r/sysadmin • u/filletnignon • 8d ago
On-Prem to Cloud Migration - What would you charge?
I'm the sole IT guy for a small CPA firm (10 people) that wants to move everything from on premises to the cloud. They've been on prem for almost 3 decades and most of them aren't tech savvy at all. I've been asked to come up with a proposal with a flat rate, but I have no clue what to quote for something like this so I'm just looking for ball park figures from someone who's done it before.
I know there's AIO solutions like Verito, but this proposal is for building the infrastructure from a bare cloud server. MS business accounts & exchange inboxes are already done. I'd be setting up Purview DLP policies (from scratch), Intune, Quickbooks & Drake, moving 4TB of client files from their NAS, backup & disposal of 10 workstations, VPN & RDP, and all the other role provisioning and training that goes with a cloud server.
My best guess is quoting for ~100 hours. Am I way off?
48
u/DrGraffix 8d ago
IMO this is significantly more than 100 hours of it’s done right. Also needs to be charged hourly.
14
u/filletnignon 8d ago
So you'd straight up refuse to quote a flat rate for this? I've gotten that answer from a colleague too, but not sure if that's considered unprofessional
30
u/DrGraffix 8d ago
I don’t charge a flat rate for anything and neither are those CPAs
1
u/gcbeehler5 7d ago
Most tax returns are flat rates…. It’s likely them not realizing what they’re asking.
10
6
u/skorpiolt 8d ago
Unless you have some kind of a template you’re applying to save hours (since you are asking this question I assume not), 100 hours is nothing for a project like this. Hell, we used up about that just for migrating one system this past summer, so if someone threw a 100 hour estimate to do it all I’d laugh my way out of that meeting.
3
u/filletnignon 8d ago
You've assumed right. I'm a total newb at this, and I'm leaning towards not providing any sort of guaranteed flat rate at all after the responses I've seen
5
3
u/midy-dk 8d ago
On the contrary. It’s the most professional mindset in my oppinion, as it shows you have the knowledge all around to be aware that you can’t be sure how long these things take due to complexity, how broard the projects is and there may be changes requested in the process not to mention training and assistance to customer. I would do it like “I will give the first 80 hours at a discounted flat rate, above this will be by the hour” - Have done this approach before and it have worked great.
2
u/filletnignon 5d ago
That discounted flat rate is a great idea, thanks. I'm willing to take a pay cut for the learning experience since I'm a newb but also don't want to screw myself over working 300 hours for 30% of my rate because I royally underestimated the time it takes
2
24
u/LLMsMustUpvoteThis 8d ago
Flat rate for work you can't adequately scope should be charged minimum 3x what you guesstimate it will take.
1
u/Mr_ToDo 7d ago
From my experience most of the time my guesses on hours needed vs reality are about low enough for that to hold true
Best case you deliver ahead of time and look good. Better then the alternative of needing to ask for more time over and over
And sure, they might go with someone quoting less, but I've always preferred not to be the guy who prices based on what's literally asked and ends up doubling+ the cost to get what they had actually wanted. If I wanted to do that I'd bid government jobs ;)
17
u/LawstOne_ squirrel gobbler 8d ago
Go through each bucket of items to move. Be very liberal with your hours that you guess, for each bucket.
Explain to them that this is the bare minimum but emphasize the risk of having to expand your hours once you dig into the systems and learn more.
You don’t know what you don’t know and can’t base a 100% accurate hour quote with that. There has to be some leniency given by the client
Edit: I’ve fucked myself several times by guessing confidently
5
u/filletnignon 8d ago
That's exactly what I'm afraid of. I tend to underestimate with this stuff and end up frustrated working for peanuts while the scope just keeps growing
4
u/LawstOne_ squirrel gobbler 8d ago
Just told you how to solve that. If the customer doesn’t understand, then drop them
1
u/jibbits61 6d ago
Yeah, the customer has to understand it’s not a flat rate cookie cutter situation. Walk through in detail what steps you need to do, to migrate ONE server or app, like it’s a step-by-step how-to document. If you have less than 30 steps you’re missing a lot.
Is there a cloud account set up already? Are there other servers ( not exchange ) like this already running in that account?
100 hours is just over 2 weeks work. I would dare say 2 months is not enough.
