Cloud Migration for Construction: How Huntzberry Civil Construction Moved From On-Premises Servers to a Cloud-First Business
- Shay
- Aug 29
- 21 min read
A few years ago, my work with Huntzberry Civil Construction looked very different from what it does today. At the time, the company was still operating as Huntzberry Brothers, much of its technology depended on servers located in the office, and getting information into the hands of employees working in the field meant finding secure ways to connect them back to those systems.
One of the earlier projects I completed with them focused specifically on that challenge. I helped deploy managed iPads so field employees could use B2W, submit timecards and equipment information, access drawings and project information through Microsoft Teams, and handle more of their work without having to return to the office. I wrote about that earlier phase in Technology for Construction Field Crews: Working Smarter From the Jobsite. At that point, B2W still depended on infrastructure located at the office, so secure VPN access was an important part of making the field technology work.
There was nothing wrong with that design. It fit what the business and its software needed at the time. As the company continued to grow, however, the applications they depended on began changing. Cloud options became more practical, employees were working from more places, and eventually it made sense to look at whether the servers and some of the other technology we had relied on for years still fit where Huntzberry Civil Construction was headed.
That is what eventually turned into a much larger modernization project. The goal was not simply to get rid of servers. I wanted to look at the business as a whole, understand what still needed to stay, determine what no longer made sense, and build the next environment around the way Huntzberry Civil Construction actually worked.
“A good cloud migration is not about moving everything somewhere new. It is about deciding what the business still needs, what it has outgrown, and what should work differently going forward.”SNL-Tech Services
Why This Cloud Migration for Construction Started With the Business Applications
The conversation about moving away from the existing servers really began with the business applications. As we were planning the company's next steps, B2W's direction was moving toward its cloud services. At the same time, Huntzberry Civil Construction had an aging QuickBooks server that would eventually need additional investment. Virtualizing or upgrading that server was certainly an option, and it was something I considered, but before putting more money into maintaining it I wanted to look at where the rest of the business software was heading.
Huntzberry Civil Construction ultimately moved B2W to Trimble's cloud platform and adopted a newer Trimble solution for the billing and accounting workflow that integrated directly with B2W. The company also moved its HR functions to BambooHR, giving employees another important business system that no longer depended on infrastructure sitting inside the office.
Once those decisions were made, the case for continuing to invest heavily in the existing servers became much harder to justify. I could have spent money preserving the aging QuickBooks server and some of the infrastructure around it, but we would have been investing in an environment the company was already beginning to move away from. For Huntzberry Civil Construction, it made more sense to put that effort into building the environment they were going to use going forward.
This is one of the reasons I do not think the question for a small business should simply be, “Do we still need a server?” The better question is what is actually running on that server and whether those applications, files and workflows still require it. I cover that decision in more detail in Should Small Businesses Move to the Cloud? because moving everything to the cloud is not automatically the right answer for every business. In this case, however, the direction of the applications and the way the team worked were both pointing toward a cloud first environment.
Before Moving More to the Cloud, I Had to Look at the Internet Connection
Moving business applications, company files and eventually much of the daily workflow to cloud services also meant the internet connection was becoming more important than it had ever been.
Before continuing with the migration, I reviewed the connectivity requirements for the applications Huntzberry Civil Construction was preparing to use and compared those requirements with the internet service available at the office. Their existing provider could not deliver the level of performance I wanted for a business that was becoming increasingly dependent on cloud applications, Microsoft 365 and employees working from multiple locations.
Their location also limited the traditional internet options available to them, so this was not as simple as calling another cable or fiber provider. I had experience with Starlink from my own use and other deployments, so I discussed it with Huntzberry Civil Construction as one of the available options. They ultimately chose Starlink Business, and they have been very happy with the change. The experience was positive enough that they later changed their home internet to Starlink Residential and saw a significant improvement there as well.
That connectivity project ended up being an important part of the cloud migration even though it had nothing to do with Microsoft 365 itself. When a business starts depending more heavily on cloud applications, internet connectivity becomes part of the infrastructure supporting those applications. Before I could make Huntzberry Civil Construction more dependent on the cloud, I needed to be comfortable with how reliably they could reach it.
I Wanted to Understand the Existing Environment Before I Started Moving It
Once the direction of the business applications and connectivity was established, I started documenting what was actually in the environment.
