66 enterprise moves, told as case studies.
Migrations, upgrades, cloud moves, consolidations and AI rollouts on identity, security, cloud, ERP, CRM, data and industry platforms. The client's name stays out. The rest stays in: the problem, what we did, the architecture before and after, the plan phase by phase, and what the client got out of it.
- 01Inventory and fit
- 02Identity model and sources
- 03Access model
- 04Parallel run
- 05Cut-over and decommission
Identity and access13 · area page →
On-premises Active Directory to cloud-first Microsoft Entra ID
We shrink on-premises Active Directory one application at a time, moving groups, users and app authentication to Microsoft Entra ID as each app is ready.
read the case studyAD FS federation to Entra ID authentication
Converting federated domains from AD FS to Entra ID cloud authentication, moving relying parties app by app and retiring the AD FS farm.
read the case studyAuth0 Rules and Hooks to Actions before end of life
Rewriting Auth0 Rules and Hooks as Actions before their 18 November 2026 end of life, with token claims compared before and after each change.
read the case study
ForgeRock AM/IDM to PingOne Advanced Identity Cloud
Moving self-managed ForgeRock AM and IDM, now called PingAM and PingIDM, to PingOne Advanced Identity Cloud without breaking sign-in or provisioning.
read the case studyHomegrown customer login to Auth0 or Okta Customer Identity
We swap homegrown customer login and its user table for Auth0, move users without forcing password resets, and keep the CRM records in sync.
read the case studyIdentity integration after a merger or carve-out
We give people access on day one after a merger or divestiture. Then directories, identity providers and governance get merged or separated, on a plan.
read the case studyIBM ISIM, Oracle OIM or homegrown provisioning to SailPoint or Saviynt
Getting off IBM ISIM, Oracle OIM or homegrown provisioning scripts and onto SailPoint or Saviynt, with provisioning, certifications and audit history intact.
read the case studyConsolidating Okta and Entra ID after years of running both
Picking one primary identity provider after years of running Okta and Microsoft Entra ID side by side, then moving apps, MFA and provisioning to it.
read the case studyOracle Access Manager and OIG to a modern identity provider and IGA
Replacing Oracle Access Manager and Oracle Identity Governance 12c with a cloud identity provider and SailPoint or Saviynt before support runs out.
read the case study
RSA SecurID tokens to passwordless MFA with passkeys
Retiring RSA SecurID tokens, hardware and software, in favour of phishing-resistant passkeys while VPN, RADIUS and server logons keep working.
read the case studyIdentityIQ 8.x to 9.0 upgrade
Upgrading SailPoint IdentityIQ 8.x to 9.0, with the route through 8.5, the iiq-precheck scan, javax to jakarta fixes and a tested rollback.
read the case studySailPoint IdentityIQ to Identity Security Cloud
Leaving IdentityIQ for SailPoint Identity Security Cloud (formerly IdentityNow) with custom logic, certifications and audit history carried across.
read the case studySAP Identity Management replacement with Entra ID or SailPoint
Replacing SAP Identity Management before its 2027 end of maintenance, with provisioning to SAP and non-SAP systems moved to Entra ID Governance or SailPoint.
read the case studyPrivileged access5 · area page →
Centrify and Delinea Server Suite zones to modern server identity
Untangling Centrify and Delinea Server Suite zones, UID maps and dzdo roles, and moving Linux and Windows servers to a server identity model you can run.
read the case studyCyberArk PAM Self-Hosted version upgrades
Upgrading CyberArk PAM Self-Hosted from 13.x or 14.x to the 15.2 Long-Term Support release, in the documented component order with DR tested first.
read the case studyCyberArk PAM Self-Hosted to Privilege Cloud (Idira PAM SaaS)
We move CyberArk PAM Self-Hosted vaults to Privilege Cloud, now sold as Idira Privileged Access Management. Rotation and sessions keep working.
read the case study
Secrets in code, pipelines and config files to HashiCorp Vault
We track down passwords, API keys and tokens in repositories, CI variables and config files and move them into HashiCorp Vault, with short-lived credentials.
read the case studyDelinea Secret Server on-premises to the Delinea Platform
Getting Secret Server off on-premises hosts and onto the Delinea Platform while templates, engines and integrations keep working.
read the case studySecurity operations5 · area page →
CMMC Level 2 and SOC 2 readiness
Engineering the identity, access, logging and evidence controls behind CMMC Level 2 and SOC 2, so assessments rest on system evidence rather than narrative.
read the case study
OT security baseline for plants and pipelines
Securing plants, substations and pipelines from a passive asset inventory up, with IEC 62443 zones and conduits and vendor access kept under control.
read the case studyService account, API key and non-human identity cleanup
Tracking down every service account, app registration, API key and AI agent, putting an owner on each and moving them to short-lived, federated credentials.