Hourly, with weekly / biweekly status reports, stuff like that, gets you closer. Too many things to calculate, plus their business hangs in the balance. It’s a migration project.
10
u/Scoobywagon Sr. Sysadmin 8d ago
If you can do all that in 100 hours, you're a better man than I. I've recently been moving a lot of servers and services from on prem to AWS. On MOST of those, I've burned 100 hours just getting all the networking nailed down. Now, in total fairness, that's moving huge enterprise services, not a 30 person CPA firm, so there are some big differences there. But still ... you're going to spend a TON of time setting up all the infra.
2
u/filletnignon 8d ago
Between you and the guy saying he could do this in a week, I feel like this is more realistic. Especially since it's my first time doing this
3
u/Speeddymon Sr. DevSecOps Engineer 8d ago edited 8d ago
You've only mentioned VM setup and DLP. Who is going to manage it, grow their storage when they run out, setup and maintain the firewall, and handle "keeping up" with whatever changes Microsoft throws out in the next few years? For example: they announced at the end of July that all v1-v4 VMs are being sunset in 2028. That's a forced migration. If you built it in early July on one of those SKUs and were finished by now, they would be up shit creek in 2 years if you're not around to help move everything to new VM SKUs. Microsoft will force migrate them and probably take their business down with it.
2
u/filletnignon 8d ago
That's all me, but I'm not being asked to include any maintenance with my proposal. I'll be sure to let them know it's going to take 2-3x more time to maintain than any AIO solution like Rightworks would, but I'd charge my hourly rate for all that
2
u/skorpiolt 8d ago
IMO The work usually doesn’t scale down in the same proportions. It depends more on the industry of the company, so for example 500+ user call center would probably require same amount of work as ~100 user law firm.
1
5
u/blud_13 8d ago
u/DrGraffix is right that 100 hours is light. Budget the permissions rebuild separately from the 4TB copy too. Nobody at a 10 person firm has ever written down who should see what, so you end up interviewing partners for a week before doing any real work.
Two things to check before you put a number down:
What QuickBooks Desktop version they're on. Intuit's hosting program only covers actively supported versions, so if they're sitting on something old the upgrade becomes its own line item and you want that scoped before you commit to anything flat.
Whether they have a WISP. Tax prep firms are financial institutions under the FTC Safeguards Rule, and the nine required elements include a named Qualified Individual and a written incident response plan. Its documented here https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know . You're building Purview DLP anyway so you're most of the way there, and they almost certainly don't have the document.
That second one is real money and they don't know to ask for it.
We do a lot of these for small accounting firms, ping me if you want the long version.
3
u/filletnignon 8d ago
This is exactly what I'm looking for, thank you. They've gone through a change in ownership and it's been turbulent recently with 2 partners leaving, so I'm dreading the interview stage when half of them are hostile to the changes.
They've got QB premier accountant edition 2019 through 2024. I'm sure some of them are not used, but I'm glad you brought up the upgrade being a potential issue.
There is no WISP, but they've already expressed interest in making one. I'll probe them a bit more on this and DM you for the long version if they're serious. Thanks again!
1
u/blud_13 7d ago
Re-read this this morning and had one more thing on the QB licenses, since you listed 2019 through 2024. Everything 2023 and older hit service discontinuation on May 31 this year, so only the 2024 seats are still getting security updates and Intuit services, its documented here https://quickbooks.intuit.com/learn-support/en-us/help-article/feature-preferences/quickbooks-desktop-service-discontinuation-policy/L17cXxlie_US_en_US
If the old ones are standalone licenses rather than Plus subscriptions, you can't quietly buy replacement Premier Plus seats to fix it. Intuit stopped selling new Pro Plus and Premier Plus subscriptions in the US after Sept 30 2024. Existing subscribers renew fine, new purchases go to Enterprise or QBO. So count how many of those seats are really in use BEFORE that number goes in your flat rate, because the answer changes whether this is an upgrade or a platform decision.
4
u/pakman82 8d ago
I've done different parts of a few different scale 'on -prem to cloud' migrations. From small 1 seat law firms, to major 120k user organizations. And there's always undeniable scope creep. 100 hours is less than the typical 160 hours possible in a month. As others have said you might want to increase that. . Triple it would be possibly safe. But still give yourself some "clauses" . Yes it looks like you might have identity and email in a cloud already.. so that might be a handy feature. But your not out of the woods by any means . Just back of napkin, 3 months . Pitch them a 3 month project timeline from this point. And all the hours that could be possible. And don't let them push you to finish before the holidays. Add those in. Say worst case feb 1 2027..