I created a spreadsheet and went through the computers individually. I documented the operating system, processor, memory and storage, but I was particularly interested in where employees were keeping their files. I did not want to discover halfway through a workstation migration that someone had important business information stored somewhere locally that nobody had accounted for.
While I was already working with the computers, I began configuring and checking OneDrive so I could make sure the files that were supposed to synchronize were doing so correctly. That process also identified exceptions that needed their own plan. One employee, for example, had a significant amount of large data that did not fit the standard OneDrive approach, so I documented that separately and planned for the data to be backed up before migrating that user's computer.
For each computer, I was looking at things such as:
Windows version and Windows 11 compatibility
Processor and memory
Available storage
Where the employee's files were actually stored
OneDrive synchronization
Applications the employee depended on
Unusual local data or workflows
Whether upgrading or replacing the computer made more sense
Several of the all in one computers needed either storage upgrades or replacement. I gave Huntzberry Civil Construction the options, and they chose to replace them. I researched replacement all in one systems with more memory, larger storage and faster processors so the new equipment would make sense for the environment we were building rather than simply matching what was being removed.
I also found a laptop that could not meet the requirements for Windows 11. One option I offered was to repurpose one of the all in one computers that was already being replaced as part of the project. That would have allowed the company to reuse equipment rather than automatically purchasing another computer. The team explained that they wanted to keep a laptop available because of how that device was used for training, so they preferred to purchase a new laptop instead. I researched several appropriate choices and sent the options to them so they could decide which one they wanted.
That is another reason I do not assume that moving a business to the cloud means replacing every computer. It means understanding whether the computers employees already have are appropriate for the environment you are building. Sometimes upgrading makes sense, sometimes replacement makes sense, and sometimes equipment can be repurposed somewhere else.
This type of review is also why I encourage businesses to periodically look at their overall technology instead of waiting until something fails. My Small Business Technology Review goes deeper into reviewing hardware, subscriptions, contracts, software and other technology costs before they become emergency decisions.
Moving the Files Was Also an Opportunity to Clean Them Up
One of the questions businesses frequently have when considering this type of project is whether SharePoint can replace a traditional file server. I do not think that question should be answered without first understanding what is actually on the file server.
Before moving Huntzberry Civil Construction's shared company files, I sat down with them and reviewed what existed, how the information was organized and who had access to it. Their existing environment used Active Directory security groups to manage access, which gave me a useful starting point, but I did not want to take years of files and permissions and blindly reproduce all of it in Microsoft 365.
A migration is one of the few times when a business is already expecting its file environment to change, so I like to use that opportunity to ask whether the existing organization still makes sense. Sometimes a client wants everything recreated almost exactly as it was. Huntzberry Civil Construction decided to use the migration as an opportunity to reorganize, clean up and tighten access.
I created the SharePoint structure around the way Huntzberry Civil Construction wanted to organize its information going forward. Rather than treating all of the company files as one large collection of data, we separated information based on how it was used and who actually needed access to it. I then used Entra ID security groups to control those permissions so employees could access the company resources appropriate to their responsibilities without everyone automatically having access to everything.
This was not simply a file copy. We were deciding what the next version of the company's file environment should look like.
I Built the Microsoft 365 Environment Before Moving Everyone Into It
Before I started moving employee computers away from the existing Active Directory environment, I wanted the Microsoft 365 side ready. That included much more than creating users and uploading files. I prepared the identity, security and device management pieces that would eventually support the computers after they were moved.
Some of that preparation included:
Microsoft Entra ID security groups
SharePoint permissions and access controls
Microsoft Intune enrollment and device management
Conditional Access policies
Microsoft Defender and email protections
Windows Hello for Business
BitLocker encryption policies
Windows Update policies
OneDrive configuration
SharePoint library synchronization
Review and management of third party application access
These are the types of areas I also look at during a Microsoft 365 Tenant Security Review. Having Microsoft 365 licenses is only the starting point. The tenant still has to be configured around the business, the users, the devices and the risks the company is trying to manage.
I also did not want the first real test of those settings to happen on an employee's computer. I took one of my own laptops and joined it to the Huntzberry Civil Construction Microsoft tenant. I documented the enrollment process and watched the policies apply so I could see what the experience would look like before doing it to the production computers.
