Support matrix for VMware vSphere migration
  • How each tool handles it
    Built-in methodAgentless: independent disks and VMs with iSCSI targets are not supported, and RDM (raw device) or passthrough disks are not replicated. NFS volumes mounted inside the guest are not replicated by either method.
    Azure Migrate agent-based migrationSupports independent disks, passthrough disks and iSCSI targets. Needs the replication appliance and the Mobility service on each VM.

    Tip: Run a test migration of every flagged VM and check each volume is present.

    Microsoft Learn: Support matrix for VMware vSphere migration
  • How each tool handles it
    Built-in methodAgentless and agent-based: VMs with encrypted disks or volumes are not supported. Shared disk clusters and multipath IO are not supported by either method.

    Tip: Decrypt in a planned window or rebuild the cluster in Azure, and record which servers need it in the wave plan.

    Microsoft Learn: Support matrix for VMware vSphere migration
  • How each tool handles it
    Built-in methodAgentless: replication uses VMware snapshots and changed block tracking (VMware's record of changed disk blocks). Existing snapshots from earlier attempts, other apps or backup tools such as Veeam block replication setup, and Microsoft says snapshot-based backups should not run at the same time. Each datastore can have at most 15 disk snapshots.
    Azure Migrate agent-based migrationWhether existing snapshots affect it: not stated in Microsoft's documentation: test it in your pilot.

    Tip: Remove old snapshots and agree with the backup owner how backups run during each wave.

    Microsoft Learn: How agentless migration of VMware VMs works
  • How each tool handles it
    Built-in methodAgentless: UEFI VMs become Azure Generation 2 VMs, which lack Secure Boot; Microsoft recommends converting them to Trusted Launch VMs (an Azure VM type with Secure Boot and a virtual TPM) after migration. Windows needs C: and its boot partition on the same disk. Virtual TPM: not stated in Microsoft's documentation: test it in your pilot.
    Azure Migrate agent-based migrationUEFI VMs become Generation 2 VMs. Secure Boot is not supported for migration.

    Tip: Back up BitLocker recovery keys for every VM with a virtual TPM before its wave.

    Microsoft Learn: Support matrix for VMware vSphere migration
  • How each tool handles it
    Built-in methodAgentless: for supported versions, Azure Migrate changes the guest during test migration and migration. Windows: sets the SAN policy to Online All, checks the Hyper-V storage and VMBus drivers load at boot, and sets the DHCP service to start automatically. Linux: rebuilds the initramfs with Hyper-V drivers, sets the network to DHCP and updates fstab. Other operating systems need manual changes.
    Azure Migrate agent-based migrationNeeds the Mobility service installed in each VM. Which guest changes it makes: not stated in Microsoft's support matrix: test it in your pilot.

    Tip: Check each guest against Microsoft's automatic list in the inventory, and mark the rest for manual preparation.

    Microsoft Learn: Prepare for VMware agentless migration
  • How each tool handles it
    Built-in methodAgentless: sets the VMware Tools service to disabled on Windows, but does not uninstall it. It installs the Azure VM agent on Windows Server 2008 R2 and later, and on listed Linux versions. Distributions outside that list need the agent installed by hand.
    Azure Migrate agent-based migrationNot stated in Microsoft's documentation: test it in your pilot.

    Tip: Uninstall VMware Tools after cutover, and check the VM agent shows Ready in the portal.

    Microsoft Learn: Prepare for VMware agentless migration
  • How each tool handles it
    Built-in methodAgentless: you choose the virtual network and subnet per adapter. Azure Migrate sets Windows and Linux to get their address by DHCP, so servers take new private IP addresses from Azure. Teamed network cards and IPv6 are not supported by either method.
    Azure Migrate agent-based migrationTeamed network cards and IPv6 are not supported.

    Tip: Lower DNS TTLs (how long other systems cache a record) a few days before cutover, and search application settings for hard-coded IP addresses.

    Microsoft Learn: Prepare for VMware agentless migration
  • How each tool handles it
    Built-in methodAgentless: the target settings include Azure Hybrid Benefit. It lets you use Windows Server licences you already own with Software Assurance, so Azure does not also charge for Windows on that VM. Windows activation after migration: not stated in Microsoft's support matrix: check it in the test migration.
    Azure Migrate agent-based migrationWhether it offers the same choice: not stated in Microsoft's support matrix: check it when you start replication.

    Tip: Confirm eligibility with your Microsoft licensing partner before you start replication.

    Microsoft Learn: Migrate VMware VMs to Azure (agentless)
  • How each tool handles it
    Built-in methodAgentless: the portal configures 10 VMs at a time. One appliance replicates up to 300 VMs at once per vCenter Server, or 500 with a scale-out appliance. If the appliance or its Azure connection is down for more than 90 minutes, the replication cycle in progress starts again from 0%.
    Az.Migrate PowerShell moduleStarts replication for a whole wave from one script. Up to 500 replications can run at once. You write the loop yourself.

