When do I pick Azure SQL Database Hyperscale vs Azure SQL Managed Instance — what is the real decision rule?
The decision rule is surface compatibility vs operational scale. Pick Managed Instance when the workload depends on instance-level SQL Server features — SQL Agent jobs, cross-database queries, linked servers, CLR, Service Broker, Database Mail, Distributed Transactions, or any of the dozens of compatibility surfaces that single-database PaaS does not expose. Pick Hyperscale when the workload is a single database (or can be refactored to one), the data volume is above 4 TB or the rate of change is high, and the operational profile — near-instant backup and restore, fast compute scale, named read replicas — is the main value. There is also a third call: if the data is below 4 TB and the application is cloud-modernized to live on a single database, vanilla Azure SQL Database Business Critical is the most cost-effective destination — neither Hyperscale nor Managed Instance is required. The /database-vs-data-warehouse-vs-data-lake-microsoft-2026 hub covers the broader OLTP vs OLAP fit decision.
How do I migrate an on-prem SQL Server estate to Azure SQL — what does the actual cutover look like?
Migration runs in three phases. First, classify every database — Data Migration Assistant identifies the compatibility issues and recommends Azure SQL Database, Managed Instance, or SQL on Azure VM as the destination. Second, land the target — provision the destination instance or database, configure HA, set up Defender for SQL, apply Azure Policy initiatives, configure the network endpoints. Third, cut over — Azure Database Migration Service runs online migrations with continuous replication and a single-digit-minute cutover window, or backup-restore handles workloads where a maintenance window is acceptable. EPC Group runs migrations in named waves with documented acceptance criteria per wave and a rollback plan that every customer signs off on before the wave starts. The /digital-transformation-microsoft-enterprise-2026 lifecycle covers the broader Assess-Modernize-Govern-Operate-Innovate framing inside which an Azure SQL migration sits.
How does Azure SQL cost compare to Amazon RDS for SQL Server — is the TCO really better on Azure?
For SQL Server workloads, Azure has two structural cost advantages that RDS does not match. First, Azure Hybrid Benefit converts existing SQL Server Software Assurance licenses into Azure SQL Database, Managed Instance, or SQL on VM core entitlements at no additional charge — the equivalent feature on AWS (BYOL for SQL on EC2) is narrower and does not apply to RDS for SQL Server PaaS. Second, Extended Security Updates for SQL 2008/2012/2014/2016 are free on Azure VM, a multi-thousand-dollar-per-core annual savings vs running the same legacy workload on RDS or EC2. On Hyperscale specifically, Azure runs above 4 TB at substantially better economics than RDS for SQL Server Multi-AZ once storage and IO are factored in. On Managed Instance there is no RDS equivalent — Aurora is PostgreSQL/MySQL only, and RDS for SQL Server is single-database PaaS without the instance-level surface. EPC Group has built side-by-side three-year TCO models for 40+ enterprise migrations and Azure has won the SQL Server line on price every time.
What does Always Encrypted with secure enclaves actually protect against — and where do I use it?
Always Encrypted protects sensitive data from privileged Azure operators, malicious DBAs, and compromised application servers — encryption and decryption happen in the client driver, so the database engine never sees plaintext. The original Always Encrypted (no enclaves) only supported equality predicates and exact-match joins on encrypted columns; secure enclaves extend that to range queries, pattern matching, and richer indexing through a hardware-protected enclave inside the SQL engine. Use Always Encrypted with secure enclaves for PCI cardholder data, PHI, government-classified data, and any column where the regulator or the data owner requires cryptographic separation from the database administrator role. Microsoft Defender for SQL detects credential brute force and anomalous queries against Always Encrypted columns; Microsoft Purview classifies them; the /microsoft-defender-for-cloud-cnapp-enterprise-2026 hub covers the unified Defender for Cloud security plane Azure SQL participates in.
What is Azure SQL Database Ledger and when does it earn its keep over the engineering work to adopt it?
Ledger makes Azure SQL Database (and Managed Instance) a tamper-evident system of record. Every modification to a ledger table is captured in an append-only history with cryptographic hashes that can be verified against an off-database digest store — Azure Storage with WORM policy, Azure Confidential Ledger, or an immutable blob. The use case is regulatory or audit-driven evidence that a row was never silently modified — financial transactions under SOX, clinical records under HIPAA, supply-chain provenance, audit logs of privileged operations. Ledger is not a substitute for transactional logging or a CDC stream; it is a cryptographic proof surface that the data the auditor sees today is the data that was written when it was written. It earns its keep when an auditor or regulator is the primary consumer of the proof, not when the use case is internal change tracking.
How does Azure SQL High Availability actually work across the three service tiers?
General Purpose uses remote premium storage with a stateless compute node — failover restarts the compute on healthy hardware and re-attaches the storage, usually under 30 seconds. Business Critical runs a four-node Always On availability group on local SSD inside an Azure region, with three synchronous replicas providing single-digit-second failover and read-scale-out to the secondary replicas — when configured zone-redundant, the four nodes spread across three Availability Zones and the SLA rises to 99.995%. Hyperscale uses a decoupled architecture where the storage layer (page servers) and the log service run independently; HA is delivered through a primary compute node and one or more high-availability replicas plus the page server tier. For cross-region DR, auto-failover groups orchestrate the secondary in a paired region with automatic or manual failover, RPO measured in seconds and RTO in minutes. EPC Group sizes the HA tier from the workload SLA, not from a default.
How do I optimize Azure SQL cost — what actually moves the bill?
Four levers move Azure SQL cost meaningfully. First, Reserved Capacity — committing to one-year or three-year reservations cuts compute spend 33-55% on the steady-state portion of the estate. Second, Azure Hybrid Benefit — if the customer has existing SQL Server Software Assurance, AHB drops the effective price 30-55% by converting SA into Azure SQL core entitlements. Third, Serverless — auto-pause and auto-scale on Azure SQL Database (and now Hyperscale) drops the bill to storage-only when the workload idles, ideal for development, staging, and unpredictable production patterns. Fourth, right-sizing — Query Store and Intelligent Insights data shows where compute is over-provisioned, and the platform supports vCore scale down with seconds of impact. EPC Group typically takes 25-40% off the post-cutover cost trajectory in the first 90 days through these four levers combined.
What does the EPC Group Azure SQL Accelerator deliver, and what does it cost?
The accelerator is the five-phase Assess, Design, Migrate, Optimize, Operate program that takes an enterprise from on-prem SQL Server estate to a fully operating Azure SQL platform with documented HA, DR, security, governance, and cost-optimization baselines. Pricing is fixed-fee between $150,000 and $500,000 depending on instance count, regulatory scope, multi-region DR requirements, and managed-service tail. Senior-architect-led, no offshore handoff, named senior on-record from kickoff through go-live. Most enterprise engagements complete the Migrate phase between 16 and 32 weeks from kickoff, with the broader estate transitioning over the 12-to-18-month horizon. The /services/azure-consulting-services page covers the broader Azure service line, and the /microsoft-cloud-orchestrator hub covers the platform layer inside which Azure SQL sits.