I also created a test user with intentionally limited access so I could verify both sides of the permissions model. An authorized employee needed to be able to reach the information they were supposed to use, while someone without permission needed to be denied. Testing the environment this way gave me an opportunity to work through the configuration before employees depended on it.
I Wanted the New File Experience to Feel Familiar
One part of the project that was particularly important to me was how all of these changes would feel to the employees.
Huntzberry Civil Construction's employees were accustomed to opening File Explorer and finding company information through the mapped drives they had used for years. Technically, I could have moved everything into SharePoint, given everyone the web address and taught them to navigate the SharePoint website. That would have worked, but it also would have created an unnecessary change in something employees did constantly.
Instead, I configured OneDrive so it automatically signs users in with their business identity on their managed computers. I also configured the appropriate SharePoint resources to synchronize automatically for the employees who need them. This lets the appropriate company files appear through File Explorer in a familiar drive style experience without employees having to manually connect SharePoint libraries or continually sign themselves back into OneDrive.
For the employees, the technology underneath the files changed much more than the basic way they get to them. They can sign into their computer, open File Explorer and find the company information they are authorized to use without having to open the SharePoint website every time they need a document.
The security and management still happen behind the scenes. Which SharePoint resources an employee receives depends on the access that has been assigned to them, and the device itself is part of the managed Microsoft environment. From the employee's perspective, however, much of that complexity is invisible.
That was intentional. I wanted to modernize where Huntzberry Civil Construction's information lived without unnecessarily forcing employees to relearn something as basic as how they open a company file.
We Did Not Change Everything at Once
This migration was staged because I did not want the entire company dealing with every change at the same time.
The first major application move was B2W. That migration was not as smooth as expected, and I was glad I chose to be onsite for the initial cutover. There were bugs and issues that required working directly with B2W support, and I had to touch each computer to get users connected properly. The managed iPads also needed their B2W application configurations updated for the new environment.
The Huntzberry Civil Construction team has always been very good about working with me when I need access to their devices or need employees to participate in a change. I have worked with them long enough that the relationship feels less like being an outside IT provider and much more like being part of the team. That makes a real difference during projects where the business still has work to get done while I am changing the technology underneath it.
Once B2W was stable, the transition away from QuickBooks was handled and went much more smoothly. From there I moved into the file portion of the project. I migrated the shared company information into SharePoint and got employees working from the new file environment before I changed the identity of their PCs.
Only after the files were working successfully did I begin the workstation migrations. I spent several days moving the computers away from the traditional Active Directory environment and into Microsoft Entra ID and Intune. Where it made sense, I also migrated the existing user profiles rather than wiping every computer and making employees start over with a completely new Windows environment.
Staging the project this way reduced the number of things employees had to adjust to at any one time. If something did not work, it was also much easier to identify which part of the migration was responsible.
There Was One Workflow I Missed
Even after the inventory, file review and testing, there was one workflow I did not catch during the original planning. Employees had been scanning documents from the office printers directly into folders on the old file server.
It was one of those processes that had been working for so long that nobody really thought about it as something that depended on the server. Once the server based file shares were removed from normal use, we discovered the dependency.
I logged into the printers, configured scan to email and updated the address books for the users. There was a short period of roughly three days when some employees had continued sending scans to the old server location, so when they told me something was missing I went back to the server, retrieved the scans and moved them where they needed to go. I also sent the team pictures and instructions showing them how to use the new scanning process.
They adjusted to the change quickly, but I like including this part of the project because it is what a real migration looks like. Documentation and planning help tremendously, but small businesses often have processes that have been working quietly for years. Sometimes nobody thinks to mention one because it has become such a normal part of the day. In this case, keeping the old environment available during the transition also meant I still had a way to retrieve those files while we corrected the workflow.
The VPN Was No Longer Necessary for Normal Work
One of the most noticeable changes for employees working outside the office was what happened to the VPN.
In the earlier Huntzberry Civil Construction field technology project, the VPN served a real purpose. B2W and other resources lived behind the office network, so employees needed a secure way to connect back to them. Once B2W moved to the cloud and the shared company information moved into Microsoft 365, those employees no longer needed to route their normal work back through the office just to reach the resources they used every day.
For Huntzberry Civil Construction, that meant the VPN could go away for normal day to day work. Field and remote employees could access the cloud services they were authorized to use directly instead of first establishing a connection back to the office.