    Tip: Exclude the appliance from patching reboots and proxy changes while waves replicate.

    Microsoft Learn: Support matrix for VMware vSphere migration
  • How each tool handles it
    Built-in methodAgentless: after the first full copy, delta cycles (top-up copies of only changed blocks) repeat every 1 to 12 hours depending on how long the last cycle took. Test migration creates a VM without stopping replication. At migration an on-demand final cycle copies the remaining changes; Microsoft says to shut the source VM down first to prevent data loss.
    Azure Migrate agent-based migrationReplication timing: not stated in Microsoft's support matrix: test it in your pilot.

    Tip: Always test into the isolated test network, and clean up each test migration before the real one.

    Microsoft Learn: How agentless migration of VMware VMs works
  • How each tool handles it
    Built-in methodAgentless: until you select Complete migration, you can stop the Azure VM and power the source back on. Complete migration stops replication and deletes the intermediate disks, and cannot be reversed: migrating that server again means replicating from the beginning.

    Tip: Keep the source VM powered off but intact until every owner has signed off.

    Microsoft Learn: How agentless migration of VMware VMs works
The plan, phase by phase
  1. 1

    Plan the landing

    Before discovery starts

    Watch out: The target region cannot be changed once the first replication starts or Hyper-V or physical resources are created.

    Ways around it

    • Agree the region in the Network and DNS worksheet first, and use a separate project for any second region.
    Show the detailed steps (3) →
  2. 2

    Discover and assess

    Over a full business cycle

    Watch out: Agentless replication does not copy RDM (raw device) or passthrough disks, and does not support independent disks or iSCSI targets.

    Ways around it

    • Run a test migration of any flagged VM and check every volume is there.

    Tools that can do it

    Watch out: vCenter servers in Linked Mode are not discovered through the one you added.

    Ways around it

    • Add each vCenter Server to the appliance separately (up to 10 per appliance).
    Show the detailed steps (3) →
  3. 3

    Start replication

    Watch out: The Azure Migrate portal lets you select only 10 machines at a time for replication.

    Ways around it

    • Split each wave into batches of 10 in the wave plan.

    Tools that can do it

    • Az.Migrate PowerShell moduleStarts replication for a whole wave from one script. Up to 500 replications can run at once. You write the loop yourself.

    Watch out: Agentless: if the appliance or its Azure connection is down for more than 90 minutes, the replication cycle in progress starts again from 0%.

    Ways around it

    • Monitor the appliance's outbound connection and avoid proxy changes while waves replicate.

    Watch out: The Hyper-V registration key is valid for only five days.

    Ways around it

    • Book host changes before you select Create resources, and download a fresh key if the window slips.
    Show the detailed steps (4) →
  4. 4

    Test a copy

    Watch out: A test VM is a full copy with the same name, so in the production network it can register in DNS or send mail twice.

    Ways around it

    • Always choose the isolated test virtual network.

    Watch out: The Upgrade available option upgrades Windows Server during the move, but applications may not support the newer version.

    Ways around it

    • Try the upgrade in a test migration first, and use it mainly for servers near end of support.
    Show the detailed steps (3) →
  5. 5

    Cut over

    In the planned change window

    Watch out: Agentless: Azure Migrate sets servers to get their address by DHCP, so they get new private IPs. Long DNS caching and hard-coded IPs keep clients on the old server.

    Ways around it

    • Lower TTLs first, and update application settings that reference host names or IPs.

    Watch out: Rolling back after users write data in Azure means copying those changes back by hand.

    Ways around it

    • Until Complete migration, stop the Azure VM, power the source back on and revert DNS.
    • If domain sign-in fails on the source, repair its trust with Test-ComputerSecureChannel -Repair.

    Turn this phase into dated tasks with the cutover planner

    Check your DNS records before and after the change

    Show the detailed steps (3) →
  6. 6

    Complete and clean up

    After the rollback window and sign-off

    Watch out: Complete migration cannot be reversed: migrating that server again means replicating from the beginning.

    Ways around it

    • Keep the source VM powered off but intact until every owner has signed off.
    Show the detailed steps (2) →
You are finished when
  • Every server in the wave shows migration succeeded, with all its disks and the VM agent Ready.
  • Names resolve to the new private IPs, domain sign-in works and every owner has signed off.
  • Each VM has a successful backup and appears in Update Manager and Defender for Cloud.
  • Source VMs are powered off and no client still connects to their old addresses.

Tools named in this plan are independent third-party products, not endorsed by the platform vendor and not paid placements. Check the tool's own documentation and run a pilot first.

Click by click

Detailed steps

Open a part when you reach it in the plan. Each step says where to go, what to do and what you should see.