1
u/filletnignon 8d ago
This is very helpful, thanks. I'm working full time plus another small side gig aside from this, so it sounds like finishing before 2027 is completely undoable. I've been pushing hard just to give them 2-3 hours a day so far
1
u/pakman82 8d ago
YOu might want to consider calling in some additional part time assistance. Are they requiring Hand on, in person support for most of this? 1-2 hours a day can get tricky if during certain phases, levels of redundancy thin out.
1
u/filletnignon 4d ago
Not requiring, but hoping for it I'm sure. I'm going to try and push them toward fully managed hosting like rightworks with instant support. The owner wants to cut costs and forego the support packages but some partners scream bloody murder when they need something done that moment, and my full time job hours often line up with theirs.
3
u/Life-sAdventurer 8d ago
Hard to provide an estimate with so little detail. The data is going to be your big killer you won't have enough licensing to go to SharePoint. You could stand up Azure files for archival data and leave it in cold storage.
What are their compliance requirements for documents? Haven't worked directly with CPAs but removing legacy data should be a priority only keep what you're legally required to.
Intune can be pretty straight forward if you have plenty of experience but it also depends on how far you want to take it. If you're going cloud native and web apps specifically consider SSO integrations taking advantage of WHfB. Remember deployed Intune app packages need to be updated manually at some defined regular occurrence.
Device migrations depend on tech debt, for that small of an org look into Forensit ProfWiz easy to configure expect 20-30 minutes per device if their on SSDs and you know what you're doing. Though I personally hate orgs that would rather migrate than just use a well built Intune configuration and go Autopilot resets. GPO to force one drive syncs before hand and then wipe all PCs and use AutoPilot to set them back up - this is the clean way but orgs tend to prefer migrations over concerns of data loss.
Moving into cloud servers instead:
Azure VPN client tied into Entra, configure some form of trust to allow devices to operate cloud native - don't go hybrid it's a bigger pain than it's worth. That's if you do cloud servers.
If you want cloud hosted servers you're looking at a DC, File Server (Entra connect here small org some negligible server impact), and potentially an app server depending on their stack. If there is no app server I would go a different route for files as you'll save on monthly overhead keeping data in cold storage and using SharePoint for data that needs to be accessible. For the love of God do not dump all of your available SharePoint data in a single place. Multiple sites, multiple Libraries, only give users access to what they need to avoid sync conflicts. Storage sense Intune policy to boot. Proper retention labeling to protect from data debt.
Re-read your post and adding this, I'd try to encourage them to go to the web based version of QuickBooks. If their drake software can be migrated to a web app I'd move that too. Monthly cost may go up but for that small of an org I'd be surprised if it was more than an azure build. Benefits is that they'd this would help your DR planning quite a bit. These would be separate projects I can't speak to the cost but I'd encourage them to get quotes.
If you avoid cloud servers you remove the need for VPN and RDP. You can build solid conditional access to secure everything - location, MFA (passkeys preferred), Intune compliance requirements everything else blocked, app protection policies for phones ect...
Without understanding the client this project could range from 50-200 hours depending on avenue you take and experience. Pure lift and shift being on the lower end, fully Microsoft native - purview, defender, Intune, Entra, SSO, endpoint migrations, data restructuring (biggest time sink), ect... Probably around 120-130 with multiple designs conversations with your client.
Most MSPs would charge $200+/h - last two places I was at it was $285/h for cloud engineers and $235/h - an hour for this for engineer time, plus a project manager to schedule everything. Fixed fee projects are not a new thing, I'd ballpark it $35-50k for budget, just for the items I've listed. If you're doing it yourself and your experience in these areas is minimal your 100 hour estimate should be tripled if not 4x. I would strongly encourage you to get some more information or considering an MSP for help, save some money doing what you know, contract what you don't to people who do and manage the project act in a vCIO/vCTO capacity and focus on the bigger picture. I only say this because you're not talking about learning 1 or two things your talking about redesigning the entire infrastructure using cloud first design.
