If you are still running Windows Server 2012 R2 or 2016, the clock has already gone off. Windows Server end of support arrived for 2012 and 2012 R2 in October 2023, and Server 2016 leaves mainstream support behind with extended support ending in January 2027. Unsupported means no security patches. Plan the migration now, before something forces your hand.
Where the dates actually sit
The confusion around server end-of-support comes from Microsoft’s two-phase lifecycle. Every server release gets a mainstream support window, then an extended support window where you only receive security updates. When extended support ends, the patches stop completely. That is the date that matters.
| Product | Mainstream support ended | Extended support ends | Status today |
|---|
| Windows Server 2012 / 2012 R2 | October 2018 | 10 October 2023 | Out of support — no patches |
| Windows Server 2016 | January 2022 | 12 January 2027 | Security updates only — plan now |
| Windows Server 2019 | January 2024 | January 2029 | Extended support |
| Windows Server 2022 | October 2026 | October 2031 | Current, supported |
So 2012 and 2012 R2 have been unsupported for getting on two years. If you are running one, every month that box stays online is a month of unpatched vulnerabilities sitting on your network. Server 2016 is in a better spot, but “January 2027” is not far away once you account for procurement, testing and a cutover that has to happen outside business hours. The businesses that get caught are the ones that treat 2027 as a 2026 problem and discover in November that the line-of-business app vendor needs six weeks to certify the new platform.
What “unsupported” really costs you
The headline risk is obvious: no security updates. When a critical vulnerability lands in an unsupported Windows Server, Microsoft does not ship a fix for it, and attackers know exactly which versions are exposed. But the knock-on effects are where most Melbourne SMEs actually feel the pain.
- Cyber insurance. Insurers now ask whether you run supported operating systems. Running an out-of-support server can void a claim or get your renewal declined outright. We cover this in detail in our cyber insurance guide for Australian SMEs.
- Compliance and the Essential Eight. Patching operating systems is a core Essential Eight control. You cannot patch an OS that no longer receives patches, so an unsupported server is an automatic black mark in any maturity assessment.
- Software compatibility. Vendors drop support for old server platforms too. Newer versions of your accounting package, your SQL-backed database or your industry software may refuse to install or run.
- Hardware. Servers that old are frequently running on hardware well past its warranty, so you are carrying a failure risk on top of the patching risk.
A construction firm in Box Hill we work with discovered this the hard way at renewal time. Their broker’s questionnaire asked, in plain terms, whether any server ran an unsupported operating system. The honest answer was yes — a 2012 R2 box still hosting their estimating software. The premium loaded, and the underwriter wanted a remediation date in writing before they would bind cover. The migration that had been “next year’s project” became a four-week sprint.
The question nobody asks first: do you even need the server?
Before you price up a replacement, ask the harder question. A lot of the on-premises servers we decommission across Melbourne metro exist out of habit, not necessity. The workloads they were bought for have moved on, and the business is paying to keep a box alive that it could retire entirely.
Work through what the server actually does, role by role, because the answer changes the whole project:
- Active Directory / domain controller. If AD is the main reason the server exists, many smaller businesses can move to Entra ID (Azure AD) and Intune, manage devices in the cloud, and drop the on-prem domain controller altogether. Others genuinely still need it. This is the role that most often decides whether you keep a server at all.
- File server. File and folder shares are one of the easiest things to move. SharePoint and OneDrive in Microsoft 365 handle most SME file needs without a server, with versioning and external sharing built in. Heavy CAD or large-media workflows sometimes still warrant on-prem or a hybrid approach.
- Line-of-business applications. The make-or-break role. Some legacy apps only run on a Windows Server and tie you to keeping one. Increasingly, the vendor has a SaaS version, and migrating to it removes the server requirement and the maintenance burden together.
- SQL Server. Often hiding behind a line-of-business app. SQL Server 2012 and 2014 are themselves out of support, so a server migration is the moment to deal with the database engine too — either upgrading it or moving to Azure SQL.
For a genuinely cloud-ready SME, the best migration is often no server at all. Move files to Microsoft 365, identity to Entra ID, the line-of-business app to its SaaS edition, and the box goes in the bin. No replacement hardware, no Server licence, no patching for the next five years. That is not the right answer for everyone, but it should be the first option you rule in or out.
Your migration options
Once you know what the server does, there are three broad paths. Most businesses end up using a mix.
1. Replace with Windows Server 2022 or 2025
If you have workloads that genuinely belong on a server — heavy file workloads, an app the vendor only supports on-prem, a domain controller you are keeping — then a clean build on Windows Server 2022 or the newer 2025 release is the straightforward path. You provision new hardware or a new virtual machine, build it current, migrate the roles and data across, and retire the old box. This keeps everything on-premises and under your direct control, which suits businesses with specific latency, data-sovereignty or application-compatibility reasons to stay local.