This is exactly the type of situation I discuss in Is Your Business Still Using SSL VPN?. A VPN is not automatically wrong simply because a business is modernizing. The question is what employees are still using it to reach. If the applications and files that originally required that connection no longer live in the office, it is worth reviewing whether the workflow still makes sense.
Removing the everyday VPN requirement did not mean I wanted company information available from any computer simply because someone knew a username and password. Moving away from a network centered environment gave me an opportunity to move more of the security toward the user's identity and the device they were actually using.
I configured Conditional Access policies to help control access to the Microsoft environment, including requirements around device compliance. These controls are part of the broader Microsoft 365 configuration I discuss in Microsoft 365 Security for Small Business. The idea is that access should not be based only on whether somebody can enter the correct password. The identity, authentication method, device and other conditions can all be part of the decision.
I also configured access around the company's normal US based operations. When an employee legitimately travels internationally, I can make the appropriate temporary exception and remove it when the trip is over. I have already had to do that, and it is a good example of why Microsoft 365 still needs ongoing management after the initial setup. Business needs change, employees travel, applications change and Microsoft changes. Policies that made sense when they were created still need to be reviewed and maintained.
Older authentication methods were reviewed as well. Because I knew what applications and devices the employees were actually using, I could remove methods they no longer needed instead of leaving older access available indefinitely simply because it had always been there.
For me, the goal was not to make working outside the office more difficult. It was to make it easier for the right employee using the right device to work where the business needed them, while still keeping controls around access to company information.
I Also Reviewed What Else Had Access to Microsoft 365
Users are not the only identities that can have access to company information. Applications can have access too.
As part of the Microsoft 365 work, I reviewed third party and enterprise application access that had accumulated in the tenant over time. I found older access that was no longer necessary and removed it rather than allowing permissions to remain simply because an application had been connected at some point in the past.
I also wanted better control over what could be authorized in the future. I configured the environment so applications requiring organizational access can go through administrative review rather than employees simply approving access without anyone looking at what the application is requesting.
That does not mean I consider third party applications a problem. Huntzberry Civil Construction uses third party applications throughout the business. What matters is whether an application has a legitimate business purpose, what it is requesting access to and whether somebody has actually reviewed that access.
That distinction became even more important later when Huntzberry Civil Construction wanted to introduce Claude Teams. In that case there was a legitimate reason to integrate another platform with Microsoft 365, so I could configure and test that connection deliberately instead of introducing AI into an environment where application access had never been reviewed.
I Also Planned for Losing Normal Administrative Access
Tightening Microsoft 365 security creates another responsibility. I need to know what happens if normal administrative access ever stops working.
I configured dedicated emergency access using Microsoft's recommended approach and protected that access with phishing resistant hardware security keys. It is separated from normal administrative use and exists specifically for a situation where the normal path into the Microsoft environment is unavailable.
I am deliberately not describing Huntzberry Civil Construction's exact recovery procedure, account configuration or how recovery information is secured. That belongs in the company's private IT documentation, not in a public article.
This is preparation I hope Huntzberry Civil Construction never needs, but it is something I would much rather have in place before an emergency than try to create during one.
I Did Not Retire the Servers Until I Was Sure We Were Finished With Them
The servers did not get wiped the moment employees began working from SharePoint.
I kept them available while I confirmed that the applications had transitioned successfully, the files were where they belonged, employees could work from the new environment and there were no remaining processes quietly depending on the old infrastructure. Finding the scanner workflow was a good example of why I wanted that validation period.
Only after I was satisfied that Huntzberry Civil Construction was operating successfully without the servers did I move into final decommissioning. Because those systems had stored years of business information, the storage was sanitized using a process aligned with current NIST media sanitization guidance rather than simply deleting the files and assuming the information was gone.
Moving information somewhere new does not remove the responsibility to properly handle the copies that existed somewhere old.
Moving to Microsoft 365 Did Not End the Backup Conversation
After the company information was moved into Microsoft 365, I talked with Huntzberry Civil Construction about what they wanted backup and recovery to look like going forward.
Microsoft 365 has native resilience and recovery capabilities, so I do not describe this as Microsoft having no way to recover information. The question was whether Huntzberry Civil Construction wanted an additional backup solution as part of its overall recovery strategy.