About this migrationWhat it covers, limits at a glance

Azure Migrate is Microsoft's hub for moving servers into Azure. For VMware it can replicate VMs without installing agents in the guests. Hyper-V uses a provider installed on each host. Physical servers, other hypervisors and VMs in other clouds use an agent-based method with a separate replication appliance.

If you need to keep running vSphere, Azure VMware Solution is the alternative and is covered at the end of this guide.

Native toolAzure Migrate (Discovery and assessment, plus Migration and modernization)
VMware methodAgentless replication through the Azure Migrate appliance
Hyper-V methodAzure Site Recovery provider and Recovery Services agent on each host
Physical and other cloudsAgent-based, using a separate replication appliance and the Mobility service
Metadata locationSet by the geography you choose for the project (for example Australia East or Australia Southeast for the Australia geography)
1What you need before step one
NeedDetailsWhere to get it
Azure rolesOwner or Contributor on the subscription to create the project and resources, plus the Azure Migrate roles Microsoft lists for registering appliances.Azure portal, https://portal.azure.com
vSphere accessvSphere administrator to deploy the OVA, and a read-only vCenter account for discovery (with Guest operations privileges for application discovery).vSphere Client: Administration > Access Control
Appliance VM (VMware)32 GB RAM, 8 vCPUs, about 80 GB of disk, and internet access directly or through an HTTP proxy.Set up the Azure Migrate appliance
Hyper-V hostsLocal admin on each host or cluster node to install the replication provider.Provider and key download from the Azure Migrate project
Physical or other-cloud serversA separate Windows server for the replication appliance, and admin or root credentials on each source.Installer: https://aka.ms/V2ARcmApplianceCreationPowershellZip
Azure CLI or Azure PowerShell (optional)For the network and scripted replication commands below.Install the Azure CLI; Install Azure PowerShell
TemplatesApplication inventory and dependency map, Network and DNS worksheet, Cutover runsheet.Templates linked at the end of this guide
2Plan the landing zone and project3 steps
  1. 1

    Choose the target region

    Where: Microsoft Learn: Azure Migrate supported geographies, and your Network and DNS worksheet

    Choose the region closest to your users that meets your data residency rules. The geography you pick for the Azure Migrate project decides where project metadata is stored. For example, with the Australia geography it is stored in Australia East or Australia Southeast.

    You should see: The worksheet records one target region and one project geography, approved by the project owner.
  2. 2

    Build the network first

    Where: Azure Cloud Shell or a terminal with the Azure CLI signed in (install the Azure CLI)

    Create the resource group, virtual network and subnets in the target region, plus a separate isolated virtual network for test migrations. Virtual networks are regional, so they must be in the same region you replicate to.

    az group create --name rg-migrate-aue --location australiaeast
    az network vnet create --resource-group rg-migrate-aue --name vnet-prod-aue --address-prefix 10.20.0.0/16 --subnet-name snet-servers --subnet-prefix 10.20.1.0/24
    az network vnet create --resource-group rg-migrate-aue --name vnet-test-aue --address-prefix 10.99.0.0/16 --subnet-name snet-test --subnet-prefix 10.99.1.0/24
    You should see: Each command returns JSON with "provisioningState": "Succeeded".
  3. 3

    Create the Azure Migrate project

    Where: Azure portal > search Azure Migrate > Get started > Servers, databases and web apps > Create project

    Choose the subscription and resource group, name the project and choose the geography that matches your residency needs, then select Create. Full steps are in set up the Azure Migrate appliance.

    You should see: After a few minutes the project deploys and opens with Azure Migrate: Discovery and assessment added.
The target region is fixed. After you start the first replication (VMware) or create resources (Hyper-V and physical), the target region cannot be changed for that project.
3Deploy the discovery appliance (VMware)4 steps
  1. 1

    Generate the project key

    Where: Azure portal > Azure Migrate > your project > Servers, databases and web apps > Azure Migrate: Discovery and assessment > Discover

    In Are your servers virtualized? choose Yes, with VMware vSphere hypervisor. Give the appliance a name of 14 characters or fewer, select Generate key and copy the key. Do not close the pane while resources are created.

    You should see: A project key appears in the pane.
  2. 2

    Deploy the OVA

    Where: Same Discover pane > 2: Download Azure Migrate appliance > OVA file, then vSphere Client > File > Deploy OVF Template

    Download the OVA and deploy it. Microsoft lists 32 GB RAM, 8 vCPUs and about 80 GB of disk for the appliance, plus internet access directly or via an HTTP proxy. Pick a network with internet access in Network Mapping, power on the VM, then in Open Console accept the licence terms and set the administrator password.

    You should see: The appliance VM boots to the Windows sign-in screen.
  3. 3

    Create a vCenter account

    Where: vSphere Client: Administration > Access Control > Roles (clone Read-only), then Administration > Access Control > Global Permissions

    Create a read-only account. For application discovery and agentless dependency analysis on vCenter 7.x and later, clone the Read-only role, add Guest operations privileges and assign it with Propagate to children.