read the case study
SIEM migration from Splunk to Microsoft Sentinel
Moving detections, log sources, playbooks and retention from Splunk to Microsoft Sentinel in the Defender portal, with a parallel run before cut-over.
read the case studyVPN to zero trust network access
Retiring remote-access VPN one app at a time, and moving users to access that checks identity and device through Entra Private Access or your current ZTNA.
read the case studyCloud and infrastructure6 · area page →
Hand-built cloud to Terraform or OpenTofu
Bringing console-built AWS, Azure and Google Cloud resources under Terraform or OpenTofu with import blocks, clean state and pipelines, without rebuilding.
read the case studyCloud landing zone and account vending
AWS Control Tower with Account Factory for Terraform, or Azure landing zones on Azure Verified Modules, built as code with guardrails, logging and vending.
read the case studyData center exit to AWS or Azure
Leaving a colocation or owned data center for AWS or Azure in planned waves, with dependencies mapped, licences checked and every server given an owner.
read the case study
Kubernetes, EKS and OpenShift version upgrades
Keeping EKS, AKS and OpenShift clusters on supported Kubernetes minors, and dealing with deprecated APIs, add-ons and node pools before each upgrade.
read the case study
VMware exit after the Broadcom licensing changes
Planning a VMware exit now that Broadcom sells only VCF and VVF subscriptions, to OpenShift Virtualization, Azure VMware Solution or native cloud.
read the case study
Windows Server 2016 and SQL Server 2016 end of support
SQL Server 2016 left extended support in July 2026 and Windows Server 2016 follows in January 2027. We upgrade, migrate or buy ESUs, server by server.
read the case studyApplications4 · area page →
.NET Framework and .NET 8 to .NET 10
Both .NET 8 and .NET 9 hit end of support on 10 November 2026. Moving them, and older .NET Framework apps, to .NET 10 LTS one project at a time.
read the case studyLegacy web apps to containers on Kubernetes or OpenShift
Moving Java, .NET and PHP web apps off hand-patched VMs and into containers on Kubernetes or OpenShift, with config, secrets, sessions and logs sorted out.
read the case studyMainframe COBOL and CICS to APIs, then cloud in slices
Putting REST APIs in front of CICS and IMS transactions first, then moving bounded COBOL functions to cloud services one slice at a time with parallel runs.
read the case studyMobile apps for Android 16 KB pages, passkeys and store deadlines
We keep Android and iOS apps shippable as Google Play's target API and 16 KB page rules and Apple's SDK minimums change, and add passkey sign-in.
read the case studyERP and HCM4 · area page →
Dynamics AX 2012 to Dynamics 365 Finance & Operations
We take AX 2012 R2 or R3 systems to Dynamics 365 finance and operations apps, and the code, data, attachments and integrations come across with them.
read the case studyOracle E-Business Suite to Fusion Cloud ERP
Leaving Oracle E-Business Suite 12.2 for Fusion Cloud ERP, deciding which customizations survive and planning conversion, integrations and quarterly updates.
read the case studyPeopleSoft HCM to Workday
Moving PeopleSoft HCM to Workday with effective-dated history, payroll, integrations and the identity feed rebuilt and tested.
read the case studySAP ECC to S/4HANA before 2027
Getting from SAP ECC 6.0 to S/4HANA ahead of the 2027 end of mainstream maintenance, by conversion, new build or selective data transition.
read the case studyCRM, ITSM and automation5 · area page →
Dynamics CRM on-premises to Dynamics 365 online
We move Dynamics CRM or Customer Engagement 9.x off your servers and onto Dynamics 365 online, rebuilding customizations, reports, integrations and sign-in.
read the case study
Siebel or homegrown CRM to Salesforce or Dynamics 365
We replace Siebel or homegrown CRMs with Salesforce or Dynamics 365 and move business logic, data and integrations deliberately.
read the case studyMerging multiple Salesforce orgs
Consolidating the Salesforce orgs that acquisitions and regional builds left behind, with data models, users, automation and integrations merged into one.
read the case studySalesforce Workflow Rules and Process Builder to Flow
Moving Workflow Rules and Process Builder to Flow after end of support, consolidated per object and tested before the old rules are turned off.
read the case studyServiceNow family upgrades, CMDB health and CSDM
Upgrading ServiceNow to the Brazil family and fixing CMDB health against CSDM 5 at the same time, so upgrades get easier and AI features read good data.
read the case studyIndustry platforms10 · area page →
Nasdaq Calypso upgrade to V19
Upgrading Nasdaq Calypso to V19, with server consolidation, properties moved to the database, the WebUI and deployment changes tested on your own trades.
read the case study
Duck Creek on-premises to Duck Creek OnDemand
We move self-hosted Duck Creek Policy, Billing and Claims onto Duck Creek OnDemand and keep the product and rating content, integrations and data intact.
read the case studyEpic integrations, FHIR APIs and TEFCA connectivity
Building and governing the HL7 and FHIR integrations, SMART on FHIR apps and TEFCA exchange around Epic, with an interface catalog and scope reviews.
