Written by Mike Pearlstein, CISSP, CEO of Fusion Computing Limited. Helping Canadian businesses build and manage secure IT infrastructure since 2012 across Toronto, Hamilton, and Metro Vancouver.
I have run cloud migrations for Canadian SMBs since 2012, and the ones that go wrong rarely fail for technical reasons. They fail because a decision that looked small in week two, a region, a licensing choice, a group membership, turned out to be structural by month six. The ten problems below are the ones I see most, and every one of them is knowable before you cut over.
KEY TAKEAWAYS
- Statistics Canada measured cloud computing at 48 percent of Canadian businesses in 2023, the most-used technology in its survey, so migration is now a mainstream SMB project.
- Egress, parallel running, support-tier uplift, training and refactor labour are the five costs most SMB estimates leave out.
- Azure Canada East in Quebec City carries no availability zones, so a residency-driven region choice can quietly cost you zone redundancy.
- Conditional Access needs Microsoft Entra ID P1 or Microsoft 365 Business Premium, which makes licence tier part of the identity design.
- A six-step sequence (Discover, Assess, Plan, Pilot, Migrate, Optimize) turns a one-shot cutover into a program with defined abort points.
What does cloud migration actually involve for a Canadian SMB?
According to Statistics Canada (2024), cloud computing was the most commonly used business technology among Canadian firms in 2023, at 48 percent, up 3 percentage points from 2021. Companies in the information and cultural sector led at 81 percent. Migration has become an ordinary SMB project, and its failure modes are now well documented.
A migration moves production workloads, plus the data and identity behind them, off owned servers into a public cloud. That usually means Microsoft Azure (Canada Central or Canada East), AWS, or Google Cloud. For a 25 to 150 employee business it is a sequence rather than one event: identity first, then file and email, then line-of-business apps, then remaining server workloads, and finally the recovery copy.
The sequencing question comes before the platform question. If you are still deciding which delivery model each workload belongs in, the difference between SaaS and cloud computing is the cleaner place to start. A workload that belongs in Microsoft 365 should never enter an Azure rehost queue at all.
Planning a move off on-premises servers this year? Talk to our team about a staged cutover plan.
The 10 challenges most Canadian SMBs hit
According to Statistics Canada (2024), about 1 in 6 Canadian businesses were impacted by a cyber security incident in 2023. National recovery spending doubled to CA$1.2 billion, from roughly CA$600 million in 2021. A migration window widens that exposure, because old controls come down before new ones are proven.
Each row below pairs the symptom an owner actually notices with the mitigation that resolves it before it becomes a fire. Only 1 of the 10 is a genuine engineering problem. The other 9 are decisions someone made, or failed to make, early.
| Challenge | Symptom | Mitigation |
|---|---|---|
| 1. No formal plan | Slipping dates, no rollback path | Phased plan with named owners and exit criteria per phase |
| 2. Cost overruns | Bill 30 to 60 percent above forecast | Full-scope cost model: egress, dual-run, support tier, refactor |
| 3. Data residency miss | Customer data lands outside Canada by default | Lock to Canada Central or Canada East; document processor list |
| 4. Identity gaps | Stale groups, weak MFA, broken conditional access | Microsoft Entra ID baseline before any workload moves |
| 5. Security cutover gap | Old controls off before new controls on | Defender for Cloud baseline live before workload cutover |
| 6. App incompatibility | Legacy app runs but is unstable on cloud VMs | Decide rehost, replatform, or refactor per app, not per portfolio |
| 7. Bandwidth bottleneck | Slow file open, VoIP jitter, VPN saturation | Office circuit upgrade plus SD-WAN or ExpressRoute |
| 8. No rollback plan | Cutover problem becomes a multi-day outage | Reversible cutover steps with defined abort points |
| 9. Skills gap | Internal team learns Azure on the production tenant | Training budget plus a Canadian partner for the first cutover |
| 10. No optimization phase | Bill never comes back down after migration | Right-size, reservations, and tag-based showback in month two. |
[ORIGINAL DATA] FC internal benchmark.
FC internal benchmark from Q2 2026, built on anonymized client data: across our 90+ Canadian SMB managed-IT engagements, we measured which problem surfaced first on migrations that had already stalled when we inherited them. Identity hygiene and undocumented application dependencies led the list. Our engineers found at least one of the two during Discover on most of those projects.
A senior Canadian engineer aims to reply within one business day, no obligation.
Cost overruns: why initial estimates are wrong
According to Microsoft (2026), Azure gives every customer the first 100 GB of outbound internet data transfer free each month. It then charges from USD $0.087 per GB across the next 10 TB in North America. Egress is metered, it scales with how chatty the new architecture is, and it almost never appears in a first estimate.
The five line items estimates leave out
Five line items produce most of the gap between forecast and invoice, and I price each of them separately.
- Data egress between regions and back to the office.
- The parallel-running period where on-premises and cloud both bill.
- Support-tier uplift from Basic to Standard.
- Training and certification for the internal team.
- Refactor labour for any app too brittle to rehost.