    You should see: The account is listed in Global Permissions with your cloned role and Propagate to children ticked.
  4. 4

    Register and start discovery

    Where: A browser that can reach the appliance: https://appliance-name-or-IP-address:44368 (the appliance configuration manager)

    Pass the prerequisite checks, paste the project key under Register with Azure Migrate and sign in with the account that generated the key. In Manage credentials and discovery sources add the vCenter account and up to 10 vCenter Servers per appliance, then select Start discovery.

    You should see: Each vCenter Server shows a validated status and discovery in progress. Discovered servers appear in the project in the Azure portal.
4Assess and group servers3 steps
  1. 1

    Let performance data collect

    Where: The Azure Migrate appliance (leave it running) and the project in the Azure portal

    Leave the appliance collecting data for a representative period so sizing reflects real usage, including month-end peaks. Do not shut the appliance down between discovery and assessment.

    You should see: The project shows discovered servers with performance data, and the appliance stays connected.
  2. 2

    Create an assessment

    Where: Azure Migrate project > Infrastructure tab > select the VMs > Create assessment

    Name the assessment and review the servers added (select Add workloads for more). Set Target region, Default environment, Pricing options, Saving options and Sizing criteria (performance-based or as-is). On the Azure VM tab select Edit defaults to review settings, then in Review + create assessment select Create Assessment. Review readiness, recommended VM sizes and disk types, and fix servers marked as not ready (unsupported OS, boot type, disk size) before replication.

    You should see: The assessment is listed under Decide and plan > Assessments > Workloads with readiness and size recommendations per server.
  3. 3

    Map dependencies and build waves

    Where: Azure Migrate project, dependency analysis (Microsoft Learn: create groups using machine dependency mapping), then your Migration wave plan template

    Use dependency analysis to find servers that must move together. Group them into migration waves and record each wave in the plan.

    You should see: Every server is in a wave, and servers that talk to each other are in the same wave or have a documented exception.
5Start replication4 steps

The steps differ by source. VMware uses the discovery appliance. Hyper-V and physical servers do not.

  1. 1

    VMware: agentless replication

    Where: Azure Migrate project > Execute > Migration > Start execution

    In Specify intent choose Servers or Virtual Machines(VM) and Azure VM. Select workloads From all inventory or From an assessment, choose the VMware vSphere appliance and Agentless migration. Choose the Target VM security type and the VMs, then set the target subscription, region, storage account, Azure Hybrid Benefit, virtual network, availability options, VM size and disk type. Select Review and start execution. Microsoft documents up to 500 simultaneous replications, and you can select up to 10 VMs at once in the portal.

    You should see: The VMs appear under Execute > Migrations at the Preparation stage with Execution status In progress, then move on as initial replication completes.
  2. 2

    Hyper-V: install the provider on each host

    Where: Azure Migrate project > Execute > Migration > Start execution > From replication provider (Hyper-V), then each Hyper-V host or cluster node

    Follow the portal link to the provider setup, select the Target region, tick the confirmation and select Create resources, then download the Hyper-V Replication provider and registration key. On each host run AzureSiteRecoveryProvider.exe, select Install, then Register, browse to the key and finish. The key is valid for five days. Back in the portal select Finalize registration, then start replication with Start execution as for VMware.

    You should see: Within about 15 minutes of finalising, the Hyper-V VMs appear in the tool and can be selected for replication.
  3. 3

    Physical servers and other clouds: replication appliance

    Where: Azure Migrate project > Execute > Migration > Start execution > From replication appliance (Physical or Others), then an elevated PowerShell window on a separate Windows server

    Select the Target region, confirm it and select Create resources. Build a separate Windows server for the replication appliance (not a source server and not the discovery appliance), download the installer from the portal or https://aka.ms/V2ARcmApplianceCreationPowershellZip, extract it and run DRInstaller.ps1 as administrator. In the appliance configuration manager, register with the replication appliance key, then add credentials and source servers. The Mobility service is pushed when you enable replication, or you install it manually. The classic replication appliance retired on 30 September 2026, so use the simplified appliance.

    .\DRInstaller.ps1
    You should see: The appliance shows as registered, and the source servers can be selected when you start execution.
  4. 4

    Script it with Azure PowerShell (optional)

    Where: PowerShell 7 with the Az.Migrate module (install Azure PowerShell), or Azure Cloud Shell (PowerShell)

    For VMware agentless migration, the Az.Migrate module covers the same steps.

