Appearance
Domain Consolidation — Target State and Migration Plan
Scope: Target architecture for AD forests, DNS zones, and UPN suffixes post-consolidation Purpose: Phased plan to reduce operational complexity without breaking the DDE regulated boundary Status: Proposal — Rory approves before any migration work begins Related story: DASHCF-010 Companion: architecture/domain-consolidation-current-state.md
Guiding Principles
- Regulated isolation stays. DDE (
ciriusdde.com, tenantff1c5d68) must remain a separate Entra tenant from PROD. HIPAA boundary isolation is a feature, not a burden. Consolidation does not mean merging PROD and DDE. - DR stays isolated.
dr.ciriusgroup.internalstays on-prem, non-routable, and disconnected from Entra. Its isolation is a deliberate control. - Consolidate what is redundant, not what is regulatory. The consolidation targets are DNS hosting, UPN suffixes on the PROD forest, and legacy records — not the tenant boundaries.
- No app auth breakage. Any change that would break published Medicare billing auth is either staged with overlapping SPNs/UPNs or deferred.
- Every step reversible until the decommission phase. Migration plans include rollback.
Target State Summary
| Layer | Current | Target |
|---|---|---|
| AD forests (regulated) | 3 (PROD, DDE, DR) | 3 (unchanged — tenant boundaries preserved) |
| Public DNS hosting | Azure DNS (all public zones) | Azure DNS (primary) + Cloudflare (selective sub-zones for Dashboard and edge workloads) |
| Registrar | U2 Web | U2 Web (unchanged — single registrar is good) |
| UPN suffixes on PROD | Multiple legacy suffixes possible | One primary UPN suffix (ciriusgroup.com) plus any explicitly-justified aliases |
| Internal DNS zones | ciriusgroup.internal split-horizon, plus ad-hoc | ciriusgroup.internal as the single internal zone with Azure Private DNS authority |
| Stale AD objects / DNS records | Accumulated | Cleaned during migration |
| Dashboard DNS | DashboardVM20 in US Central | DashboardVM (new) in US West, Cloudflare in front where it earns its keep |
Target Architecture
AD Forests and Entra Tenants
+--------------------------------+ +--------------------------------+
| ciriusgroup.com (PROD) | | ciriusdde.com (DDE) |
| Entra tenant d477c9f8 | | Entra tenant ff1c5d68 |
| On-prem AD + Entra Connect | | Azure-hosted AD + Entra |
| ACTRODC01 primary DC | | Connect on ENTRACAZC01 |
| Employees, PROD workloads | | Customer AVD, Medicare billing|
+--------------------------------+ +--------------------------------+
+--------------------------------+
| dr.ciriusgroup.internal |
| On-prem AD, DR site |
| No Entra sync, no internet |
+--------------------------------+
No trust between any two. Federation through managed SPs only.DNS Zone Hosting
Registrar: U2 Web (all public domains)
|
v
Authoritative DNS: Azure DNS (default), Cloudflare (selective sub-zones)
Public zones (Azure DNS):
- ciriusgroup.com (PROD subscription)
- ciriusdde.com (DDE subscription)
Sub-zones delegated to Cloudflare (case by case):
- dashboard.ciriusgroup.com (US West migration)
- (others as justified — edge, static, DDoS-sensitive)
Internal zones (Azure Private DNS + on-prem AD DNS):
- ciriusgroup.internal (split-horizon, PROD + DR)
- privatelink.* (Azure private endpoint zones)
DR-local (non-routable):
- dr.ciriusgroup.internalMigration Phases
The plan is divided into phases that land independently. Each phase is complete before the next begins.
Phase 1 — Inventory Freeze and Cleanup
Goal: Establish a clean baseline before any structural change. Effort: ~2 weeks wall-clock, ~1 week focused engineering.
Activities:
- Publish
domain-consolidation-current-state.md(DASHCF-009 — this workstream). - Enumerate and delete stale DNS records across all Azure DNS zones.
- Remove decommissioned computer accounts from each AD forest.
- Audit UPN suffixes on PROD; remove any that have zero active users.
- Inventory certificates pinned to specific FQDNs; note renewal dates.
Exit criteria:
- Current-state doc reflects reality within 5%.
- Zero stale records in Azure DNS zones.
- Every UPN suffix on PROD has at least one active user or explicit justification.
Phase 2 — Dashboard DNS Migration (US Central → US West)
Goal: Stand up the new DashboardVM in US West with DNS cut over cleanly. Effort: ~1 week engineering + 1 week bake. Dependency: Phase 1 complete.
Activities:
- Provision DashboardVM (West) in the appropriate subscription.
- Create
dashboard.ciriusgroup.comsub-zone; decide Azure DNS vs Cloudflare per the "earns its keep" test (Cloudflare gains DDoS, WAF, edge cache — worth it when the dashboard is externally reachable). - Dual-run old and new endpoints; monitor traffic and errors.
- Cut over DNS with low TTL (60–300s); watch for 24 hours.
- Decommission DashboardVM20 in US Central after bake.
Exit criteria:
- New DashboardVM responding on the published FQDN with zero error-rate regression.
- DashboardVM20 destroyed in Terraform; state clean.
Phase 3 — Internal DNS Consolidation
Goal: One authoritative internal zone per environment, no ad-hoc zones. Effort: ~1–2 weeks. Dependency: Phase 2 complete.
Activities:
- Identify every ad-hoc internal DNS zone (often created for a single project).
