CLCloudGuide
Azure Hybrid Cloud Architecture for Organizations with On-Premises Systems
Most organizations adopting Azure keep some systems on-premises for years. A hybrid architecture connects identity, networking, management and security across both, so the estate behaves as one environment rather than two.
- Published
- Updated
- Reading
- 4 minutes
- Prepared by
- EngineSpire Technologies
Key points
- Hybrid is normal. Legacy applications, latency, licensing and data obligations keep some workloads on-premises.
- Identity is the first integration: synchronize Active Directory with Microsoft Entra ID and enforce MFA through Conditional Access.
- A hub-and-spoke network with non-overlapping address space keeps connectivity manageable as subscriptions grow.
- Azure Arc brings on-premises servers under the same policy, monitoring and update management as Azure resources.
- Plan for the link to Azure failing, and decide what must keep working locally when it does.
Why hybrid, and for how long
Few organizations move everything to the cloud at once. Manufacturing systems need local response times, some applications cannot run on modern platforms, licences may be tied to hardware, and branch offices still need local services. Decide for each workload whether hybrid is a transition or a permanent state. That decision determines how much to invest in integration.
Start from an Azure landing zone
Microsoft's Cloud Adoption Framework defines Azure landing zones: a management group hierarchy, platform subscriptions for identity, management and connectivity, application landing zones for workloads, Azure Policy for guardrails and role-based access control. Use the landing zone accelerator or build to the same design areas, but do not skip them. Hybrid problems are much harder to solve on top of an unplanned subscription.
Identity: one set of credentials
- Synchronize on-premises Active Directory users to Microsoft Entra ID with Entra Connect Sync or Entra Cloud Sync.
- Choose the sign-in method. Password hash synchronization is the simplest and keeps cloud sign-in working if on-premises servers are down. Pass-through authentication and federation keep authentication on-premises but add infrastructure to keep available.
- Enforce MFA with Conditional Access, and require stronger methods for administrators.
- Treat the synchronization server and domain controllers as the most sensitive systems you have. Compromising them compromises everything.
- For applications that need Kerberos or LDAP in Azure, extend domain controllers into Azure or use Microsoft Entra Domain Services.
Network connectivity
| Option | Characteristics | Typical use |
|---|---|---|
| Site-to-site VPN | Encrypted tunnels over the internet; quick to set up; performance varies with the internet path | First phase, smaller sites, backup path |
| ExpressRoute | Private connection through a connectivity provider; more consistent performance; a service level agreement | Production hybrid workloads with steady, significant traffic |
| ExpressRoute with VPN failover | Private primary path with an internet-based backup | Workloads that must survive a provider outage |
- Use a hub-and-spoke topology or Azure Virtual WAN, with shared services and inspection in the hub.
- Plan address space that does not overlap with offices, branches and partners.
- Decide where traffic is inspected: Azure Firewall or a third-party appliance in the hub.
- Resolve names across both environments with Azure DNS Private Resolver and conditional forwarding.
- Use private endpoints so platform services are reachable only from your networks.
Managing on-premises servers with Azure Arc
Azure Arc projects on-premises and other-cloud servers into Azure Resource Manager. Once connected, they can be inventoried, tagged and governed with Azure Policy, monitored with Azure Monitor, patched with Azure Update Manager and protected with Microsoft Defender for Cloud. Arc also extends to Kubernetes clusters and SQL Server instances.
Connecting servers to Arc has no charge by itself, but several services you use through it are billed. Price the features you plan to use before rolling out broadly.
Security operations across both environments
- Use one security posture view for Azure and Arc-connected servers, such as Microsoft Defender for Cloud.
- Collect logs from both environments into one SIEM, whether Microsoft Sentinel or another platform.
- Apply the same hardening baselines on-premises and in Azure.
- Filter traffic between on-premises networks and Azure with firewall rules instead of flat routing.
- Give administrators separate privileged accounts, ideally used from dedicated admin workstations.
Backup and disaster recovery
- Protect Azure virtual machines with Azure Backup, and on-premises servers with the Azure Backup agent or your existing backup platform.
- Use Azure Site Recovery to replicate on-premises virtual machines to Azure as a recovery site.
- Enable immutability for backup vaults that hold critical data.
- Document what recovered systems depend on, especially identity, DNS and network routes, and test failover.
Design for the link failing
If sign-in, file access or line-of-business applications depend on Azure, an internet or ExpressRoute outage stops the office. Decide deliberately what must keep working locally. Common measures include a local domain controller, cached credentials, redundant connections from diverse providers, local internet breakout and written offline procedures for critical processes.
A phased roadmap
- Hybrid identity and MFA.
- Landing zone, hub network and connectivity.
- Azure Arc for visibility, policy and patching of existing servers.
- Migration of low-risk workloads.
- Disaster recovery to Azure for systems that stay on-premises.
- Modernization of applications where it pays off.
Common questions
Do we need ExpressRoute?
Not always. Many organizations start with site-to-site VPN and add ExpressRoute when traffic volume, performance consistency or compliance requirements justify its cost. Keep a VPN as a backup path either way.
Can we keep Active Directory if we use Azure?
Yes. Most hybrid organizations keep Active Directory for on-premises applications and devices while synchronizing identities to Microsoft Entra ID for cloud services. Dependence on Active Directory can shrink over time as applications modernize.
What does Azure Arc cost?
Connecting servers to Azure Arc has no charge by itself. Services used through Arc, such as Defender for Servers and some monitoring and update management features, are billed. Check current pricing for the features you plan to use.
Sources and further reading
- [1]Azure landing zones — Microsoft Learn
- [2]Hub-spoke network topology in Azure — Microsoft Learn
- [3]Azure Arc overview — Microsoft Learn
- [4]What is hybrid identity with Microsoft Entra ID? — Microsoft Learn
Need this applied to your environment?
We can turn this guide into a scoped assessment of your own sites, systems and constraints.
Keep reading
- CLAWS Landing Zone Checklist for Growing Philippine CompaniesA landing zone is the governed starting point for everything you run in AWS: accounts, identity, logging, networking and guardrails. This checklist covers the decisions to make before the first production workload moves.6 min read
- CLGoogle Cloud Migration Planning: A Practical Readiness GuideBefore moving workloads to Google Cloud, find out what you run, decide how each workload should move and build the foundation for identity, networking, security and cost control. This guide walks through the readiness work.4 min read
- CLPrivate Cloud vs Public Cloud: How to Make a Defensible ChoiceThe right platform depends on each workload's demand pattern, performance needs, data obligations, cost and your team's ability to run it. This guide gives a structured way to compare private and public cloud and to document the decision.4 min read