    Connect-AzAccount
    $MigrateProject = Get-AzMigrateProject -Name MyMigrateProject -ResourceGroupName rg-migrate-aue
    $DiscoveredServer = Get-AzMigrateDiscoveredServer -ProjectName $MigrateProject.Name -ResourceGroupName rg-migrate-aue -DisplayName APP01
    Initialize-AzMigrateReplicationInfrastructure -ResourceGroupName rg-migrate-aue -ProjectName $MigrateProject.Name -Scenario agentlessVMware -TargetRegion "australiaeast"
    $TargetResourceGroup = Get-AzResourceGroup -Name rg-servers-aue
    $TargetVirtualNetwork = Get-AzVirtualNetwork -Name vnet-prod-aue
    New-AzMigrateServerReplication -InputObject $DiscoveredServer -TargetResourceGroupId $TargetResourceGroup.ResourceId -TargetNetworkId $TargetVirtualNetwork.Id -LicenseType NoLicenseType -OSDiskID $DiscoveredServer.Disk[0].Uuid -TargetSubnetName snet-servers -DiskType Standard_LRS -TargetVMName APP01 -TargetVMSize Standard_D2s_v5
    Get-AzMigrateServerMigrationStatus -ProjectName $MigrateProject.Name -ResourceGroupName rg-migrate-aue -MachineName APP01
    You should see: New-AzMigrateServerReplication returns a job, and Get-AzMigrateServerMigrationStatus shows the replication state for APP01.
Replication resets after long outages. Microsoft notes that if Azure connectivity or the appliance services are unavailable for more than 90 minutes, agentless replication cycles restart from 0%.
6Run a test migration3 steps
  1. 1

    Start the test

    Where: Azure Migrate project > Execute > Migrations > select the server name in the Workloads column > Testing > Start test migration

    Choose the isolated test virtual network and a subnet for each NIC. Optionally select Upgrade available to upgrade the Windows Server OS. Select Test migration. The source keeps running and replicating.

    $ReplicatingServer = Get-AzMigrateServerReplication -ProjectName $MigrateProject.Name -ResourceGroupName rg-migrate-aue -MachineName APP01
    $TestVirtualNetwork = Get-AzVirtualNetwork -Name vnet-test-aue
    Start-AzMigrateTestMigration -InputObject $ReplicatingServer -TestNetworkID $TestVirtualNetwork.Id
    You should see: Execution status shows the test job completing, and a test VM appears in the test virtual network.
  2. 2

    Validate the application

    Where: Azure portal > Virtual machines > the test VM > Connect (Bastion or RDP/SSH from a machine in the test network)

    Log on, check services start, run application smoke tests and confirm the VM agent and activation are healthy. Record any changes needed, such as connection strings or firewall rules.

    You should see: Smoke tests pass, or you have a written list of fixes for the cutover runsheet.
  3. 3

    Clean up the test

    Where: Azure Migrate project > Execute > Migrations > the server > Testing > Clean up test migration

    Remove the test VM so it does not clash with the real migration.

    Start-AzMigrateTestMigrationCleanup -InputObject $ReplicatingServer
    You should see: The test VM is deleted and the server is ready for migration.
7Cut over3 steps
  1. 1

    Stop the application and migrate

    Where: The source server (stop application services), then Azure Migrate project > Execute > Migrations > the server > Completion > Migrate

    In the change window, stop application services. In the Migrate pane, under Shut down virtual machines and perform a planned migration with no data loss, choose Yes, then select Migrate. Azure Migrate shuts down the source VM and runs a final replication so no data is lost.

    Start-AzMigrateServerMigration -InputObject $ReplicatingServer -TurnOffSourceServer
    You should see: The job completes in Azure notifications and the server appears at the Completion stage on the Migrations page.
  2. 2

    Update DNS and dependencies

    Where: Your DNS server (DNS Manager on a domain controller) or DNS host, plus load balancers and firewalls

    Point DNS records, load balancers and firewall rules at the new private IP addresses. Update application settings that reference host names or IPs.

    Resolve-DnsName app01.contoso.com
    You should see: The name resolves to the Azure VM's private IP address and users can reach the application.
  3. 3

    Complete the migration

    Where: Azure Migrate project > Execute > Migrations > the server > Completion > Complete migration

    After acceptance testing, select Complete migration to stop replication and clean up replication state.

    Remove-AzMigrateServerReplication -InputObject $ReplicatingServer
    You should see: Replication stops for the server and it no longer shows an active replication.
Plan rollback before you start. Keep the source VM powered off but intact until sign-off. Rolling back means powering the source on and reverting DNS.
8Harden and decommission2 steps
  1. 1

    Protect the new VMs

    Where: Azure portal: each VM > Backup; Azure Update Manager; Microsoft Defender for Cloud; Cost Management > Budgets

    Enable Azure Backup, apply network security groups, configure Azure Update Manager and Defender for Cloud, and set budgets in Cost Management.

    You should see: Each VM shows a backup policy and a completed first backup, and a budget exists for the resource group.
  2. 2

    Decommission the source

    Where: vSphere Client or Hyper-V Manager, your backup console and documentation

    Remove the on-premises VMs from inventory and backup jobs once the rollback window has closed, and update documentation with the new locations and IP addresses.