read the case study
TriZetto Facets upgrades and CMS-0057-F interoperability APIs
Keeping TriZetto Facets current while we build the Provider Access, Payer-to-Payer and Prior Authorization APIs that CMS-0057-F requires by January 2027.
read the case study
Guidewire InsuranceSuite self-managed to Guidewire Cloud
Moving self-managed PolicyCenter, BillingCenter and ClaimCenter to Guidewire Cloud without carrying every Gosu customization and integration along.
read the case study
Murex MX.3 upgrades and the move to MXSaaS
Planning the next Murex MX.3 upgrade, or a move to MXSaaS, with automated regression on trades, valuations and accounting and the datamart reports traced.
read the case studyOracle Utilities CC&B 2.x to the 25.x release line
Taking Oracle Utilities CC&B from 2.6, 2.7, 2.8 or 2.9 to 25.4 on a tested upgrade path, with custom algorithms checked and bill cycles compared.
read the case study
AVEVA PI data to cloud analytics on Databricks or Fabric
Getting AVEVA PI System data into Databricks or Microsoft Fabric with asset context, outbound-only paths out of the plant and tag names people understand.
read the case studySAP IS-U to S/4HANA Utilities
Taking SAP IS-U from ECC 6.0 to S/4HANA Utilities ahead of 2027, and proving billing variants, device data and FI-CA in parallel billing first.
read the case studyTemenos core banking upgrades and Temenos SaaS
Upgrading Temenos Transact (formerly T24), or moving to Temenos SaaS, with local developments traced, retired or rebuilt, and regression automated.
read the case studyData and analytics6 · area page →
Apache Airflow 2 to Airflow 3
Upgrading self-managed Apache Airflow 2, now past end of life, to Airflow 3, and fixing removed features, auth and scheduling changes before DAGs move.
read the case studyDatabricks Hive metastore to Unity Catalog
We move Databricks workspaces off the Hive metastore, DBFS mounts and table ACLs and onto Unity Catalog, ahead of new workspaces dropping legacy features.
read the case study
Informatica PowerCenter to IDMC or dbt
Moving PowerCenter mappings and workflows to Informatica IDMC Cloud Data Integration or to dbt on the warehouse, decided mapping by mapping.
read the case study
Power BI Premium P SKUs to Microsoft Fabric F SKUs
Moving Power BI Premium per-capacity P SKUs to Microsoft Fabric F SKUs before the agreement ends, sized from real load and reassigned in validated batches.
read the case study
Tableau to Power BI
Moving Tableau workbooks to Power BI semantic models, scoped by what people open, with row-level security and numbers that match before anyone switches.
read the case study
Teradata, Netezza or Hadoop to Snowflake
Moving a Teradata, Netezza or Hadoop warehouse to Snowflake, with converted code, reconciled data and a cost model that holds up after cut-over.
read the case studyAI and agents8 · area page →
AI pilot to production with forward deployed engineers
Taking an AI pilot into production with forward deployed engineers who work with the business team, build evals, connect real systems and hand over cleanly.
read the case studyMicrosoft 365 Copilot or Gemini Enterprise rollout with real adoption
Rolling out Microsoft 365 Copilot or Gemini Enterprise with oversharing fixed first, use cases tied to real tasks and adoption measured past login counts.
read the case studyEnterprise search and RAG that respects document permissions
Enterprise search and RAG that only return what each user may open. We capture source ACLs at ingestion, filter at query time and leak-test.
read the case studyMCP servers for SAP, Salesforce, ServiceNow and internal APIs
We connect AI agents to SAP, Salesforce, ServiceNow and internal APIs through MCP servers, with OAuth, scoped tools, approval for writes and audit.
read the case studyOpenAI Assistants API to the Responses API and the Agents SDK
Getting apps off the shut-down OpenAI Assistants API onto the Responses and Conversations APIs or the Agents SDK, with history kept and outputs re-tested.
read the case study
Classic RPA bots to agentic automation
Moving classic RPA bots to agentic automation in UiPath or Power Automate. APIs first, agents only where judgment is needed, and controls on both.
read the case studyIdentity, scopes and audit for AI agents and MCP servers
Giving AI agents their own identities, putting remote MCP servers behind OAuth with per-tool scopes, and logging which agent did what for whom.
read the case studyTurning on Agentforce, Now Assist, Joule and Copilot safely
Turning on vendor AI in Salesforce, ServiceNow, SAP and Dynamics 365, with permissions checked, an owner for each use case, agents tested and costs watched.
read the case studyDon't see your move here?
Send us the platform you're on and where you need to get to. If it's an enterprise system, we've probably done the hard part before.
- The platform and the version you're on
- Where you need to get to, and by when
- What's custom: rules, plugins, integrations
- Any audit finding or deadline driving it