2. Move to Azure
Lifting the workload into Microsoft Azure replaces the physical box with a cloud virtual machine. You stop worrying about hardware failure and capacity, and you can scale up or down. There is one detail worth knowing: if you run Windows Server 2012/2012 R2 or 2016 inside Azure, Microsoft provides Extended Security Updates at no additional cost while you complete your migration to a current version. Running those same versions on-premises means paying for ESU separately. So Azure can buy you a supported runway while you finish the project properly, rather than leaving an unpatched box exposed. Our cloud services team handles these migrations end to end.
3. Retire the server into SaaS and cloud platforms
The option covered above — move the workloads to cloud services and decommission the server entirely. No replacement, no licensing, no ongoing maintenance. For many SMEs this is both the cheapest long-term option and the most secure, because there is simply less infrastructure to patch and protect.
| Path | Best when | Server to maintain? | ESU situation |
|---|
| New Windows Server 2022/2025 | Workloads must stay on-prem | Yes | Current version, fully supported |
| Azure VM | You want cloud flexibility, less hardware risk | Managed VM | Free ESU for 2012/2016 during migration |
| SaaS / cloud, retire server | Apps and files can move to the cloud | No | Not applicable — no legacy OS left |
Planning the migration properly
A server migration goes wrong when it is treated as a like-for-like swap done over a weekend. It is a project with a discovery phase, and the discovery is where the surprises live — the scheduled task nobody documented, the printer driver hosted on the old box, the app that authenticates against the local domain.
- Assess. Inventory every role, application, dependency and integration on the server. Confirm with each software vendor which platforms they support and what they need. This is where you decide replace, move to Azure, or retire.
- Back up first. A verified, tested backup of the current server is non-negotiable before you touch anything. If the cutover goes sideways, the backup is your way home. Our backup and recovery approach treats this as the foundation of any migration, not an afterthought.
- Build and test in parallel. Stand up the new environment alongside the old one and test the line-of-business apps against it before you commit. Catch the compatibility problems while the old server is still running.
- Cut over outside business hours. Schedule the switch for an evening or weekend, with a rollback plan and a tested backup behind you. Communicate the window to staff so nobody loses work mid-flight.
- Decommission cleanly. Once the new environment is confirmed stable, retire the old server, revoke its access, and update your documentation and asset register so the next person knows what changed.
This is core MSP work, and it is exactly the kind of project our managed IT services are built around. TechAssist has been migrating Melbourne SMEs off ageing infrastructure since 2014, with 13 Australian-employed engineers and same-business-day on-site support across the metro when a cutover needs hands on the hardware. We run the assessment, handle the build, and own the cutover so your team is not improvising at 9pm on a Saturday.
Frequently asked questions
Is Windows Server 2016 still safe to use right now?
It still receives security updates until extended support ends on 12 January 2027, so it is patched for now. But “supported until 2027” is not the same as “leave it until 2027”. Migrations take planning, vendor coordination and a tested cutover, so start the assessment well before the deadline rather than scrambling in the final months.
Can I just keep running Windows Server 2012 R2 if it still works?
Technically it runs, but it has had no security patches since October 2023. New vulnerabilities go unfixed, it can void a cyber insurance claim, and it fails Essential Eight patching expectations. “It still works” is true right up until it is the entry point for a breach. Treat it as a liability to remove, not a server to keep.
How do free Extended Security Updates in Azure work?
If you migrate a Windows Server 2012/2012 R2 or 2016 workload into an Azure virtual machine, Microsoft provides Extended Security Updates for that legacy operating system at no extra charge while it runs in Azure. Running the same version on your own hardware means buying ESU separately. It is a runway to finish your move to a current version, not a permanent fix.
Do we actually still need an on-premises server?
Often, no. If your file shares can move to SharePoint and OneDrive, your identity to Entra ID, and your main application to a SaaS version, you can retire the server entirely. The deciding factor is usually one stubborn line-of-business app or a heavy file workload. The assessment tells you which camp you are in.
The short version
Windows Server 2012 and 2012 R2 are already out of support, and Server 2016 follows in January 2027 — so this is a now problem, not a later one. Start by asking whether you still need the server at all, then choose between a current Windows Server build, an Azure move with free Extended Security Updates while you migrate, or retiring the box into cloud and SaaS. Whichever path fits, the work is the same: assess properly, back up first, test in parallel, and cut over with a rollback plan. If you are running an ageing server and want a clear-eyed assessment of where it should go, get in touch and we will map your options before the deadline maps them for you.
Windows 10 reached windows 10 end of life on 14 October 2025. Microsoft has stopped shipping security updates, bug fixes and technical support for it. Every Windows 10 machine still running in your business is now an unpatched, slowly widening hole in your defences — and the clock has already passed midnight.