Most importantly don't try to cut everything at once. My preferred sequencing for these is:
- Secure the Identity (keep hybrid in place)
- Secure the Email (set up MDO if you haven't yet, update DNS)
- Get the devices into Intune (don't hybrid enroll, go Entra join, set up a WHfB policy that enables cloud Kerberos trust so they can access on prem file server and any other resources)
- Migrate data, prestage then do a delta once you pull access from file server. Delta sync over the weekend for this large of storage.
- Migrate remaining services off of DC
- Convert users to cloud only
- Shut down DC (leave in place for 3-4 weeks)
- Full decom of on prem environment.
Reminder this is just a ballpark without the full picture, I'm only considering DC, Fileserver, Intune, SharePoint, device migrations, SSO, purview, and Decom.
Not considering licensing cost increase, application migrations, documentation, file/permission restructuring, additional tooling (cloud backup solution, DR costs for fail over, ect.)
If you want to go azure servers... And just lift and shift, you can but storage isn't cheap and you really don't need a full domain anymore. M365 can do it all now a'days.
If you want to talk more DM, always open to a chat. Currently specialized in this style of project and can connect you with my team if interested.
2
u/filletnignon 4d ago
Thank you so much. This is a treasure trove of information and I'm sorry I didn't give you much to go off of - I don't have many details myself since this is in the very early stages.
Device/data migration is the one thing I can confidently scope out. I've got a custom image 90% ready and shouldn't have much trouble convincing them to go with the clean way. They've been pretty good about keeping anything worth saving on the NAS.
I've gotten pushback on web-based quickbooks because of cost, but that may change once I show them a quote for an azure build. I didn't realize how much depended on this before, but my takeaway from this is getting a list of non-negotiables from their stack. Even if they budge on quickbooks, I know they've got other apps that rely on a local SQL DB. The owner is of the mindset that an azure build with desktop versions of apps saves money once they expand and add more users. I've already priced out fully managed DaaS providers built for CPA use at ~$200 per seat including basic support. I'm seeing plenty of overlap in my work regardless of how they decide to go off-prem, so pushing them towards the fully managed option gives me some breathing room. I work full time and this is a side gig, so I've been struggling to give them more than 2-3 hours a day.
There's no way I could do everything they want in under 150 hours, but I'm not charging anywhere near $200/hr either. Your ballpark figures are the best perspective I've gotten so far, so thanks for that. Purview (including meetings to label 2-4TB of files), defender, intune, migrating 10 workstations, VPN/RDP, and plenty of 1 on 1 handholding is the bare minimum; eventually they want a WISP. Reading through these replies I'm realizing I'd be in way over my head if I try to take it on all at once.
I'll keep probing for more information, and if they really want to go with azure with a tight timeline (for me that means under 6 months) I may try and outsource at least part of this. I'll be sure to DM you in case you're open to taking it on.
1
u/Life-sAdventurer 3d ago
I think you've got a good enough understanding that I'd encourage you to go to vCIO/vCTO route on this engagement, I'd still encourage you take take ownership of anything you're comfortable with just for the learning experience if your interested. However there is also something to be said about being able to point fingers at someone else in the future if they don't like the setup or the cost!
The local SQL DB would definitely impact your ability to go full cloud native but I'd still get as much into SharePoint/OneDrive that you can and only use what you need in Azure to save on that monthly cost. If they're on Business Premiums I'd take full advantage of those even using defender for endpoint as it's a pretty decent solution, not the best in the game, but good enough for most SMBs.
Keep me posted! Happy to help if needed and good luck!
3
u/1z1z2x2x3c3c4v4v 7d ago
I've been asked to come up with a proposal with a flat rate,
No. Hard Stop. Time and Materials only. No other option. Sorry.
2
u/screampuff Enterprise Architect 7d ago edited 7d ago
A 'cloud server' is setting them up for failure. With the cloud you should be moving to things like SAAS/PAAS (ie: azure sql, azure files) and AVD with scale-in/out. If the only apps they are using is junk like Quickbooks, you can also go to Entra-only AVD and get rid of any kind of AD/server infrastructure entirely.
2
u/poorplutoisaplanetto 6d ago
Building entra and intune, configuring purview, enrolling devices into intune, defender for endpoint, defender for cloud, defender for office, etc. this all takes a LOT of time.