- Consolidate into
ciriusgroup.internalwith Azure Private DNS as the Azure-side authority, on-prem AD DNS for the on-prem side, split-horizon where needed. - Move private-endpoint-required zones (
privatelink.*) into a single RG per subscription so they are discoverable. - Add diagnostic settings on every Private DNS zone forwarding to LAW.
Exit criteria:
- No ad-hoc internal zones remain.
privatelink.*zones centralized per subscription.
Phase 4 — UPN Suffix Cleanup on PROD
Goal: Primary UPN suffix on PROD is ciriusgroup.com; aliases are explicitly-justified only. Effort: ~1 week engineering plus user communication time. Dependency: Phase 1 complete.
Activities:
- For every alternate UPN suffix on PROD, move users to the primary or to a justified alias.
- Remove unused suffixes from the Entra tenant Custom domain names list.
- Confirm Entra Connect on PROD syncs only the cleaned suffix list.
Exit criteria:
- Entra PROD has one primary UPN suffix plus any Rory-approved aliases.
- No user objects on deprecated suffixes.
Phase 5 — Cloudflare Selective Adoption
Goal: Put Cloudflare in front of specific public-facing sub-zones where edge/DDoS/WAF are worth the complexity. Effort: ~1 week per sub-zone. Dependency: Phases 1 and 2 complete.
Activities:
- Per sub-zone: delegate NS in Azure DNS to Cloudflare; import records into Cloudflare via Terraform (
cloudflare/cloudflareprovider). - Apply WAF, rate-limit, and caching policy as appropriate.
- Verify certificate issuance (Cloudflare-managed or uploaded).
- Keep Azure DNS for apex zones and internal records.
Exit criteria:
- Each adopted sub-zone has documented justification, WAF policy, and cert story.
- No surprise Cloudflare adoption for zones that don't need it.
Phase 6 — DDE Tenant (Unchanged) Hygiene
Goal: Apply the same Phase 1 and Phase 4 cleanups inside DDE without merging anything into PROD. Effort: ~1 week. Dependency: Phase 1 and Phase 4 complete on PROD (reuse patterns).
Activities:
- Clean stale DNS in
ciriusdde.com. - Clean stale AD objects in
ciriusdde.comdomain. - Audit DDE UPN suffixes.
- Confirm
ENTRACAZC01sync scope matches the cleaned object set.
Exit criteria:
- DDE tenant hygiene matches PROD hygiene.
- No merge or trust between PROD and DDE.
Dependencies Across Phases
| Depends on | Dependents |
|---|---|
| Phase 1 (inventory + cleanup) | All other phases |
| Phase 2 (Dashboard migration) | Phase 5 (Cloudflare selective) |
| Phase 4 (UPN cleanup PROD) | Phase 6 (DDE hygiene repeats the pattern) |
External dependencies:
- Rory approval at each phase gate.
- User communication for any UPN change — ahead of Phase 4.
- Certificate renewal schedule — align Cloudflare migration with renewal windows so cert work isn't duplicated.
- CI/CD OIDC — domain changes do not affect GitHub org name;
Cirius-Group-Incstays as-is regardless of domain consolidation outcome.
Rollback
Each phase is designed for rollback:
| Phase | Rollback |
|---|---|
| Phase 1 | N/A (cleanup only — no structural changes) |
| Phase 2 | Flip DNS back to old IP; old VM kept until post-bake decommission |
| Phase 3 | Internal DNS is additive until cutover; keep old zones alive with forwarding during bake |
| Phase 4 | UPN suffix alias readded via Terraform; user objects moved back |
| Phase 5 | Delegate NS back to Azure DNS; Terraform reverts Cloudflare records |
| Phase 6 | Same rollback pattern as Phases 1 and 4, scoped to DDE |
Every rollback is a Terraform PR, never a portal fix.
Estimated Effort (Calendar)
| Phase | Engineering Days | Wall-Clock (with reviews + bake) |
|---|---|---|
| 1 — Inventory and cleanup | 5 | 2 weeks |
| 2 — Dashboard migration | 5 | 2 weeks |
| 3 — Internal DNS consolidation | 8 | 2 weeks |
| 4 — UPN cleanup PROD | 4 | 2 weeks |
| 5 — Cloudflare selective | 5 per sub-zone | 1 week per sub-zone |
| 6 — DDE hygiene | 5 | 2 weeks |
Total engineering effort: ~30 engineering days for the first Cloudflare sub-zone. Total wall-clock: ~3 months with reviews, user communication, and bake time between phases.
These are planning estimates, not commitments. Each phase re-estimates as it starts.
Out of Scope
- Merging PROD and DDE tenants — explicitly rejected; HIPAA isolation stays.
- Deleting DR forest — DR isolation is a deliberate control.
- Cloudflare adoption for apex zones — apex stays on Azure DNS.
- Registrar change — U2 Web stays; single registrar is operationally cleaner.
- Domain acquisition of new names — separate procurement workstream.
Risks
- User disruption during UPN changes — mitigated by per-user communication and staging aliases.
- Certificate mismatch during Cloudflare cutover — mitigated by aligning cert renewal with cutover windows.
- Stale DNS cache during Dashboard migration — mitigated by low TTL pre-cutover and extended bake.
- Forgotten dependency (an automation script hardcoded to an FQDN) — mitigated by Phase 1 inventory and by staged cutovers with rollback.
Related
architecture/domain-consolidation-current-state.md— current state (DASHCF-009)- SecOps project
DASHCF— Dashboard Migration & Cloudflare epic runbooks/backup-architecture.md— DR architecture context for DR forest