    You should see: No migrated VM remains in vCenter, Hyper-V or on-premises backup jobs.
9Azure VMware Solution instead of rehosting2 steps

Azure VMware Solution gives you a vSphere private cloud on dedicated hosts in Azure. You move VMs without converting them, and keep vCenter and VMware tooling.

  1. 1

    Check regional host availability

    Where: Microsoft Learn: Azure VMware Solution private cloud and cluster concepts (host types by region table)

    Host types vary by region, so check Microsoft's list for yours. For example, Microsoft lists Azure VMware Solution host types in Australia East (AV36, AV36P and AV64 across zones) and Australia Southeast (AV36). A cluster needs a minimum of three hosts.

    You should see: You know which host types are offered in your target region and the minimum cluster size.
  2. 2

    Decide whether it fits

    Where: Your Workload 7R decision matrix and business case

    It suits large estates that need to exit a data centre quickly or have VMware-dependent appliances. You still license VMware, so compare it with rehosting in the VMware alternatives guide.

    You should see: Each workload is marked rehost to Azure VM or relocate to Azure VMware Solution.
Worth knowing

Expert notes

The detail behind the plan: options compared, and what experienced engineers check first. Tap any item.

Compare all the ways to do this3 options

Azure Migrate agentless replication

Medium effort

Best for: VMware VMs managed by vCenter

  • Nothing to install inside the guests
  • The same appliance handles discovery, assessment and replication
  • The appliance and its connection must stay healthy for the whole project
  • Replicate in batches rather than all at once
Read more →

Azure Migrate agent-based replication

Medium effort

Best for: Physical servers, other hypervisors and VMs in other clouds

  • Works wherever the server runs, treating it as a physical server
  • Uses a separate replication appliance and the Mobility service
  • The Mobility service must be installed on every server
  • One more appliance to build and maintain
Read more →

Azure VMware Solution

High effort

Best for: Large estates that need to exit a data centre quickly or have VMware-dependent appliances

  • A vSphere private cloud on dedicated hosts in Azure
  • VMs move without conversion, and vCenter and VMware tooling stay
  • You still license VMware
  • A cluster needs at least three hosts, and host types vary by region
Read more →
Our advice

Use agentless replication for VMware VMs and agent-based replication for physical servers and other clouds; Hyper-V uses its own host provider. Choose Azure VMware Solution only when you must keep vSphere or need to leave a data centre faster than you can rehost, and compare it with the options in the VMware alternatives guide.

Pick the target region before the first replicationReduces risk

Microsoft says the target region cannot be changed for the project after you start the first VMware replication or select Create resources for Hyper-V and physical servers.

What to do

Agree the region in the Network and DNS worksheet and build the virtual networks there first. If some workloads must go to a second region, plan a separate project for them.

Microsoft Learn: Migrate Hyper-V VMs to Azure
Use performance-based sizing, not as-isCost lever

On-premises VMs are often over-provisioned. Sizing Azure VMs on allocated vCPU and memory carries that waste into the monthly bill.

What to do

Let the appliance collect performance data over a full business cycle, choose performance-based Sizing criteria when you create the assessment, and compare the recommendation with known peaks before accepting it.

Microsoft Learn: Create an assessment
Keep the appliance and its connection healthySaves time

Microsoft notes that if Azure connectivity or the appliance services are unavailable for more than 90 minutes, agentless replication cycles restart from 0%.

What to do

Exclude the appliance from patching reboots during replication, monitor its outbound connection, and avoid proxy changes while waves are replicating.

Microsoft Learn: Migrate VMware VMs to Azure (agentless)
Register Hyper-V hosts within five days of downloading the keySaves time

The Hyper-V registration key is valid for five days. Change freezes on hosts often push installs past that, and registration then fails.

What to do

Book host changes before you select Create resources, install the provider on every host or cluster node in one window, and download a fresh key if the window slips.

Microsoft Learn: Migrate Hyper-V VMs to Azure
Use the simplified replication appliance for physical serversReduces risk

Microsoft says the classic replication appliance retired on 30 September 2026 and the simplified appliance must be used for all new agent-based migrations.

What to do

Download the installer from the portal or https://aka.ms/V2ARcmApplianceCreationPowershellZip and run DRInstaller.ps1. If you still have replications on a classic appliance, finish or move them before the retirement date.

Microsoft Learn: Migrate machines as physical servers to Azure
Batch replications in groups of 10Saves time

The portal lets you select up to 10 machines at once for replication. Large waves set up one screen at a time take longer than planned.

What to do

Split each wave into batches of 10 in the wave plan, or use the Az.Migrate PowerShell commands to script replication for larger waves.

Tools that can get around this

The portal limit is per screen, not per project. Scripting replication with PowerShell lets one run start replication for a whole wave.

