Book_11 — Epilogue: The Platform Question
After the Authentication Transformation — Choosing a Platform per Data Domain
Books 01–10 are the SQL Server Identity Transformation. This epilogue starts where they end: with a rationalized estate whose authentication has moved to Microsoft Entra ID. Nothing in Books 01–10 depends on it.
Book_11-bundle.docx — this epilogue as one Word document. Regenerated on every site deploy.
The Fragmentation Cost
The authentication transformation produces a rationalized estate. The platform question asks what to do with that estate. Twenty years of accretion have produced overlapping instances, duplicated data domains, and no single authoritative source for any given subject. The goal is fewer authoritative platforms: one authoritative database per data domain.
Three Destinations
Every retained data domain ends at one of three candidate destinations: stay on SQL Server, re-platform to PostgreSQL, or re-platform to Oracle. Each can satisfy the forced requirement — authentication that is observable and conditionable in the identity plane. This epilogue doesn’t rank them. Which one fits depends on the data domain, so the decision is made with a framework rather than a verdict.
Decision Framework
Score each candidate destination for each data domain on the same dimensions, and record the evidence behind each score:
| Dimension | Evidence required per data domain |
|---|---|
| Migration effort | Schema and code inventory (procedures, functions, triggers, jobs), conversion estimate, test scope |
| Application compatibility | Driver and connection-string support for every consuming application; vendor support statements |
| Operational maturity | Monitoring, patching, backup and runbook coverage the operating team already has for the platform |
| HA/DR fit | Required RPO and RTO against the platform’s supported HA and DR topologies |
| Identity integration | How the platform authenticates to the chosen identity plane, verified in its own documentation |
| Licensing exposure | Current and projected license cost from the agency’s own agreements |
| Portability | Dependence on platform-specific features; exit path |
| Data-domain consolidation opportunity | Which duplicate copies of the domain the move would retire |
| Required skills | Staff skills today, and the training or hiring the move needs |
| Switching cost | Parallel-run duration, dual-running cost, contract terms |
Two data domains can reach different answers, and that is normal. The goal is fewer authoritative platforms, not a single vendor.
Decision Sequence
- Audit and rationalize first (Books 02–03). Inventory every instance, surface silent NTLM fallback, and classify each instance retire, consolidate or retain.
- Do the forced authentication move on the retained set (Books 04–06): Arc-enable, stand up Entra logins alongside Windows logins, cut over, retire the old logins.
- Then make the platform choice per data domain. Re-platforming follows the same parallel-run discipline — establish the target, validate in parallel, cut over only after the validation window. Never drop before you observe.
- The authentication transformation produces the inventory that scopes the platform decision.
- The decision is made per data domain against a common set of dimensions and evidence, and two estates with two answers is normal.
- The goal is fewer authoritative platforms, not a single vendor.
Place in the dependency chain: Epilogue, after step 9.