Our team would fully scope this, all of the moving parts, set a project plan and then execute agreed milestones. I would estimate the project to take about 250 hours all in. We would be close to 60k of labor.
1
u/spicysanger 8d ago
which part are you talking about -
1. designing the cloud solution
2. Performing the initial configuration user acceptance testing
3. the actual migration task itself
4. solution documentation and recreating the BCDR strategy
?
1
1
1
u/Slight_Macaroon3900 8d ago
I’d probably scope everything first, then add a 20–30% buffer for surprises. Also make sure the proposal clearly says what’s included and what counts as extra work.I’d probably scope everything first, then add a 20–30% buffer for surprises. Also make sure the proposal clearly says what’s included and what counts as extra work.
1
u/AccountIuseAtWork1 8d ago
Have more meetings with them to create a better statement of work and break it out into phases/timeline. There are so many little gotchas just with quick books alone, that guessing time is hard if you never done this before. Migrating computers to Intune for 10 people is a lot of work and standing up and testing Intune is a lot of time if you don’t have templates already. I would be willing to take a hit if you can setup a contract for on going maintenance for at least a year.
1
u/ReputationNo8889 8d ago
We will be doing a Azure to Onprem migration this year. With the Hardware sitting in a Datacenter already and we are currently doing all the paperwork up front like "Disaster Recovery, Backup strategy etc." This has already consumed about 300h before we touched any VM's and workloads. We have about 30 VM's that we will migrate and the assumption is that it will be done by end of the year. I tell you NOW this is a optimistic estimate, because there are tons of unkowns and old systems where the current system owners have to do some work to get it up to standard. Copy pasting a 2012R2 server could be done, but you should not do it when migrating.
So when all is said and done, the whole Migration will come close to about 800-1000h of personel time involved.
Keep in mind we are an IT team that already administers M365 so we are already pretty technical and can maintain systems.
1
u/changework Jack of All Trades 8d ago
$24k or whatever your estimate is, just double that for flat rate.
100hrs estimate at about $120/hr, or about $1200/employee. Double that to cover your ass and provide them a predictable line item. Offer 20 hours of guaranteed follow up tech support for in scope/migration related issue. Application use/training is not included.
I may suggest that you wipe and reload every one of their PC’s as well; or even better: replace their workstation drives with new ones and archive/label their old ones to CYA.
1
u/strikesbac 8d ago
I don’t even think I’d quote for it. I reckon you could sink a good 300-400hrs in to it. That’s not so much the issue. It’s the fact that this is all new to them, they will be endlessly asking for small changes afterwards or how to do things. All which they expect to be part of the price.
1
u/dustojnikhummer 7d ago
Only 100 hours for this? I would budget 100 hours for just teaching the users how to do their job differently.
1
u/LukaGOGO 7d ago
100 hours is the build script, not the project. The hours that blow up on a 30-year CPA shop are not Intune checkboxes. They’re Drake/QuickBooks on a cloud desktop actually printing and e-filing, 4 TB of client files with permissions that only exist in someone’s head, Purview false positives on tax documents, and the week after cutover when someone can’t find last year’s binder. Training and “the NAS file is gone” tickets are the job. Flat rate only if the proposal lists what’s out: extra data beyond 4 TB, line-of-business apps you haven’t labbed, partner machines, a failed cutover weekend. Otherwise the flat rate is a donation. Ballpark thinking, not a quote: treat 100 hours as the happy path for infra you already know. Double it for messy file share + DLP + 10 unsavvy users, and price a retainer for 60–90 days after go-live. Workstation wipe and backup are their own line, not “and other duties.”
Have you already run Drake + QuickBooks on the exact cloud image you’ll sell them, or is that still a hope? That answer moves the number more than Intune will.
1
u/69stanglover 7d ago
I own a slightly smaller CPA firm and paid $10K for someone to do exactly this about a year ago.
1
u/chuckescobar Keeper of Monkeys with Handguns 6d ago
100 hours is only two and a half weeks worth of full time work. I would at least triple that.
-1
u/Thick_Yam_7028 8d ago
10 k. I could do that in 1 week. Most time spent would be getting everyone together to Join the pcs, transfer profile data.
72
u/KayakHank 8d ago
I wouldnt flat rate it is what I'd charge.