  • Az.Migrate PowerShell moduleGet-AzMigrateDiscoveredServer lists every discovered VM and New-AzMigrateServerReplication starts each one; Microsoft says up to 500 replications can run at once. You write the loop yourself.
Third-party tools, not endorsed by the platform vendor. Confirm in the tool's documentation and run a pilot first.
Microsoft Learn: Migrate machines as physical servers to Azure
Run every test migration in an isolated networkReduces risk

A test VM is a full copy of the server, with the same name and services. In the production network it can register in DNS, send mail or process jobs twice.

What to do

Always choose the isolated test virtual network in Start test migration, and select Clean up test migration when testing is finished.

Microsoft Learn: Migrate VMware VMs to Azure (agentless)
Apply Azure Hybrid Benefit where you are entitledCost lever

The Target settings step has Azure Hybrid Benefit options. Leaving them off for servers covered by eligible Windows Server licences means paying for licences twice.

What to do

Confirm eligibility with your licensing partner and tick the Azure Hybrid Benefit options when you start execution. Check the vendor's current pricing for the difference.

Microsoft Learn: Migrate VMware VMs to Azure (agentless)
Consider the OS upgrade option during migrationSaves time

Test migration and migration offer Upgrade available to upgrade the Windows Server OS. Servers on old versions can move and upgrade in one change.

What to do

Test the upgrade in a test migration first, because applications may not support the newer OS. Use it for servers close to end of support, such as Windows Server 2016.

Microsoft Learn: Migrate VMware VMs to Azure (agentless)
Lower DNS TTLs and list hard-coded IPsUser impact

Migrated VMs get new private IP addresses. Long DNS TTLs and IPs in config files keep clients pointing at the old server after cutover.

What to do

Lower TTLs on the records you will change a few days before cutover (lower DNS TTL), and search application configs for IP addresses during the test migration.

Find RDM, independent and iSCSI disks before you choose agentlessReduces risk

Microsoft's VMware support matrix says agentless replication does not support independent disks or VMs with iSCSI targets, and that RDM or passthrough disks are not replicated to Azure. A VM with an RDM disk can replicate and boot in Azure without that disk.

What to do

Add disk mode, RDM and in-guest iSCSI columns to the inventory, run a test migration of any flagged VM and check every volume is present. Note that encrypted disks, shared disk clusters and NFS volumes mounted inside the guest are not supported by either method.

Tools that can get around this

The agent-based method installs the Mobility service inside the guest, so it replicates disks that agentless replication cannot see or skips.

  • Azure Migrate agent-based migrationMicrosoft lists independent disks, passthrough disks and iSCSI targets as supported for agent-based migration. Needs the replication appliance and the Mobility service on each VM.
Third-party tools, not endorsed by the platform vendor. Confirm in the tool's documentation and run a pilot first.
Microsoft Learn: Support matrix for VMware migration
Finish safely

Check it worked, or roll back

Full validation checklist8 checks

Run these before you declare the migration complete. Record the results in the data validation report.

CheckHow to checkWhat good looks like
Every server in the wave migrated

In the Azure Migrate project open Execute > Migrations and compare the servers and their status with your migration wave plan. With Az.Migrate, run Get-AzMigrateServerReplication -ProjectName $MigrateProject.Name -ResourceGroupName rg-migrate-aue.

Every server in the wave shows migration succeeded; none show replication errors or a test migration left uncleaned.
VMs boot with all disks and the VM agent healthy

In the Azure portal open each VM > Overview and Boot diagnostics, then connect with Bastion or RDP/SSH and check every data disk is online.

The VM is running, the VM agent status is Ready, and every disk from the source inventory is present with the right size.
Size, network and region are as assessed

Compare each VM's size, virtual network, subnet and private IP in the Azure portal with your assessment and Network and DNS worksheet.

Every VM is in the target region and subnet with the size you chose from the performance-based assessment.
DNS and dependencies point at Azure

Run Resolve-DnsName app01.contoso.com from on-premises and from another Azure VM, and check load balancer backend health and firewall rules.

Names resolve to the new private IPs and backends show healthy.
Domain membership and sign-in work

On each migrated Windows VM, run Test-ComputerSecureChannel in an elevated PowerShell window and sign in with a domain account.

Test-ComputerSecureChannel returns True and domain users can sign in.
Applications and integrations pass acceptance tests

Run the acceptance tests in your Cutover runsheet with each owner, including scheduled jobs, outbound email and calls to on-premises systems.

All tests pass and each owner signs off.
Protection and operations are in place

In the Azure portal check each VM > Backup for a completed backup, Azure Update Manager for assessment results, and Microsoft Defender for Cloud for the VM.

Each VM has a successful backup, appears in Update Manager and is covered in Defender for Cloud.
The source VM is off and receives no traffic

In vSphere Client or Hyper-V Manager check the source VM is powered off, and check firewall logs for any traffic to its old address after cutover.