This isn’t a future problem to schedule for next quarter. If you’ve been telling yourself “we’ll deal with it later”, later arrived in October 2025. The good news: the path forward is well understood, and you have more options than panic-buying a truckload of new laptops. The bad news: every month you wait, the risk and the cost both climb.
What “end of support” actually means
End of support is not a switch that bricks your machines. Windows 10 still boots, your line-of-business apps still run, and your staff probably won’t notice anything different on the surface. That’s exactly what makes it dangerous. The operating system keeps working while the protection underneath it quietly rots.
From 14 October 2025, Microsoft no longer issues:
- Security updates for newly discovered vulnerabilities. When a critical flaw is found — and they are found constantly — Windows 11 gets a patch and Windows 10 does not.
- Reliability and bug fixes, so problems compound over time rather than getting resolved.
- Technical support from Microsoft, including for Microsoft 365 apps running on Windows 10. Office will keep functioning, but you’re on your own when something breaks.
An unpatched OS is the single softest target in most networks. Attackers don’t need to be clever; they just scan for known vulnerabilities that will never be fixed. Within months of an OS going end of life, exploit kits start treating it as low-hanging fruit.
The real risks of running an unsupported OS
The exposure here goes well beyond “you might get a virus”. For an Australian business, four distinct problems stack on top of each other.
Cyber security
Every month after October 2025 widens the gap between the threats in the wild and the defences on your endpoints. A single unpatched workstation can be the foothold an attacker uses to move laterally, harvest credentials and deploy ransomware across your whole environment. Endpoint detection helps, but it’s compensating for a structural weakness, not fixing it.
Compliance and the Essential Eight
The Australian Cyber Security Centre (ACSC) Essential Eight lists patch operating systems as one of its eight core mitigation strategies. The mitigation explicitly requires using an operating system that is still receiving vendor support. Run Windows 10 past end of life and you fail that control outright — you cannot reach even Maturity Level One. If you’re a government supplier, tendering for work, or contractually bound to Essential Eight alignment, an unsupported OS is a straight non-compliance. Our 90-day Essential Eight guide walks through how the patching controls are actually assessed.
Cyber insurance
Insurers have tightened their proposal forms considerably. Most now ask directly whether you run supported, patched operating systems and apply security updates within defined timeframes. Running an end-of-life OS can breach a policy condition, and if a claim arises from a vulnerability on an unsupported machine, you’re handing the insurer a clean reason to reduce or decline the payout. We cover this trap in detail in our cyber insurance guide for Australian SMEs. The premium you’ve paid for years may be worth far less than you think.
Privacy obligations
If a breach traced to an unsupported system exposes personal information, the Office of the Australian Information Commissioner (OAIC) Notifiable Data Breaches scheme can require you to notify affected individuals and the regulator. “We knew the OS was unsupported and kept using it” is not a position you want to defend to the OAIC, your customers, or your board.
Extended Security Updates — a stopgap, not a strategy
Microsoft offers Extended Security Updates (ESU) to keep critical and important security patches flowing after end of life. It is a deliberate bridge, not a destination, and it’s priced to make sure you treat it that way.
For consumers, Microsoft made a one-year ESU option available, including a free route for individuals who enable certain settings. That consumer path is genuinely a stopgap for a home PC — it is not a business strategy.
For business and enterprise, ESU is sold per device and the price escalates every year — Microsoft’s commercial ESU programme roughly doubles the per-device cost in year two and doubles again in year three. The model is intentional: it buys you breathing room while making procrastination progressively more painful. Pay for three years of ESU across a fleet and you’ll usually have spent more than it would have cost to simply replace or upgrade the machines.
Use ESU when you have a genuine, time-boxed reason — a legacy application that won’t run on Windows 11 yet, or a hardware refresh you can’t physically complete before the deadline. Do not use it as a way to avoid making a decision. Budget for ESU as a one-year bridge with a hard exit date, not a recurring line item.
Is your fleet ready for Windows 11?
Windows 11 is the obvious destination, but it has stricter hardware requirements than Windows 10, and that’s where most businesses get caught. A machine that runs Windows 10 perfectly well may be ineligible for an in-place upgrade.
The two requirements that trip people up most:
- TPM 2.0 — a Trusted Platform Module security chip. Many machines from the mid-2010s either lack it or have it disabled in the firmware. Sometimes it’s present and just needs enabling in the BIOS; sometimes it isn’t there at all.
- CPU compatibility — Microsoft only supports a defined list of processors, broadly Intel 8th generation and newer, and equivalent AMD Ryzen chips. Older CPUs are unsupported even if everything else checks out.
You can’t eyeball this across a fleet. A proper readiness assessment inventories every device, checks TPM status, CPU model, RAM and storage, and sorts each machine into one of three buckets: upgrade in place, replace, or bridge with ESU. That inventory is the foundation of every decision that follows. If you don’t have a current picture of what’s actually on people’s desks, that’s step one — and it’s something our managed IT services team handles as standard.
