Cloud migration in 2026 is no longer a question of whether to move — it is a question of which workloads to move to which cloud, in what order, with what cost guardrails, and how to avoid the technical and contractual traps that turned previous-generation migrations into expensive disappointments. This guide is the practical SMB and mid-market playbook: the 6 R’s framework, AWS / Azure / Google Cloud comparison for typical workloads, a realistic migration timeline, the cost surprises everyone hits, and how to avoid the common failure modes.
The 6 R’s of Cloud Migration
| Strategy | What It Means | Best For | Effort |
|---|---|---|---|
| Rehost (lift-and-shift) | Move VM as-is to cloud IaaS | Time-pressured migrations; legacy apps | Low |
| Replatform (lift-and-reshape) | Minor optimization (e.g., SQL Server → managed RDS) | Apps with simple managed-service equivalents | Medium |
| Refactor (re-architect) | Rewrite for cloud-native services | Apps with high scaling needs or active development | High |
| Repurchase (drop-and-shop) | Replace with SaaS | Email, file storage, CRM, ERP, ticket tools | Medium |
| Retire | Decommission | Apps no one is using or that have replacements | Low |
| Retain | Keep on-prem | Latency-critical, sovereignty-bound, or regulated workloads | None |
For most SMBs migrating from on-prem in 2026, the typical mix is: ~40% repurchase (SaaS replaces home-grown or vendored software), ~30% rehost, ~15% replatform, ~10% retire, ~5% retain.
AWS vs Azure vs Google Cloud — Quick Comparison
| Capability | AWS | Microsoft Azure | Google Cloud |
|---|---|---|---|
| Best for | Greenfield apps; broadest service catalog | Microsoft-shop integration; hybrid scenarios | Data analytics; AI/ML; Kubernetes-native shops |
| Identity | IAM (separate) | Native Entra ID integration | Cloud Identity (separate) |
| Compliance certifications | Most comprehensive | Strong; including FedRAMP High | Strong; growing |
| Discount programs for SMBs | AWS Activate | FastTrack via M365 | Google for Startups |
For Microsoft-stack SMBs, Azure is usually the natural primary cloud — the integration with Entra ID, Microsoft 365, and Defender pays back the small price premium. Pure analytics or container-heavy shops often pick Google Cloud. AWS remains the broadest catalog and the default for any application teams already familiar with it.
A Realistic SMB Migration Timeline
| Phase | Typical Duration | Key Activities |
|---|---|---|
| 1. Assessment | 4–6 weeks | Application inventory, dependencies mapping, 6 R’s classification, cost modeling |
| 2. Foundation | 3–4 weeks | Landing zone, identity, networking, security baseline, billing alerts |
| 3. Pilot wave | 4–6 weeks | Migrate 2–3 lower-risk apps; validate process and cost projections |
| 4. Production waves | 3–9 months | Migrate workloads in dependency-aware waves of 5–15 apps |
| 5. Optimization | Ongoing | Right-sizing, reserved instances, cost reviews, security hardening |
Total elapsed time for a typical SMB: 6–12 months for a complete migration. Plan budget accordingly — running both old and new during cutover is the largest near-term cost.
The Cost Surprises Everyone Hits
- Egress costs. Moving data out of a cloud is expensive.
- Idle resources. Forgotten dev VMs, oversized databases, and unused load balancers compound monthly.
- Data storage tiering. Lifecycle policies to cool/archive tiers save 60–90% on infrequently-accessed data.
- Software licensing in the cloud. Bring-your-own-license vs cloud-included can be 2x different in cost.
- Networking. NAT gateways, private endpoints, inter-region traffic — these can be 15–30% of total spend if not designed deliberately.
- Logging and monitoring. Default settings can produce surprisingly large bills. Sample, filter, and tier appropriately.
- Snapshots and backups. Persistent snapshots accumulate without lifecycle policies.
Migration Planning — The Application Wave Pattern
- Wave 0 — Pilot. Pick 2–3 simple, low-risk applications. Goal: validate process, tooling, and cost projections before scaling.
- Wave 1 — Standalone apps. Apps with few dependencies; SaaS-bound or simple lift-and-shift candidates.
- Wave 2 — Front-tier apps. Customer-facing applications with managed dependencies.
- Wave 3 — Core business apps. ERP, CRM, billing, finance — the apps everyone depends on.
- Wave 4 — Identity and shared services. Active Directory, file shares, DNS — typically last because everything else depends on them.
- Wave 5 — Cleanup and optimization. Decommission on-prem, right-size cloud resources, lock in reserved-instance commitments.
Common Migration Failure Modes
- Big-bang migrations. Almost always misses dependencies and creates outages.
- No baseline cost modeling. Actual spend is 30–60% higher in year one than list-price projections.
- Forgetting identity. Underestimating Entra ID / IAM / Cloud Identity setup is the second-most-common reason migrations slip.
- Network architecture drift. Should use segmentation and zero-trust patterns from day one.
- Skipping security baseline. Defender for Cloud / GuardDuty / Security Command Center should be on day one.
- No FinOps practice. Without monthly cost reviews, spend grows 20–40% per year through accumulated waste.
- Treating SaaS migration as IT-only. Repurchase decisions are business decisions with IT implications.
Compliance and Cloud
| Framework | Cloud Considerations |
|---|---|
| HIPAA | BAA with cloud provider; encryption in transit and at rest; audit logging; access controls |
| SOC 2 | Provider’s SOC 2 + your tenant configuration; CC criteria including encryption and access |
| FedRAMP | FedRAMP-authorized region/service; separate boundary for federal data |
| FTC Safeguards | Encryption, MFA, vulnerability management, incident response |
| State privacy laws | Data residency considerations; especially CA, TX, NY, IL |
Frequently Asked Questions
How much does cloud migration cost for an SMB?
Professional services for migration run $50k–$300k for a 50–250 user SMB. Run-rate cloud spend then varies by workload — typically $50–$300 per user/month for a mid-sized organization with full SaaS plus IaaS.
Is cloud cheaper than on-prem?
Often no on a 1:1 basis — but cloud delivers more capability per dollar (security, scaling, BCP), which is the more honest framing.
Should we go multi-cloud?
Almost everyone is multi-cloud whether they planned to be or not. Strategic multi-cloud — same workload on two clouds — is rarely worth the operational overhead for SMBs.
What is the most common migration mistake?
Underestimating identity and networking. Both are 2–3x larger than expected and affect every application that follows.
Do we need a FinOps practice?
Yes, even at SMB scale. Monthly cost reviews with right-sizing typically pay back 10–25% of cloud spend.
Bottom Line
Successful cloud migration is a structured exercise: assess (6 R’s), build foundation (identity, network, security), pilot, then waves. The capability story is decisively in cloud’s favor for most SMBs. The risk is in execution, not in the destination.
Planning a migration? ACS runs cloud migration assessments and execution for U.S.-based SMBs and mid-market firms. Contact us for an assessment scoped to your environment.