I presented several options, including the Microsoft 365 backup solution available through SNL-Tech Services. I walked through the choices and costs and let Huntzberry Civil Construction decide which approach made the most sense for them. They chose the SNL-Tech Services solution, and the Microsoft 365 environment is now backed up as part of the managed environment.
I go deeper into that distinction in Microsoft 365 Backup for Small Business because native Microsoft 365 recovery features and a separate backup strategy are related, but they are not necessarily the same thing. The right answer depends on what the business expects to be able to recover and how it wants that recovery handled.
I think the decision process is important. My role is to explain the risk, the options and the tradeoffs so the client can make an informed decision. The fact that I offer a particular solution does not mean it should automatically be the only option presented.
Some of the Smaller Changes Have Taken More Adjustment
Not every challenge in this project involved servers, Microsoft 365 or a major migration.
One of the later changes was introducing a dedicated password manager. I was not comfortable with business passwords being stored in browser password managers that could potentially be associated with employees' personal accounts, so we implemented a separate password management solution and I provided instructions to help everyone start using it.
That has probably been one of the harder changes for the team to adopt. I joke with them that one day I may just use policy to turn browser password saving off, which I can do, but I would rather give everyone time to get comfortable using the password manager correctly than force the change abruptly just because the technology gives me the ability to do it.
We went through a similar decision process when the company needed professional PDF software. I researched several options and gave the team choices to review rather than deciding for them which product they had to use. Huntzberry Civil Construction ultimately selected Foxit PDF Editor.
Those may seem like relatively small decisions compared with replacing servers, but they are part of managing the environment too. Technology still has to work for the people who use it every day.
The Foundation Made the Next AI Project Much Easier
Roughly six months later, the next significant technology project was something that had not been part of the original server migration plan at all.
Huntzberry Civil Construction wanted to begin using Claude Teams.
By that point, however, I was introducing AI into a very different environment than the one I had started with. The company information had already been reorganized into SharePoint. Users had managed Microsoft identities. Security groups controlled access to company information. Computers were managed through Intune. Conditional Access policies were already in place, and third-party application access was something I could review and manage.
There was still backend work required to configure the Microsoft 365 integration and test how Claude Teams would interact with the environment, and I wrote about that project separately in How I Set Up Claude Teams for a Small Business Safely. The difference was that the foundation underneath the AI project already existed.
That matters because I do not think responsible AI adoption starts with choosing an AI product. Before connecting AI to business information, I want to understand where that information lives, who already has access to it, whether the permissions make sense and how the new application will be authorized. That is also the broader issue behind Can You Trust AI With Your Business Data? It's the Wrong Question. The more useful question is what information the AI can reach, why it has that access and what controls exist around it.
AI governance is also becoming part of the broader business risk conversation. I cover some of that relationship in AI Governance, Small Business and Cyber Insurance, particularly for businesses beginning to connect AI tools to company systems and data.
The work we had already completed for Huntzberry Civil Construction made those questions much easier to answer.
Now the Business Is Changing Again
The Huntzberry Civil Construction technology story is still evolving because the company itself is changing again.
The business is currently going through a rebrand. That means I am preparing another set of changes behind the scenes, including the Microsoft 365 domain configuration and email aliases needed for the company's updated identity. I maintain a checklist for the remaining systems and configurations that need to change when the rebrand reaches its cutover point so we are not relying on memory to remember every place the old identity exists.
Claude Teams is part of that planning as well. I have already started preparing the backend requirements for single sign on so the AI platform can eventually follow the same managed identity approach used elsewhere in the environment.
This is why I do not really look at the Huntzberry Civil Construction project as a cloud migration that started and then ended. The major migration ended, but managing the technology did not. The company has continued to grow and change, and the environment we built gives me a much better foundation for adapting the technology as those changes happen.
