|
| 1 | +--- |
| 2 | +title: 'Phase 2: Classify apps and plan pilot' |
| 3 | +description: This article describes phase 2 of planning migration of applications from AD FS to Azure Active Directory |
| 4 | +services: active-directory |
| 5 | +author: omondiatieno |
| 6 | +manager: CelesteDG |
| 7 | +ms.service: active-directory |
| 8 | +ms.subservice: app-mgmt |
| 9 | +ms.topic: how-to |
| 10 | +ms.workload: identity |
| 11 | +ms.date: 05/30/2023 |
| 12 | +ms.author: jomondi |
| 13 | +ms.reviewer: gasinh |
| 14 | +ms.collection: M365-identity-device-management |
| 15 | +--- |
| 16 | + |
| 17 | +# Phase 2: Classify apps and plan pilot |
| 18 | + |
| 19 | +Classifying the migration of your apps is an important exercise. Not every app needs to be migrated and transitioned at the same time. Once you've collected information about each of the apps, you can rationalize which apps should be migrated first and which may take added time. |
| 20 | + |
| 21 | +## Classify in-scope apps |
| 22 | + |
| 23 | +One way to think about this is along the axes of business criticality, usage, and lifespan, each of which is dependent on multiple factors. |
| 24 | + |
| 25 | +### Business criticality |
| 26 | + |
| 27 | +Business criticality takes on different dimensions for each business, but the two measures that you should consider are **features and functionality** and **user profiles**. Assign apps with unique functionality a higher point value than those with redundant or obsolete functionality. |
| 28 | + |
| 29 | + |
| 30 | + |
| 31 | +### Usage |
| 32 | + |
| 33 | +Applications with **high usage numbers** should receive a higher value than apps with low usage. Assign a higher value to apps with external, executive, or security team users. For each app in your migration portfolio, complete these assessments. |
| 34 | + |
| 35 | + |
| 36 | + |
| 37 | +Once you've determined values for business criticality and usage, you can then determine the **application lifespan**, and create a matrix of priority. The diagram shows the matrix. |
| 38 | + |
| 39 | + |
| 40 | + |
| 41 | +> [!VIDEO https://www.youtube.com/embed/PxLIacDpHh4] |
| 42 | +
|
| 43 | +## Prioritize apps for migration |
| 44 | + |
| 45 | +You can choose to begin the app migration with either the lowest priority apps or the highest priority apps based on your organization’s needs. |
| 46 | + |
| 47 | +In a scenario where you may not have experience using Azure AD and Identity services, consider moving your **lowest priority apps** to Azure AD first. This minimizes your business impact, and you can build momentum. Once you've successfully moved these apps and have gained the stakeholder’s confidence, you can continue to migrate the other apps. |
| 48 | + |
| 49 | +If there's no clear priority, you should consider moving the apps that are in the [Azure AD Gallery](https://azuremarketplace.microsoft.com/marketplace/apps/category/azure-active-directory-apps) first and support multiple identity providers because they're easier to integrate. It's likely that these apps are the **highest-priority apps** in your organization. To help integrate your SaaS applications with Azure AD, we have developed a collection of [tutorials](../saas-apps/tutorial-list.md) that walk you through configuration. |
| 50 | + |
| 51 | +When you have a deadline to migrate the apps, these highest priority apps bucket takes the major workload. You can eventually select the lower priority apps as they won't change the cost even though you've moved the deadline. |
| 52 | + |
| 53 | +In addition to this classification and depending on the urgency of your migration, you should publish a **migration schedule** within which app owners must engage to have their apps migrated. At the end of this process, you should have a list of all applications in prioritized buckets for migration. |
| 54 | + |
| 55 | +## Document your apps |
| 56 | + |
| 57 | +First, start by gathering key details about your applications. The [Application Discovery Worksheet](https://download.microsoft.com/download/2/8/3/283F995C-5169-43A0-B81D-B0ED539FB3DD/Application%20Discovery%20worksheet.xlsx) helps you to make your migration decisions quickly and get a recommendation out to your business group in no time at all. |
| 58 | + |
| 59 | +Information that is important to making your migration decision includes: |
| 60 | + |
| 61 | +- **App name** – what is this app known as to the business? |
| 62 | +- **App type** – is it a third-party SaaS app? A custom line-of-business web app? An API? |
| 63 | +- **Business criticality** – is its high criticality? Low? Or somewhere in between? |
| 64 | +- **User access volume** – does everyone access this app or just a few people? |
| 65 | +- **User access type**: who needs to access the application – Employees, business partners, or customers or perhaps all? |
| 66 | +- **Planned lifespan** – how long will this app be around? Less than six months? More than two years? |
| 67 | +- **Current identity provider** – what is the primary IdP for this app? AD FS, Active Directory, or Ping Federate? |
| 68 | +- **Security requirements** - does the application require MFA or that users be on the corporate network to access the application? |
| 69 | +- **Method of authentication** – does the app authenticate using open standards? |
| 70 | +- **Whether you plan to update the app code** – is the app under planned or active development? |
| 71 | +- **Whether you plan to keep the app on-premises** – do you want to keep the app in your datacenter long term? |
| 72 | +- **Whether the app depends on other apps or APIs** – does the app currently call into other apps or APIs? |
| 73 | +- **Whether the app is in the Azure AD gallery** – is the app currently already integrated with the [Azure AD Gallery](https://azuremarketplace.microsoft.com/marketplace/apps/category/azure-active-directory-apps)? |
| 74 | + |
| 75 | +Other data that helps you later, but that you don't need to make an immediate migration decision includes: |
| 76 | + |
| 77 | +- **App URL** – where do users go to access the app? |
| 78 | +- **Application Logo**: If migrating an application to Azure AD that isn’t in the Azure AD app gallery, it's recommended you provide a descriptive logo |