I build a 25 to 30 percent contingency on top of those five, and I price the parallel-running period explicitly rather than hoping it closes early. On the engagements I have inherited mid-flight, that period is the single line most often underestimated, usually by a factor of two.
The operating-model view matters as much as the project view. Our managed cloud services page sets out what a fixed monthly fee covers after cutover. That includes the Azure right-sizing work which brings a post-migration bill back down.
Want a full-scope cost model before you commit a budget? Book a consultation.
Data residency: PIPEDA, Quebec Law 25, and what regulators require
According to the Office of the Privacy Commissioner of Canada (2009), PIPEDA permits an organization to transfer personal information to another jurisdiction for processing. Contracts must give that data comparable protection, and individuals must be told at collection that it may leave Canada.
So PIPEDA sets a contractual and transparency bar rather than a storage-location mandate. Quebec Law 25 is stricter: a privacy impact assessment is required before personal information is communicated outside Quebec. Ontario health clients add PHIPA obligations on top. Treating any of this as paperwork after cutover is what forces contract renegotiations later.
[REGULATOR QUOTE] OPC on processing outside Canada.
Under PIPEDA the OPC is explicit that a contract cannot override foreign law. Organizations must also tell individuals that their records may be reached by foreign courts, law enforcement and national security authorities. That disclosure obligation is the part I see missing from SMB privacy notices most often.
Canada Central or Canada East
Region choice carries a technical cost that residency conversations usually skip. Per Microsoft (2026), Canada Central in Toronto supports availability zones. Canada East in Quebec City does not, and the two are paired. Picking Canada East for provincial optics can therefore trade away in-region zone redundancy.
Microsoft’s Advanced Data Residency (2026) add-on lists Canada as a Local Region Geography and is available on Business Basic, Standard, and Premium. Two conditions matter for SMBs: you must cover 100 percent of eligible paid seats, and Microsoft targets completion of the tenant move within 12 months of opt-in.
For clinics and firms sending health information outside Canada, we go deeper on the statutory analysis in cross-border PHI, the CLOUD Act, and Law 25.
Identity and access: the unspoken hard part
According to Microsoft (2026), Conditional Access requires a Microsoft Entra ID P1 licence, and Microsoft 365 Business Premium customers can use it as well. Risk-based sign-in policies need Entra ID P2. Licence tier therefore decides which identity controls you are able to enforce on cutover day.
Most post-migration incidents start in identity rather than in the workloads. Three patterns recur: Active Directory groups carrying a decade of accumulated membership, MFA exemptions written for service accounts and never revisited, and conditional access policies copied from a template built for a different tenant.
The pre-migration identity baseline
The baseline I insist on before any workload moves is short, and I will not start a wave without it.
- A clean Entra ID group structure with dormant membership removed.
- MFA on every human account, with no standing service-account exemption.
- Conditional Access tied to Intune device compliance.
- Privileged Identity Management on admin roles.
- One documented break-glass account stored offline.
That work is unglamorous, it takes my team about a week on a 50-seat tenant, and it removes most of the post-cutover risk.
The Canadian Centre for Cyber Security (2024) assesses that state-sponsored actors are persistently developing capabilities against the three major commercial cloud providers. Concentration risk is real, and for an SMB the practical answer is identity hygiene plus tested recovery, not provider avoidance.
“The assessment found an admin account with domain-level rights that had been inactive for four years but was still open. One phishing email away from a full breach. We never would have caught that on our own.”
Application compatibility and refactoring: how to choose, and the criteria that matter
According to the Canadian Centre for Cyber Security (ITSM.50.062), a cloud consumer stays accountable for hosted data. The split of duties then shifts with each service model, which is what makes rehost, replatform, and repurchase three different security decisions.
The framework is the six R’s: Rehost, Replatform, Repurchase, Refactor, Retain, Retire. A typical Canadian SMB portfolio lands near 40 percent rehost, 25 percent replatform, 15 percent repurchase to a SaaS equivalent, 10 percent refactor, with the balance retained or retired for the moment.
Treating the whole portfolio as rehost is the expensive default. Rehosted legacy apps run, then consume more compute than modelled, depend on file shares that perform poorly over a wide-area link, and resist scaling. A short replatform pass onto managed database and managed identity usually pays back inside the first 12 months of Azure bills.
Under ITSM.50.062, moving an app to SaaS hands the provider everything below the data and access layer. That is a real reduction in your patching burden and a real increase in your dependency on one vendor’s controls, which is why repurchase decisions belong in the same review as security decisions.
Network and bandwidth: what changes
According to the AWS Well-Architected Framework (2024), the model exists to help teams design and operate reliable, secure, efficient and sustainable workloads. AWS publishes a free review tool against it. Performance and cost share one model because in cloud the network is metered.
What breaks first on the network
3 changes catch teams off guard. Office bandwidth becomes the new bottleneck the day file servers leave the building. VPN concentrators stop being the right access design for cloud-resident apps. East-west traffic between workloads turns into a visible line on the Azure invoice.
Most Canadian SMBs land on an upgraded office circuit, SD-WAN or Azure ExpressRoute for predictable performance into the region, and split-tunnel access so Microsoft 365 and Teams traffic stops doubling back through the corporate firewall. Fusion Computing deploys that combination by default for new cloud clients.
Recovery design changes at the same time. A cloud-resident estate needs its own tested restore path for Microsoft 365 and Azure, which we cover in disaster recovery best practices. A cutover weekend is the most common moment for that path to quietly break.
Not sure whether your circuit can carry a cloud cutover? Get in touch for a bandwidth review.
The 6-step cloud migration playbook (Discover → Assess → Plan → Pilot → Migrate → Optimize)
According to Microsoft (2026), the Cloud Adoption Framework now organizes Azure guidance into seven methodologies. Strategy, Plan, Ready and Adopt run in sequence. Govern, Secure and Manage run in parallel once workloads are live. Older write-ups describing a five-phase model are out of date.
The six-step playbook below is what Fusion Computing runs on Canadian SMB migrations. It maps onto the Microsoft methodologies while staying sized for a 25 to 150 employee business rather than an enterprise programme office.
| Step | Goal | Typical duration |
|---|---|---|
| 1. Discover | Inventory every workload, dependency, and identity | 2 to 4 weeks |
| 2. Assess | Apply the six R’s; cost-model each workload | 2 to 3 weeks |
| 3. Plan | Wave plan, rollback steps, residency lock, identity baseline | 2 weeks |
| 4. Pilot | Move one low-risk workload end-to-end; validate | 2 to 4 weeks |
| 5. Migrate | Execute waves with a defined cutover window per wave | 3 to 9 months |
| 6. Optimize | Right-size, buy reservations, tag for showback, harden security | Ongoing from month 2 post-cutover. |
Toronto businesses running a first migration usually want a local team on the cutover weekend and an internal team that learns the platform on a pilot wave. Our Toronto cloud services page covers how that split works in practice, including the quarterly optimization review.
Mike Pearlstein, CISSP, reviews every cloud migration scope personally.
FAQ
How long does a cloud migration take for a 50-person Canadian SMB?
For a 50-person business, a complete migration usually runs four to nine months end to end. Budget roughly four to seven weeks for Discover and Assess, two weeks for Plan, then waves spaced across the rest of the year. Optimize starts in month two after the first cutover and then continues indefinitely as a quarterly review.
What are the most common cloud migration challenges?
Cost overruns, data residency oversights, weak identity baselines, application incompatibility, and missing rollback plans account for the majority of stalled migrations. Each of the 5 is preventable with a written plan and a pilot wave that proves the runbook.
Does PIPEDA require Canadian data residency?
PIPEDA sets no Canadian-storage mandate. The Office of the Privacy Commissioner requires comparable protection by contract for personal information transferred to a third party, including a foreign cloud region, plus disclosure to individuals at collection. Most Canadian SMBs still choose Canadian regions to simplify the compliance argument and to satisfy customer contracts.
How does Quebec Law 25 change cloud decisions?
Law 25 requires a privacy impact assessment before personal information is communicated outside Quebec, plus disclosure of the transfer. For an SMB with Quebec customers or staff, the practical answer is to default to Canada Central or Canada East and document the processor chain in writing.
Which Azure region should a Canadian SMB choose?
Canada Central in Toronto supports availability zones and is the default for most workloads. Canada East in Quebec City has no availability zones and is paired with Canada Central, so choosing it for provincial reasons trades away in-region zone redundancy. Confirm every dependent service, including backups and logs, lands in the same region.
Should we lift-and-shift or refactor first?
Both, in proportion. A typical SMB portfolio rehosts about 40 percent, replatforms 25 percent onto managed database and managed identity, repurchases 15 percent to SaaS, and refactors 10 percent. The remainder is retained or retired. Treating the whole portfolio as rehost is the most expensive option over three years.
What does cloud migration cost a Canadian SMB?
Total project cost covers labour and tooling plus the parallel-running period. It typically lands at one to two times the first year of expected steady-state cloud spend. Add a 25 to 30 percent contingency on top of the original estimate, and price the parallel-running period explicitly rather than assuming it closes early.
What is the most common security mistake during migration?
Turning off existing controls before the new controls are live and verified. Microsoft Defender for Cloud baseline coverage should be running first. So should Conditional Access and centralised logging, tested before the first production workload moves.
Do we need a Canadian partner, or can we run this internally?
Most 25 to 150 employee Canadian businesses use a Canadian managed IT partner for the first wave and the cutover, then run optimization in-house with quarterly reviews. The internal team learns the platform on a non-production wave instead of during a high-stakes cutover.
Related Resources
Four service pages and one planning guide that pick up where this one stops.
- Managed IT Services for Canadian SMBs.
- Cybersecurity Services for cloud-resident workloads.
- Microsoft 365 Copilot rollout and licensing.
- Infrastructure Security for cloud and hybrid estates.
- IT Strategic Planning Process for the multi-year roadmap.
