Featured Case Study

Case study: replacing undocumented legacy systems with a governed Azure platform

Executive Summary

Revive moved a trust-and-advisory group off a set of undocumented legacy systems and onto Microsoft Azure in 90 days. A locally installed document management system was replaced with SharePoint Online and Azure Files. The email archive, which ran on an end-of-life version of Windows Server, moved to Azure SQL Managed Instance with Exchange Online Archiving. An in-house decoder that existed only as a compiled binary was reverse-engineered, documented and containerized. An OCR pipeline made more than 15 years of scanned PDFs searchable. Reporting that ran on static virtual machines was rebuilt on Azure Synapse, with Power BI Premium dashboards for trustees and finance staff. Backups are immutable and geo-replicated, and a ransomware exercise was run to prove recovery rather than assume it. Microsoft Purview classifies data and enforces retention and access policies. The decisive factor was not technical: a deliberate change-management approach brought skeptical staff with us, which is what allowed a 90-day timetable to hold.

The Challenge: Legacy as a Risk Multiplier

Five parts of the estate each carried risk:

• Document management: a locally installed application surrounded by ad-hoc scripts, with no version history and no audit trail.
• Email archive: running on an end-of-life Windows Server, no longer receiving security updates.
• Proprietary decoder: a binary one engineer understood, with no source code: a single point of knowledge failure.
• Scanned archive: 15 years of PDFs on aging file servers, with no full-text search.
• Reporting: built on static virtual machines, refreshed by hand, slow to change.

Together these compounded: an unsupported operating system is an open door, undocumented workarounds make every change risky, absent governance makes data-protection obligations impossible to evidence, and slow reporting delays decisions. The trustees recognized that the exposure grew with every month of deferral.

The Montshield Revive Approach

Five principles governed the work:

• Inventory first: catalog every system, rate its risk, and design the target state before moving anything.
• Move in stages: encrypted in transit, kept within agreed regions, with no planned downtime.
• Reduce what needs maintaining: containerize where it helps, and prefer managed services to servers.
• Prove resilience: restore from backup and rehearse a ransomware scenario, rather than documenting an intention.
• Build confidence: publish the governance model and cost forecast, and demonstrate each step before it is taken.

The sequence suited a risk-averse organization that nonetheless needed to move quickly.

Phase 1: Assessment and Early Resistance

The first 30 days produced a full inventory. Documentation was almost absent, and the decoder was understood by one person. Four groups raised objections:

• Operations: feared interruptions to service.
• Legal and compliance: data residency obligations.
• Finance: predictability of cloud cost.
• IT: skills and available capacity.

Each was addressed directly:

• Roadmap: a timeline with explicit rollback points at each stage.
• Cost model: projected Azure spend against the existing run cost.
• Encryption and region rules: TLS in transit, Azure Disk Encryption at rest, and region selection set to meet residency requirements.
• Immutable backups: Azure Backup with a retention lock, so copies cannot be deleted early.
• Workshops: non-critical data migrated in front of the teams concerned.

This moved the discussion from the risk of changing to the risk of not changing, and produced a cross-team working group with executive backing.

Phase 2: Document & Archive Modernization

The document system, email archive and scanned archive were handled next.

• SharePoint Online: the document system moved here, with role-based access and version history; large files linked to Azure Files.
• Email archive: the end-of-life server retired, mail moved to Azure SQL Managed Instance and Exchange Online Archiving for automatic retention.
• OCR pipeline: containerized Tesseract with Azure Functions; contracts also processed with Azure AI Document Intelligence for higher accuracy.
• Blob storage and search: 15 years of PDFs moved to Azure Blob Storage and indexed with Azure AI Search for full-text retrieval.

The result is one platform where a historic contract is found in seconds, metadata is applied automatically, and access is logged in one place.

Phase 3: Analytics Re-platformed

Reporting moved from virtual machines to managed analytics services:

• Azure Synapse: a serverless warehouse drawing on the new SQL store and the document archive.
• Power BI Premium: dashboards with row-level security, so trustees and finance staff see only their own view.

Old and new reports were run side by side and reconciled, which established that the new pipeline was correct before the old one was retired.

Phase 4: Resilience Proven: Ransomware Test & Immutable Backups

A ransomware exercise tested continuity:

• Simulation: a script attempted to encrypt part of Azure Files, which triggered backup alerts.
• Containment: affected services were stopped and the disaster-recovery runbook was followed.
• Restore: data was recovered from a second region within hours, from immutable backups.

The exercise demonstrated that the immutable copies could not be altered and that recovery worked in practice.

Phase 5: Governance with Microsoft Purview

Microsoft Purview added a governance layer across the platform:

• Classification: automatic labeling of personal and financial data using built-in and custom rules.
• Policy enforcement: encryption at rest, retention periods and access restrictions applied across Azure resources.
• Audit dashboards: who accessed what, and where policy was breached.

Evidence is now produced continuously rather than assembled before an audit.

Results and Impact

Delivered within the 90 days committed:

• The end-of-life Windows Server was retired, removing the largest single exposure.
• Moving from self-hosted SQL Server to Azure SQL reduced licensing cost by approximately 35%.
• Documents are in SharePoint Online with version history and controlled access.
• The email archive integrates with Exchange Online and applies retention automatically.
• Fifteen years of scanned documents are searchable; retrieval fell from hours to seconds.
• Dashboards replaced manual reports, with over 80% of intended users active within four weeks.
• Recovery was demonstrated by exercise, not assumed.
• Governance policies cover the migrated estate, with continuous reporting.

Staff who initially objected now rely on the platform, and the internal IT team spends its time on new work rather than maintaining systems nobody understood.

Lessons for C-Level Leaders

Five points worth carrying into a similar decision:

• Unsupported systems carry hidden risk. Undocumented workarounds are as dangerous as missing patches.
• Objections are answered with evidence. Roadmaps, cost models and demonstrations do more than assurances.
• Resilience has to be tested. A backup nobody has restored is an assumption.
• Governance has to be continuous. Controls applied once drift as data and people change.
• This is a board matter, not an IT project. The decisions are about risk, cost and obligation.

Conclusion

An organization carrying fragile, undocumented legacy systems moved to a governed cloud platform in 90 days without interrupting its work. The combination that made it possible was technical discipline and deliberate change management: unsupported systems retired, immutable backups in place, recovery proven by exercise, and governance applied continuously rather than before audits. The same sequence applies to most private offices in the same position.