| 79 | +- **App description** – what is a brief description of what the app does? |
| 80 | +- **App owner** – who in the business is the main POC for the app? |
| 81 | +- **General comments or notes** – any other general information about the app or business ownership |
| 82 | + |
| 83 | +Once you've classified your application and documented the details, then be sure to gain business owner buy-in to your planned migration strategy. |
| 84 | + |
| 85 | +## Application users |
| 86 | + |
| 87 | +There are two main categories of users of your apps and resources that Azure AD supports: |
| 88 | + |
| 89 | +- **Internal:** Employees, contractors, and vendors that have accounts within your identity provider. This might need further pivots with different rules for managers or leadership versus other employees. |
| 90 | + |
| 91 | +- **External:** Vendors, suppliers, distributors, or other business partners that interact with your organization in the regular course of business with [Azure AD B2B collaboration.](../external-identities/what-is-b2b.md) |
| 92 | + |
| 93 | +You can define groups for these users and populate these groups in diverse ways. You may choose that an administrator must manually add members into a group, or you can enable self-service group membership. Rules can be established that automatically add members into groups based on the specified criteria using [dynamic groups](../enterprise-users/groups-dynamic-membership.md). |
| 94 | + |
| 95 | +External users may also refer to customers. [Azure AD B2C](../../active-directory-b2c/overview.md), a separate product supports customer authentication. However, it is outside the scope of this paper. |
| 96 | + |
| 97 | +## Plan a pilot |
| 98 | + |
| 99 | +The app(s) you select for the pilot should represent the key identity and security requirements of your organization, and you must have clear buy-in from the application owners. Pilots typically run in a separate test environment. |
| 100 | + |
| 101 | +Don’t forget about your external partners. Make sure that they participate in migration schedules and testing. Finally, ensure they have a way to access your helpdesk if there were breaking issues. |
| 102 | + |
| 103 | +## Plan for limitations |
| 104 | + |
| 105 | +While some apps are easy to migrate, others may take longer due to multiple servers or instances. For example, SharePoint migration may take longer due to custom sign-in pages. |
| 106 | + |
| 107 | +Many SaaS app vendors may not provide a self-service means to reconfigure the application and may charge for changing the SSO connection. Check with them and plan for this. |
| 108 | + |
| 109 | +## App owner sign-off |
| 110 | + |
| 111 | +Business critical and universally used applications may need a group of pilot users to test the app in the pilot stage. Once you've tested an app in the preproduction or pilot environment, ensure that app business owners sign off on performance prior to the migration of the app and all users to production use of Azure AD for authentication. |
| 112 | + |
| 113 | +## Plan the security posture |
| 114 | + |
| 115 | +Before you initiate the migration process, take time to fully consider the security posture you wish to develop for your corporate identity system. This is based on gathering these valuable sets of information: **Identities, devices, and locations that are accessing your applications and data.** |
| 116 | + |
| 117 | +### Identities and data |
| 118 | + |
| 119 | +Most organizations have specific requirements about identities and data protection that vary by industry segment and by job functions within organizations. Refer to [identity and device access configurations](/microsoft-365/enterprise/microsoft-365-policies-configurations) for our recommendations including a prescribed set of [conditional access policies](../conditional-access/overview.md) and related capabilities. |
| 120 | + |
| 121 | +You can use this information to protect access to all services integrated with Azure AD. These recommendations are aligned with Microsoft Secure Score and the [identity score in Azure AD](../fundamentals/identity-secure-score.md). The score helps you to: |
| 122 | + |
| 123 | +- Objectively measure your identity security posture |
| 124 | +- Plan identity security improvements |
| 125 | +- Review the success of your improvements |
| 126 | + |
| 127 | +This also helps you implement the [five steps to securing your identity infrastructure](../../security/fundamentals/steps-secure-identity.md). Use the guidance as a starting point for your organization and adjust the policies to meet your organization's specific requirements. |
| 128 | + |
| 129 | +### Device/location used to access data |
| 130 | + |
| 131 | +The device and location that a user uses to access an app are also important. Devices physically connected to your corporate network are more secure. Connections from outside the network over VPN may need scrutiny. |
| 132 | + |
| 133 | + |
| 134 | + |
| 135 | +With these aspects of resource, user, and device in mind, you may choose to use [Azure AD Conditional Access](../conditional-access/overview.md) capabilities. Conditional access goes beyond user permissions: it's based on a combination of factors, such as the identity of a user or group, the network that the user is connected to, the device and application they're using, and the type of data they're trying to access. The access granted to the user adapts to this broader set of conditions. |
| 136 | + |
| 137 | +## Exit criteria |
| 138 | + |
| 139 | +You're successful in this phase when you have: |
| 140 | + |
| 141 | +- Fully documented the apps you intend to migrate |
| 142 | + |
| 143 | +- Prioritized apps based on business criticality, usage volume, and lifespan |
| 144 | + |
| 145 | +- Selected apps that represent your requirements for a pilot |
| 146 | + |
| 147 | +- Business-owner buy-in to your prioritization and strategy |
| 148 | + |
| 149 | +- Understanding of your security posture needs and how to implement them |
| 150 | + |
| 151 | +## Next steps |
| 152 | + |
| 153 | +- [Phase 3 - Plan migration and testing](migrate-adfs-plan-migration-test.md) |
0 commit comments