Your four options compared
There’s no single right answer for a whole business. Most Melbourne SMEs end up with a mix, machine by machine. Here’s how the four realistic paths stack up.
| Option | Best for | Upfront cost | Watch out for |
|---|
| Upgrade in place | Machines that already meet Windows 11 requirements (TPM 2.0, supported CPU) | Low — labour only | Confirm app compatibility; allow time per device |
| Replace hardware | Older machines that fail the CPU or TPM check | High — new device per user | Lead times; staged budget; secure disposal of old units |
| Cloud PC / Windows 365 | Shift/hybrid workers, thin-client setups, fast scaling | Ongoing per-user subscription | Needs reliable internet; recurring cost vs one-off |
| ESU bridge | A small number of machines tied to legacy apps, time-boxed | Per-device, escalating yearly | Stopgap only; set a hard exit date |
Cloud PC and Windows 365 deserve a closer look if you’re already invested in Microsoft 365. They run a full Windows 11 desktop from Microsoft’s cloud, streamed to whatever device the user has — which can extend the useful life of older hardware that’s no longer fit to run Windows 11 locally. It’s not right for everyone, but for the right workforce it sidesteps the hardware problem entirely. We can map this against your existing Microsoft 365 licensing so you’re not paying twice for the same capability.
A Melbourne scenario
A construction firm in Box Hill we work with came to us in early 2025 with about forty workstations, a mix of site-office desktops and project-manager laptops. A readiness scan put roughly half on supported hardware that could upgrade in place, a quarter on machines too old to meet the CPU requirement, and the rest as borderline. Two estimating PCs were locked to an older take-off application the vendor hadn’t yet certified for Windows 11.
The plan wrote itself once we had the data: upgrade the compliant half over a few weekends, replace the oldest quarter in two budgeted waves across two quarters, and put just those two estimating PCs on a one-year ESU bridge with a firm cut-off once the software vendor shipped its update. No big-bang spend, no scramble, and every machine accounted for. The difference between that and a panicked December rush was simply starting with an inventory.
Building the migration plan and budget
A workable migration plan is mostly about sequencing and money, not heroics. The pattern we use across Melbourne metro businesses:
- Inventory everything. Every device, its Windows 11 eligibility, and the apps it depends on.
- Triage into the three buckets — upgrade, replace, bridge — and flag any legacy-app blockers early.
- Stage the spend. Spread hardware replacement across two or three budget periods so it doesn’t land as one brutal capital hit.
- Prioritise by risk. Machines handling sensitive data or facing the internet move first; back-office spares can wait.
- Set hard dates for any ESU-bridged devices so the stopgap doesn’t quietly become permanent.
This is the kind of forward planning a virtual CIO engagement is built for — turning a looming deadline into a costed, scheduled programme your board can actually sign off. TechAssist has been doing exactly this for Melbourne SMEs since 2014, and our thirteen Australian-based engineers handle the rollout end to end rather than leaving you a spreadsheet and good luck.
Why “we’ll deal with it later” is now overdue
The deadline has passed. Every Windows 10 machine on your network today is unsupported, unpatched against new threats, and counting against your Essential Eight posture, your insurance position and your privacy obligations. None of that is alarmist — it’s just where the calendar sits as of June 2026.
The fix is straightforward once you’ve got an inventory and a plan, and it’s far cheaper to do deliberately over a quarter or two than as an emergency. The businesses that started early are already done. The ones still running Windows 10 are carrying risk every day they wait.
Frequently asked questions
Can I still use Windows 10 after October 2025?
Technically yes — the machines keep working. But they no longer receive security updates, so each one becomes a growing vulnerability. For a business, continuing on Windows 10 without ESU means accepting cyber, compliance and insurance risk that compounds month by month.
How much does business ESU cost?
Microsoft prices commercial ESU per device, and the cost escalates each year — roughly doubling in year two and again in year three. Over three years it typically exceeds the cost of upgrading or replacing the machine, which is by design. Treat ESU as a one-year bridge, not an ongoing plan.
How do I know if my computers can run Windows 11?
The common blockers are TPM 2.0 and CPU compatibility — broadly Intel 8th generation or newer and equivalent AMD chips. A fleet-wide readiness assessment checks every device automatically and sorts them into upgrade, replace or bridge. Guessing device-by-device isn’t reliable at scale.
Is Windows 365 a good alternative to buying new PCs?
For shift, hybrid or thin-client workforces it can be, because it streams a full Windows 11 desktop from the cloud and extends the life of older hardware. It’s a recurring per-user cost rather than a one-off purchase, so it suits some teams and not others. It’s worth modelling against your existing Microsoft 365 licensing.