Huntzberry Civil Construction Before and After
Earlier Environment | Current Direction |
B2W depended on on premises infrastructure | B2W moved to Trimble's cloud platform |
QuickBooks depended on an aging server | New cloud based billing workflow integrated with the Trimble environment |
HR depended on the previous business workflow | BambooHR cloud platform |
Local Active Directory | Microsoft Entra ID |
Traditional file server | Organized SharePoint environment |
Active Directory file permissions | Entra ID security groups controlling access |
Mapped server drives | Appropriate SharePoint resources automatically available through File Explorer |
User files stored in different locations | Managed OneDrive configuration for employee work files |
Employees depended on office hosted resources | Cloud services available directly from appropriate managed devices |
VPN required for normal remote access | Normal cloud work no longer depends on the office VPN |
Office network was a major security boundary | Identity, device compliance and Conditional Access help control access |
Older third-party application access remained | Application access reviewed and administrative approval introduced |
Traditional domain-joined computers | Microsoft Entra ID joined and Intune managed computers |
Endpoint settings varied more by machine | Centralized encryption, authentication and update policies |
Aging hardware remained in service | Computers reviewed individually and replaced or repurposed where appropriate |
Microsoft 365 backup strategy needed to be decided | Additional managed Microsoft 365 backup implemented |
AI was not part of the original environment | Claude Teams introduced after the Microsoft 365 foundation was established |
Huntzberry Brothers business identity | Systems being prepared for the Huntzberry Civil Construction rebrand |
What I Think Other Small Businesses Can Take From This
The lesson I take from this project is not that every small business should get rid of its servers or move everything into Microsoft 365. There are businesses with applications, specialized data or workflows that still make on-premises or hybrid infrastructure the better choice. Even at Huntzberry Civil Construction, I found data and computers that did not fit neatly into the standard migration plan and had to be handled differently.
What I think businesses should do is periodically look at why they are maintaining the technology they have. If a server exists primarily because an application needed it years ago, does that application still need it? If employees connect to a VPN every morning, what are they actually connecting back to? If the company is preparing to move years of files, is there an opportunity to clean up the organization and permissions before carrying all of that history somewhere new? If employees can work from almost anywhere, what determines whether the person, device and application requesting access should actually be trusted?
Huntzberry Civil Construction's answers eventually led to a cloud-first environment, but we did not get there by changing everything at once. I first had to understand the applications, computers, files, permissions and connectivity the business already had. The destination was built and tested before the employee computers were moved. Applications were transitioned in stages, employees began working from SharePoint before their PCs were migrated, and the old servers remained available until I was confident nothing important still depended on them.
I also tried to keep the employee experience in mind throughout the project. The technology underneath their files changed considerably, but employees could still open File Explorer and find the company information they were authorized to use. OneDrive could sign in automatically, the appropriate SharePoint resources could appear without employees manually connecting them, and normal remote work no longer required them to remember to connect a VPN first.
That is one of the biggest changes from the earlier project I completed with Huntzberry Civil Construction. Back then, the challenge was figuring out how to securely extend the office to employees working in the field. Today, much of their work no longer has to come back through the office in the first place.
The servers going away were certainly part of the project, but they were never really the point. The bigger change was building an environment that better fits how Huntzberry Civil Construction works now and gives the company room to keep changing.
SNL-Tech Services Resources
If you are considering a similar technology change for your business, these resources go deeper into several of the decisions that came up during the Huntzberry Civil Construction project:
Additional Resources
Microsoft Learn: OneDrive Policies and Automatic SharePoint Library Synchronization
Microsoft's current guidance covers silent OneDrive sign in through managed Windows devices and automatic synchronization of specified SharePoint team site libraries through OneDrive. Microsoft OneDrive policy documentation
Microsoft Learn: Conditional Access and Intune Device Compliance
Microsoft documents how Intune device compliance can be used as a signal when Conditional Access decides whether a device should be allowed to reach company resources. Microsoft Conditional Access documentation
Microsoft Learn: Admin Consent Workflow
Microsoft's admin consent workflow allows users to request access to applications that require organizational approval while keeping the final approval with an authorized administrator. Microsoft admin consent workflow documentation
Microsoft Learn: Emergency Access Accounts
Microsoft's current guidance covers maintaining dedicated emergency administrative access, phishing resistant authentication, Conditional Access considerations, monitoring and periodic validation. Microsoft emergency access guidance
NIST SP 800-88 Revision 2: Guidelines for Media Sanitization
The current NIST publication provides guidance for sanitizing storage media before disposal or reuse. Revision 2 became final in September 2025 and superseded Revision 1. NIST SP 800-88 Revision 2
Starlink Business
Starlink provides business connectivity options for locations where traditional connectivity choices may be limited.Starlink Business
Comments