The source is powered off and no client connects to its old address.
Rollback planIf it goes wrong

Roll back if

  • A migrated VM fails to boot or loses disks in Azure and the fix is not found in the window
  • Acceptance tests fail on a critical application after DNS changes
  • Hybrid connectivity to on-premises dependencies fails and cannot be fixed in the window
  • Performance is far below the baseline and resizing does not fix it

Point of no return

Until users write to the Azure VM and you select Complete migration, rollback means powering the source on and reverting DNS. Complete migration stops replication and cleans up the replication state, so migrating that server again means starting replication from the beginning. Once users write data in Azure, rolling back also means copying it back. If you chose the OS upgrade option, only the Azure VM was upgraded; the source stays on its old version. Deleting the source VM is the final point of no return.

  1. 1

    Stop the Azure VM

    Where: Azure portal > Virtual machines > the VM > Stop

    Stop the application services, note any data written since cutover, then stop the VM so it cannot clash with the source on the domain or network.

    You should see: The VM shows Stopped (deallocated).
  2. 2

    Power on the source VM

    Where: vSphere Client > the VM > Actions > Power > Power On (or Hyper-V Manager > the VM > Start)

    Start the source VM, which Azure Migrate shut down during the planned migration, then start its application services.

    You should see: The VM boots and the application responds on its original address.
  3. 3

    Repair the domain trust if needed

    Where: Elevated Windows PowerShell on the source VM

    If the Azure VM was joined to the domain while it ran, it may have changed the computer account password and the source no longer matches. Run Test-ComputerSecureChannel, and if it returns False, run Test-ComputerSecureChannel -Repair -Credential (Get-Credential).

    You should see: Test-ComputerSecureChannel returns True and domain users can sign in.
  4. 4

    Revert DNS and dependencies

    Where: DNS Manager on a domain controller or your DNS host, plus load balancers and firewalls

    Point records back to the source IP addresses and reverse any load balancer or firewall changes.

    You should see: Resolve-DnsName app01.contoso.com returns the source address and application tests pass.
  5. 5

    Copy back post-cutover data

    Where: The application or database on the stopped Azure VM (start it in an isolated network if needed)

    Export data written in Azure since cutover and apply it to the source, or get the data owner to accept the loss in writing.

    You should see: The source holds every change since cutover, or the gap is signed off.
  6. 6

    Record what cannot be undone

    Where: Your Rollback plan and Cutover runsheet

    Note that Complete migration cannot be reversed (replication must start again), that the target region is fixed for the project, and that a deleted source VM can only come back from backup. Complete migration and decommission only after sign-off.

    You should see: Complete migration and decommission dates are after the rollback window.

Agree the triggers and who decides before the go / no-go meeting. Use the rollback plan template.

Common problems and fixes6 errors
Agentless replication cycle starts again

Cause: Azure connectivity or appliance services were unavailable for more than 90 minutes.

Fix: Restore appliance connectivity, check proxy and firewall rules, and let the cycle complete before testing.

Agentless migration fails for a VM with non-ASCII characters in the VMDK name

Cause: Azure Migrate does not support agentless migration of VMDKs containing non-ASCII characters.

Fix: Rename the disk files in vSphere, or use the agent-based method for that VM.

Hyper-V host registration fails with an invalid key

Cause: The registration key is more than five days old.

Fix: Download a new registration key from the project and register the host again.

Physical server replication stuck at initial replication

Cause: Ports between the source and the replication appliance are blocked, or a stale duplicate appliance is registered.

Fix: Allow HTTPS 443 and TCP 9443 to the replication appliance and remove stale appliances from the project.

Migrated Windows VM is not activated

Cause: Activation did not complete against Azure KMS after migration.

Fix: Check outbound access to the Azure KMS endpoint and rerun activation inside the guest.

Discovery shows no VMs from a linked vCenter

Cause: vCenter servers in Linked Mode are not discovered through the vCenter you added.

Fix: Add each vCenter Server to the appliance separately.

Search the full error library →

FAQ

Frequently asked questions

Does Azure Migrate need agents on VMware VMs?

No. VMware VMs can use agentless replication through the Azure Migrate appliance. Agent-based migration is available when agentless is not suitable.

Can I migrate physical servers or AWS instances with Azure Migrate?

Yes. They are migrated as physical servers using the agent-based method, a separate replication appliance and the Mobility service.

Which region should I use?

Deploy your target VMs in the region that meets your residency and latency needs. Project metadata is stored in the geography you choose; for the Australia geography that is Australia East or Australia Southeast.

Does a test migration affect the source server?

No. The source keeps running and replicating while the test VM runs in the isolated network you choose.

How many VMs can I replicate at once?

Microsoft documents up to 500 simultaneous agentless VMware replications, with up to 10 VMs selected at a time in the portal.

Should I use Azure VMware Solution instead?

Use it if you need to keep vSphere, move quickly without conversion, or run VMware-only appliances. Otherwise rehosting to Azure VMs removes the VMware licence dependency.

Sources

Official sources

8 official pages this guide is based on