Get a Windows 11 readiness assessment
If you’re still running Windows 10 anywhere in your business, the first move is an honest inventory: what you have, what can upgrade, what needs replacing, and what genuinely needs a short ESU bridge. Get in touch and we’ll scope it for you, then turn it into a staged, budgeted plan — so this gets sorted properly rather than hanging over you into another quarter.
Cloud migration is the IT category where buyer disappointment is most common. The phrase covers projects from a five-day SharePoint setup to a two-year replatforming. Partners range from competent boutiques to outfits with junior consultants who will learn on your bill. Picking the wrong one locks in operational pain for five years.
This is a buyer’s guide written from the engineering side of the table. We will define what cloud migration services actually mean for an Australian SME in 2026 (mostly file server to SharePoint and OneDrive, on-prem Active Directory to Entra ID, and on-prem SQL or line-of-business systems to Azure). We will cover the three pricing models you will see and which one fits your situation. We will name the lift-and-shift trap that costs SMEs more in year three than the original project cost. And we will give you the 12 questions to ask a prospective migration partner before you sign anything.
TechAssist has been running migrations for Melbourne SMEs since we were founded in 2014. Our cloud services Melbourne team has migrated firms ranging from 8 to 250 staff, across professional services, manufacturing, healthcare, and not-for-profit. We have 13 Australian engineers, two offices (Tecoma and 575 Bourke St CBD), a 24/7 NOC, and per-user fixed monthly pricing for the run state after the migration. The engineering bias in this guide is real but the recommendations are the same we give clients we end up not working with.
What “Cloud Migration Services” Actually Means in 2026
The term has been used loosely for so long it has lost meaning. Let us define it concretely. For an Australian SME in 2026, “cloud migration” almost always means one or more of the following workstreams.
File server to SharePoint and OneDrive. This is the bread-and-butter SME migration. An on-premise file server (often a Windows Server running 2016 or 2019 that is past end-of-life on hardware) is being retired, and the file shares are being moved to SharePoint Online document libraries plus OneDrive for individual user files. The work is more nuanced than it sounds: permissions need to be modelled cleanly, mapped drive habits need to be transitioned, and the file structure usually needs to be restructured at the same time because the on-prem structure has accumulated 15 years of cruft.
On-premise Active Directory to Entra ID. The identity layer migration. Moving from a Windows Server domain controller to Entra ID as the primary identity provider, with hybrid join or full cloud join for Windows endpoints. This is the foundation for conditional access, device compliance, and most of the modern security controls. It is also the migration that quietly breaks the most legacy line-of-business applications, so the discovery work needs to be thorough.
On-premise SQL or line-of-business system to Azure. The infrastructure-as-a-service or platform-as-a-service migration. Moving a database or LOB application from on-premise servers to Azure SQL, Azure VMs, or App Service. This is where the lift-and-shift trap lives, and we will talk about it shortly.
Email migration. Moving from on-prem Exchange or a third-party mail provider to Exchange Online. This is increasingly a small workstream because most SMEs already moved email to the cloud years ago, but it still comes up for late-mover firms and for post-acquisition consolidation work.
Backup re-platforming. Moving from on-prem backup appliances to cloud-native or hybrid backup services that protect both on-prem and cloud workloads. This often gets bundled into the migration scope because the existing backup tool does not protect the new cloud workloads, and trying to bolt it on later costs more than rebuilding the backup strategy properly. See our backup and disaster recovery Melbourne 2026 guide for the broader picture.
For a typical Melbourne SME migration, two or three of these workstreams are bundled into a single engagement, with the file server and Entra ID work usually being the core, and the SQL or LOB workstream being the optional but heavier component.
The Three Pricing Models
The pricing model a partner offers tells you a lot about how they run projects. There are three common shapes for cloud migration engagements in the Australian SME market.
| Pricing model | How it works | Best fit | Watch for |
|---|
| Fixed-price discovery plus T&M build | Fixed fee for a one-to-three-week discovery and scoping phase. Build phase is time and materials with a budget cap and weekly reporting. | Mid-complexity migrations where scope is genuinely uncertain. | T&M without a cap is open-ended. Insist on a cap and weekly reporting. |
| Hybrid (fixed core, T&M for complex bits) | Fixed price for the standard workstreams (file server, AD, email), T&M for anything custom (LOB integration, data transformation). | Most SME migrations of moderate complexity. | The boundary between fixed and T&M needs to be crystal-clear in the SOW. Vagueness here causes disputes. |
| Full fixed price | One fixed number for the entire engagement, including all workstreams, change requests within a defined envelope. | Well-defined migrations with low ambiguity in scope. | The partner has priced in risk margin. You will pay more than T&M would cost if the project runs smoothly. The upside is predictability. |
The honest take on which to choose: hybrid is the right answer for most Melbourne SMEs in the 30 to 100 staff range. Fixed-price discovery plus T&M build is the right answer when you have a legacy line-of-business application and the discovery phase needs to surface what the migration actually involves before anyone can credibly quote it. Full fixed price is the right answer when you have rigid budget approval processes that cannot tolerate any variance.
