Project 01: Datacenter Exit & Identity Transformation

The mission: exit a physical datacenter completely, retire on-prem Active Directory, and land every workload and identity in a cloud-native model. Outcome: 20% opex reduction, 27 apps consolidated under SSO, zero business interruption.

#Target Architecture

#Phase 1 — Inventory Everything That Authenticates

Nothing moves until you know what talks to AD. Export every app, service account, and LDAP bind:

1
2
3
4
5
6
7
8
9

# Every service principal + last logon — the honest app inventory
Get-ADUser -Filter {servicePrincipalName -like "*"} -Properties servicePrincipalName, lastLogonTimestamp |
  Select-Object Name, @{n="SPNs";e={$_.servicePrincipalName -join ";"}},
    @{n="LastLogon";e={[DateTime]::FromFileTime($_.lastLogonTimestamp)}} |
  Export-Csv ad-service-inventory.csv -NoTypeInformation

# LDAP binds hitting the DCs (enable 2889 auditing first)
Get-WinEvent -LogName "Directory Service" -FilterXPath "*[System[EventID=2889]]" -MaxEvents 5000 |
  Select-Object TimeCreated, Message | Export-Csv ldap-binders.csv -NoTypeInformation

#Phase 2 — Stand Up the Identity Plane First

Identity moves before workloads. Okta becomes the sole IDP, federated with Entra ID for the Microsoft estate:

1. Deploy Okta org → configure Entra ID federation (Okta as IDP, Microsoft 365 as SP).
2. Onboard apps in waves of 5, SAML/OIDC first, SWA last.
3. Enforce Conditional Access + MFA at the Okta policy layer, not per-app.

1
2
3
4
5
6
7
8
9

#!/usr/bin/env bash
# Gate: no wave ships until every app in it passes an auth smoke test
for app in $(cat wave-3.txt); do
  status=$(curl -s -o /dev/null -w "%{http_code}" \
    "https://corp.okta.com/api/v1/apps?q=${app}" \
    -H "Authorization: SSWS ${OKTA_TOKEN}")
  [ "$status" = "200" ] || { echo "FAIL: ${app}"; exit 1; }
done
echo "WAVE CLEAR"

#Phase 3 — Workload Waves Behind a Health Gate

Every workload follows the same state machine:

DRAIN → SYNC_FINAL → FLIP → OBSERVE(15m) → COMMIT | ROLLBACK

The OBSERVE gate compares error rate, p99, saturation, and a business KPI against the same weekday one week prior. Breach → automatic rollback, no meeting required.

#Phase 4 — Decommission and Prove the Savings

Power down is not done. Done is: contracts terminated, circuits cancelled, hardware disposed with certificates, and the −20% opex visible in the GL. Track it like a burn-down: