Why Azure for Mainframe?
Azure has invested heavily in mainframe compatibility, offering specialized infrastructure like Azure NetApp Files for high-performance I/O and partnerships with vendors like Raincode and TmaxSoft.
Technical Deep Dive
1. The Compute Layer: Azure Kubernetes Service (AKS) vs VMs
While you can run emulators on Virtual Machines (VMs), the modern approach is to containerize the re-hosted or refactored application and run it on AKS.
- Benefit: Auto-scaling based on CPU/Memory load (handling end-o-month spikes).
- Challenge: Mainframe apps are often stateful. You need to externalize state to Redis or a database to make them cloud-native.
2. High Availability (HA) & Disaster Recovery (DR)
Mainframes use Parallel Sysplex for HA. In Azure, you achieve this using Availability Zones and Region Pairs.
Architecture Pattern:
- Active-Active: Run instances in East US and West US.
- Data Sync: Use Azure SQL Geo-Replication to keep data in sync (with some lag).
- Traffic: Use Azure Front Door to route traffic.
3. Integration: Logic Apps & Service Bus
Unlock legacy data by wrapping COBOL transactions in APIs.
- Use Azure Logic Apps to orchestrate workflows that trigger mainframe transactions.
- Use Azure Service Bus to decouple the high-speed mainframe from slower distributed systems.
Migration Approaches
1. Rehosting (Emulation)
Use Micro Focus Enterprise Server or TmaxSoft OpenFrame to run COBOL/JCL unmodified on Azure VMs.
Pros: Fast migration (6-12 months)
Cons: High ongoing licensing costs, no true modernization
2. Refactoring to .NET
Convert COBOL to C# using automated tools, deploy to Azure App Service.
Pros: True cloud-native, lower long-term cost
Cons: 2-3 year timeline, high risk
3. Hybrid (Strangler Fig)
Gradually extract services from mainframe, run hybrid with Azure Arc.
Pros: Lowest risk, incremental learning
Cons: Requires mainframe expertise for 5+ years
The Azure-Specific Gotcha
Azure SQL Managed Instance does not support all DB2 z/OS features. Expect significant schema redesign for:
- Triggers with SIGNAL/RESIGNAL
- Advanced partitioning strategies
- Temporal tables (AS OF queries)
Budget 30-40% more time for database migration vs. AWS RDS/Aurora.
How to Choose a Mainframe to Azure Migration Partner
If you want to keep COBOL/PL/I code as-is: Raincode. Their compilers allow you to run mainframe code natively on Azure without emulation overhead.
If you need a comprehensive managed service: Infosys. Their Cobalt platform provides end-to-end migration and ongoing managed services.
If you are in Healthcare or Finance (regulated): Cognizant. They specialize in compliance-heavy industries and have pre-built Azure landing zones for HIPAA/SOC2.
If you need fast replatforming: Astadia. They are the Azure “FastPath” partner and can get you migrated in record time (but expect less refactoring).
Red flags:
- Vendors who suggest “Lift and Shift” without addressing batch I/O performance on Blob Storage
- No plan for RACF-to-Entra ID security mapping
- Ignoring ExpressRoute requirements for hybrid scenarios
- No experience with Azure NetApp Files (critical for high-IOPS workloads)
When to Hire Mainframe to Azure Migration Services
1. Microsoft EA (Enterprise Agreement) Commitment
Your company signed a massive Azure consumption agreement. You need to migrate workloads to meet the commitment or risk wasting pre-paid credits.
Trigger: Azure Consumption Mandate from Finance.
2. PowerBI Analytics Demand
Business stakeholders want to run PowerBI dashboards on mainframe data. ETL from DB2 to Azure SQL Data Warehouse is painful in a hybrid setup.
Trigger: “Why can’t we see this data in PowerBI?“
3. Office 365 / Dynamics Integration
You are already on the Microsoft ecosystem. Integrating mainframe data with Dynamics CRM or Office 365 workflows requires constant API bridges.
Trigger: “It takes 2 weeks to sync customer data to Dynamics.”
4. MIPS Cost Explosion
IBM sent the MIPS pricing renewal. The cost increased 15% YoY, and your CFO is demanding a move to OpEx.
Trigger: Mainframe licensing renewal shock.
5. Disaster Recovery Gap
Your DR plan relies on a secondary data center. Azure offers geo-redundant DR at a fraction of the cost.
Trigger: DR test failure; inability to meet RTO/RPO SLAs.
Total Cost of Ownership: Mainframe vs Azure
| Line Item | % of Total Budget | Example ($10M Project) |
|---|---|---|
| Code Migration (COBOL/PL/I) | 35-45% | $3.5M-$4.5M |
| Database Migration (DB2 → Azure SQL) | 25-30% | $2.5M-$3M |
| Testing (Regression & Performance) | 20-25% | $2M-$2.5M |
| Azure Infrastructure Setup | 10-15% | $1M-$1.5M |
Hidden Costs NOT Included:
- ExpressRoute: $5K-$20K/month for dedicated network link during migration.
- Parallel Run: Running Mainframe + Azure simultaneously for 6-12 months doubles operating costs.
- Security Audit: RACF-to-Entra ID mapping requires dedicated security consultants.
Break-Even Analysis:
- Median Investment: $6M
- Annual Savings: $2.5M (MIPS + Hardware + Staffing)
- Break-Even: 2.5-3 years
Mainframe to Azure Migration Roadmap
Phase 1: Discovery & Azure Landing Zone (Months 1-4)
Activities:
- Catalog all mainframe applications and datasets
- Design Azure Landing Zone (Subscriptions, VNets, Security)
- Provision ExpressRoute for hybrid connectivity
- Select Migration Strategy (Rehost vs Refactor)
Deliverables:
- Application Inventory
- Azure Architecture Blueprint
- ExpressRoute Connection Live
Phase 2: Pilot Migration (Months 5-8)
Activities:
- Select a non-critical application for Pilot
- Migrate DB2 dataset to Azure SQL Managed Instance
- Convert JCL to Azure Logic Apps or Control-M
- Deploy to AKS or App Service
Deliverables:
- Pilot Application Running on Azure
- Validated Migration Patterns
Phase 3: Wave-Based Migration (Months 9-24)
Activities:
- Group applications into “Waves” based on dependencies
- Execute migration in 3-month waves
- Run parallel testing (Mainframe vs Azure)
- Decommission mainframe applications incrementally
Risks:
- Data sync lag between DB2 and Azure SQL during parallel run
Deliverables:
- 80% of Applications Migrated
- Reduced MIPS Consumption
Phase 4: Decommission & Optimization (Months 25-30)
Activities:
- Cutover final applications
- Decommission mainframe LPAR
- Optimize Azure costs (Reserved Instances, Auto-Scaling)
- Implement FinOps governance
Deliverables:
- Fully Decommissioned Mainframe
- Optimized Azure Environment
Architecture Transformation
graph TD
subgraph "Legacy Mainframe"
A[TN3270 Terminal] --> B[CICS Transaction Gateway]
B --> C[COBOL Programs]
C --> D[DB2 / VSAM]
D --> E["(DB2 z/OS)"]
D --> F["(VSAM)"]
end
subgraph "Azure Cloud"
G[Web Browser] --> H[Azure App Gateway]
H --> I[App Service (C# / Java)]
I --> J[Azure SQL / Blob]
J --> K["(Azure SQL MI)"]
J --> L["(Blob Storage)"]
end M[PowerBI] --> K
end
style B fill:#f9f,stroke:#333,stroke-width:2px
style H fill:#bbf,stroke:#333,stroke-width:2pxPost-Migration: Best Practices
Months 1-3: Security Hardening
- Entra ID Conditional Access: Implement MFA and conditional access policies that mimic RACF granularity.
- Azure Sentinel: Deploy SIEM to monitor for anomalous access patterns.
Months 4-6: Cost Optimization
- Reserved Instances: Once workloads stabilize, buy 1-year or 3-year Azure Reserved Instances for 40-60% discount.
- Auto-Scaling: Implement horizontal pod autoscaling in AKS for variable workloads.
Expanded FAQs
Can we use Azure NetApp Files instead of Blob Storage?
Answer: Yes, and you should for batch workloads. Azure NetApp Files provides NFS with mainframe-like IOPS (up to 320K IOPS). Blob Storage is great for archives but terrible for high-frequency I/O. Budget $10K-$50K/month for NetApp Files.
What about RACF security?
Answer: There is no 1:1 mapping. RACF is dataset-level (“Who can read this file?”). Entra ID is role-based (“What can this user do?”). We typically implement Azure RBAC + Database Row-Level Security to achieve similar granularity. This requires a security redesign.
How do we handle bi-directional data sync during parallel run?
Answer: Use Azure Data Factory with CDC (Change Data Capture) to sync DB2 → Azure SQL in real-time. For the reverse (Azure → Mainframe), use IBM DataGate or custom MQ triggers. Expect 5-15 second lag.
Is Azure the only cloud for mainframe?
Answer: No. AWS has more mature mainframe tooling (Blu Age, Micro Focus on EC2). Azure is preferred if you are already deep in the Microsoft ecosystem (Office 365, Dynamics, PowerBI). GCP has the least mainframe tooling.
What about compliance (PCI-DSS, HIPAA)?
Answer: Azure supports all major compliance frameworks. However, you need to configure it correctly. Use Azure Blueprints for automated compliance (e.g., “PCI-DSS Blueprint”). Most failures are due to misconfiguration, not Azure’s inability.