The model that should make you nervous: a low fixed price for an aggressive scope, where the partner is hoping to use change orders to recoup margin. This is the most common pattern of buyer disappointment we see. The kick-off feels great, the price feels right, and by week six you have approved $40,000 of change orders and the partner has rebuilt their margin on top of the original quote. The protection against this is a thorough discovery before the contract is signed.
The Lift-and-Shift Trap
This is the trap that costs Melbourne SMEs more in cloud cost over time than the migration itself. The partner takes your on-premise SQL Server, lifts it onto an Azure VM with the same specs, and shifts it to the cloud. The migration is fast, the bill at the end is low, and the project is declared a success.
The problem is what happens in year two and year three. The on-prem server was a one-time hardware capital cost amortised over five years. The Azure VM is a recurring operational cost forever. The specs that made sense on-prem (over-provisioned because hardware was hard to expand) are wasted in Azure because cloud workloads should be sized to actual load and scaled when needed. The result is a perpetual Azure bill that is two to four times what a properly designed cloud architecture would cost, with worse performance characteristics.
The fix is platform-as-a-service or refactoring during the migration, not after. Specifically: SQL Server should usually become Azure SQL Database (with elastic pool, or serverless tier for variable workloads), not an Azure VM running SQL Server. Windows Server file shares should become SharePoint and OneDrive, not Azure Files. Custom applications should be containerised or refactored to App Service where viable, not lifted onto VMs.
The reason partners default to lift-and-shift is that it is fast and low-risk for them. It avoids the architectural conversations that take time and require Azure expertise that not every partner has. It also positions them for a profitable optimisation engagement in year two, when the bill is hurting and you come back asking for help.
If you are evaluating a migration partner, the lift-and-shift conversation is the single best test of their depth. Ask them what they would do with your specific workloads. If the answer is “lift to Azure VMs first, optimise later,” that is a partner who is going to leave you paying the on-prem tax in Azure forever. Walk away. The right answer is “let us look at each workload and design the target architecture before we move, even if it takes longer up front.”
The 12 Questions to Ask Before You Sign
These are the questions we would ask if we were on the buyer side of a migration engagement. The answers will tell you more than any case study.
One. Show me the discovery deliverable from your last three SME migrations. The discovery document is the single best indicator of how seriously a partner takes scoping. If they cannot show you a sanitised example, or if the example is two pages of high-level boxes, they are not doing real discovery.
Two. How will you handle the Azure cost forecast for year one, year two, and year three? You want a projected monthly Azure bill at each milestone, with the assumptions stated. Partners who cannot do this are guessing on the cost side, and guessing means surprises.
Three. What is your specific approach to file permissions during the SharePoint migration? File permissions are where the migration’s hidden complexity lives. The right answer involves a permissions audit, a model for SharePoint sites and Teams, and a plan for the inevitable exceptions. The wrong answer is “we will replicate the existing structure.”
Four. How do you handle the legacy line-of-business application that does not support Entra ID? Every SME has at least one. The right answer involves identifying it during discovery, modelling the options (hybrid join, application proxy, replacement, retirement), and pricing the work accordingly. The wrong answer is “we will figure it out during the build.”
Five. What is your incident response if the migration goes sideways at 8pm on a cutover Saturday? You want to know who is on call, what their response time commitment is, and what the rollback procedure looks like. Cutover weekends are when migrations fail spectacularly, and you need to know there is a human and a plan when it happens.
Six. Who are the named engineers on this project, and what are their certifications? Not “our team has Azure certifications.” You want names, role descriptions, and which specific engineers will be doing the architecture and implementation. Partners who staff projects with rotating cast members give you inconsistent work quality.
Seven. What does your post-migration run state look like, and what is the handover process? Most migration disappointment is not during the migration. It is in the six months after, when something breaks and the partner is no longer engaged. You want clarity on the handover, the run state ownership, and the path to ongoing support.
Eight. Can you share a reference from a Melbourne SME of similar size and complexity, in the last 18 months? You want the reference to be both recent (so the partner is still operating at the same standard) and comparable (so the work has actually relevant similarity to yours). Generic enterprise references are not useful for SME engagements.
Nine. What happens if Azure costs come in higher than your forecast? Specifically: who eats the difference, and what is the process for re-evaluating the architecture? A partner who says “we will work with you to optimise” without committing to any responsibility is offloading the architectural risk onto you.
Ten. How do you handle change requests during the build? You want a written change request process with size thresholds, approval steps, and a commitment that changes below a certain dollar value will be absorbed rather than charged. Without this, change requests become the partner’s margin recovery mechanism.
Eleven. What is your approach to security during and after the migration? The migration is the perfect moment to uplift conditional access, MFA, application control, and Essential Eight alignment. A partner who treats security as out of scope for the migration is leaving the most valuable work on the table.
Twelve. Where will my data live geographically, and what is the data residency commitment? For most SMEs the answer is Azure Australia East or Australia Southeast, but you want this stated explicitly, with the specific workloads named. This matters more than buyers usually realise, especially for clients in government supply chain or regulated sectors.
The partner’s answers to these twelve questions will tell you who you are dealing with. The partner who hedges or generalises is the partner who will surprise you later. The partner who has specific, named, defensible answers is the partner worth talking to in detail.
A Sample Scope-of-Work Skeleton
Here is the structure of a sensible SOW for a Melbourne SME cloud migration. Adapt this for your situation. If the partner’s SOW is shorter or thinner than this, push back.
| SOW section | What it should contain |
|---|
| Executive summary | One-page summary of the engagement, the workstreams, the duration, and the price. |
| Discovery deliverables | Detailed inventory of current state, target architecture, migration approach for each workstream, risk register. |
| Workstream breakdown | Named workstream for each major workload, with explicit scope boundaries, deliverables, and acceptance criteria. |
| Target architecture diagram | Visual representation of the post-migration state, including identity, network, data, and security layers. |
| Migration sequence and timeline | Phased plan with named milestones, dependencies, and cutover windows. |
| Roles and responsibilities (RACI) | Who does what on the partner side and the client side, named individuals where possible. |
| Acceptance criteria per workstream | Specific tests that must be passed before each workstream is considered complete and signed off. |
| Change request process | Written process with thresholds for what counts as a change, approval steps, and pricing. |
| Azure cost forecast | Projected monthly Azure spend at three, six, twelve, and twenty-four months with assumptions stated. |
| Risk and mitigation | Named risks, probability/impact assessment, and mitigation plans. |
| Cutover plan and rollback procedure | For each cutover, the procedure, the abort criteria, the rollback steps, and the on-call coverage. |
| Post-migration support and warranty | What support is included for what duration after each workstream completes. |
| Pricing breakdown | Line-by-line breakdown of fixed and T&M elements, with assumptions. |
| Payment milestones | What gets paid when, tied to acceptance criteria not calendar dates. |
The SOW should be 25 to 50 pages for a typical mid-complexity SME migration. Less than that, the partner has not done the thinking. More than 80 pages, the partner is hiding complexity in volume.
A Melbourne Example: 65-Person Engineering Consultancy in Hawthorn
A 65-person mechanical and electrical engineering consultancy in Hawthorn engaged us in late 2024 for what they thought would be a SharePoint migration and turned into a broader cloud migration including identity, file shares, and an on-premise project management database.
The discovery surfaced more complexity than expected. The file server held about 14TB of project files including CAD models, which needed careful handling for SharePoint sync behaviour. The Active Directory had 11 years of accumulated permissions, roles, and group nesting that needed cleaning before any migration could be clean. The project management database was a SQL Server application with custom integrations to Outlook and to their cost-tracking spreadsheets that no one had documented in seven years.
The decision early in discovery: refactor where it materially reduces ongoing cost, lift-and-shift only where refactoring offered no value. SQL Server moved to Azure SQL Database (single database, with elastic pool option for future growth) instead of a VM. File shares moved to SharePoint with a redesigned site structure mapped to project workstreams rather than the old folder hierarchy. Identity moved to Entra ID with hybrid join during a transitional period, then fully cloud-joined endpoints by month six.
Timeline: 14 weeks from discovery start to final cutover, plus a 12-week post-migration support window. Cost: $148,000 fixed for the standard workstreams plus $34,000 T&M for the SQL refactor, against an internal budget envelope of $200,000. Azure run cost: $1,640 per month at steady state, against a forecast of $1,800. They are now on per-user fixed monthly managed service with us, with 24/7 NOC monitoring out of Tecoma and same-business-day on-site coverage when something needs hands on gear.
The lift-and-shift counterfactual: a partner who had simply lifted the SQL Server to an Azure VM would have charged less for the project (maybe $115,000 total) but the Azure run cost would have been roughly $3,400 per month due to the VM sizing and the SQL Server licensing on Azure. Over five years, the lift-and-shift would have cost the firm about $105,000 more in Azure spend, plus the future optimisation work to fix it. The architectural decision during the migration saved more than the migration cost over the asset lifetime.
Where TechAssist Sits in the Partner Landscape
We are honest about our positioning. We are not a Big Four consulting firm and we do not bid on $5m enterprise transformations. We are not a one-person operation working from a home office. We are a mid-market Melbourne MSP with 13 Australian engineers and the scale to handle SME migrations end-to-end while still being a partner you can call and get the principal engineer on the phone.
Our sweet spot is 30 to 250 staff Melbourne SMEs, professional services and skilled industries, where the migration needs to be done properly the first time, on a budget that is real but not unconstrained, with a transition into a managed service relationship afterwards. Our per-user fixed monthly pricing on the run state means we are not incentivised to leave you with brittle infrastructure that creates ongoing ticket volume.
We are Essential Eight aligned and ISO 27001 capable, which matters for clients moving into regulated sectors or pursuing certifications. We sub-15-minute respond to P1 incidents and provide same-business-day on-site coverage across Melbourne metro from our Tecoma office and our 575 Bourke St CBD office.
If our positioning does not fit your situation, that is fine. The questions in this guide will still serve you well with another partner. If it does fit, we are happy to run a discovery conversation. See our MSP Melbourne overview for the broader service description, our co-managed IT support page if you have an internal IT lead, and our managed IT services Melbourne page for the full service breakdown.
For vertical-specific context, see our law firms, manufacturers, and healthcare pages. For the broader provider selection framework, our how to choose an MSP Melbourne and top managed service providers Melbourne articles cover the ground.
The Six Red Flags That Should End the Conversation
If you see any of these during the sales process, the conversation should end. We have seen each of these cause migration disasters, and the partner’s behaviour during the sales cycle is the best predictor of how they will behave during the project.
One. They quote without discovery. A partner who gives you a fixed price for a migration without spending real time understanding your environment is either selling you a project they cannot deliver, or has priced in so much risk that you are overpaying.
Two. They cannot name the engineers. The salesperson is great. The case studies are slick. The actual delivery team is a mystery. This is the pattern where you find out, after signing, that the engineers are junior offshore staff or contractors with no continuity.
Three. The Azure cost forecast is “we will optimise after migration.” This is the lift-and-shift trap signalled in advance. Walk away.
Four. The change request process is “we will handle it.” No written process, no thresholds, no commitment. This will turn into endless change orders during the build.
Five. They will not provide a Melbourne SME reference of comparable scale. Generic references and enterprise references are not useful. If they cannot point you to a comparable client in the last 18 months, they have not done the work at your level recently.
Six. They are uncomfortable when you ask about security uplift during the migration. The migration is the moment to fix conditional access, MFA, and application control. A partner who treats this as out of scope is missing the point of why most SMEs are migrating in the first place. Read our zero trust security model explained and cybersecurity services Melbourne resources for the security framing.
Frequently Asked Questions
How long does a typical SME cloud migration take?
For a 50-person business with a moderate-complexity stack (file server, on-prem AD, one or two LOB applications), the engagement runs 12 to 20 weeks from discovery to final cutover, plus 8 to 12 weeks of post-migration support. Smaller and simpler migrations can be done in 6 to 10 weeks. Larger and more complex migrations can run 6 to 9 months. Anyone promising a serious migration in 2 to 4 weeks is selling you a rushed project.
Can we keep our existing IT person and just engage a partner for the migration?
Yes, and this is a common pattern, but it requires clear scope boundaries. The partner runs the project, the internal IT person handles end-user support, change communication, and the on-the-ground coordination during cutover. Our co-managed IT support model is built for exactly this arrangement. The pattern that does not work is the internal person trying to “help” with the technical migration work in parallel, which creates accountability gaps.
What does an Azure bill for a 50-person SME look like at steady state?
Depends entirely on the architecture and what workloads you have moved. For a 50-person business that has migrated file shares to SharePoint, identity to Entra ID, and one moderate SQL workload to Azure SQL, the Azure-side bill is typically $800 to $2,200 per month at steady state. The Microsoft 365 licensing is separate and runs $30 to $50 per user per month depending on tier.
Is hybrid cloud (some workloads on-prem, some in Azure) still a sensible choice?
For some workloads, yes. Specifically: industrial control systems, very large file shares where bandwidth economics matter (some video production and CAD scenarios), and certain LOB applications with vendor support constraints. For most SME workloads, hybrid is a transitional state, not a destination. Plan to be fully in the cloud within three years of starting the migration, or you will end up paying for the worst of both worlds.
What about Microsoft 365 Copilot during the migration?
Deploy after the migration, not during. The Copilot value comes from clean SharePoint structure, properly permissioned document libraries, and a tenant that has been hardened. Trying to roll out Copilot before the migration is finished produces poor user experience because Copilot is searching across the messy interim state.
How do we make sure we are not locked into the partner after the migration?
This is the right question to ask before signing. The protections are documentation (you should own all architecture documentation, including admin credentials and root-of-trust certificates), portable architecture (avoid partner-specific tooling for the run state), and a clean handover process. Our run-state pricing is per-user fixed monthly with no lock-in clause, and the architecture we deploy is standard Microsoft and Azure constructs that any competent partner can take over if you ever decide to move. Reach our team via the contact page for a discovery conversation.