On-Premises PCE to SaaS Migration

The On-Premise PCE > SaaS Migration package moves a customer's existing Illumio deployment from an on-premise Policy Compute Engine to the Illumio SaaS platform while keeping its segmentation configuration and VEN-managed workloads intact.

Moving to SaaS removes the work of running, upgrading, and maintaining PCE infrastructure. The move itself still needs care. Labels, IP Lists, rulesets, security policies, and integrations all have to arrive correctly, and every VEN-managed workload has to reconnect and synchronize with the new PCE. If configuration is missed or a workload doesn't reconnect, protection can lapse during the cutover.

Illumio Professional Services handles the migration in three phases:

Preparation. PS reviews the existing PCE configuration, workloads and VENs, labels, IP Lists, rulesets, security policies, and integrations such as SIEM and SAML. PS checks that PCE and VEN versions meet migration requirements, identifies unsupported configurations and potential issues, and runs a dry run to find and resolve errors before the real cutover. Cutover. PS uses the Illumio PCE Migration Tool to move the required objects to the SaaS PCE, then migrates the VEN-managed workloads and monitors connectivity and policy synchronization as they move. Validation. PS confirms that workloads are connected and synchronized with the SaaS PCE and that labels, IP Lists, rulesets, and security policies migrated correctly, then reviews the environment with the customer.

When the engagement is complete, the customer is running on the Illumio SaaS platform with its configuration, policy, and workloads migrated and validated.

Package Dependencies

• None  

Strongly Recommended Packages

• Health Check, to identify configuration issues before migration  

Optional Supporting Packages

• Add-On – Additional PCE Migration Window, where more migration windows are needed than the package includes  

Technical Readiness

• Operational on-premise PCE
• SaaS PCE organization provisioned
• PCE and VEN versions that meet migration requirements, or a plan to upgrade them before migration
• Network connectivity from VEN-managed workloads to the SaaS PCE
• Administrative access to the on-premise PCE and the SaaS PCE for Illumio Professional Services
• Details for SIEM, SAML/SSO, and other integrations that must be set up on the SaaS PCE  

Customer Readiness

• Project manager or primary point of contact assigned
• Migration windows and change approvals identified
• Platform, network, and integration administrators available
• Critical workloads and application owners identified

Migration Readiness Review

• Review the existing PCE configuration.
• Review workloads and VENs, labels, IP Lists, rulesets, and security policies.
• Review integrations such as SIEM and SAML that need to be set up on the SaaS PCE before cutover.
• Check PCE and VEN versions against migration requirements.
• Identify unsupported configurations, objects that need cleanup, and potential migration issues.
• Document readiness findings and the actions required before cutover.

Customer Outcome

The customer knows what will migrate, what has to change first, and what risks need to be addressed before cutover.

Dry Run and Pre-Migration Preparation

• Perform a dry run of the migration to find errors before cutover.
• Resolve migration errors identified during the dry run.
• Clean up objects as needed to support a successful migration.
• Confirm that integrations needed at cutover are ready on the SaaS PCE.
• Agree the cutover plan, migration windows, workload migration order, and rollback approach with customer stakeholders.

Customer Outcome

The environment is prepared and tested for cutover, which lowers the risk of errors and disruption during the live migration.

Migration Cutover

• Use the Illumio PCE Migration Tool to migrate required objects and configuration from the on-premise PCE to the SaaS PCE.
• Migrate VEN-managed workloads to the SaaS PCE within the agreed migration windows.
• Monitor workload connectivity and synchronization during the migration.
• Address migration, VEN connectivity, and policy synchronization issues as they come up.

Customer Outcome

The customer's configuration and VEN-managed workloads are moved to the SaaS PCE in a controlled, monitored cutover.

Post-Migration Validation and Handoff

• Confirm that migrated workloads are connected and synchronized with the SaaS PCE.
• Confirm that labels, IP Lists, rulesets, and security policies migrated correctly.
• Complete remaining migration issues and cleanup tasks within the package scope.
• Document the migration outcome, including validation results, open items, and any customer follow-up actions.
• Review the migrated environment with the customer to confirm it is stable and working as expected.

Customer Outcome

The customer is running on the Illumio SaaS platform with migrated configuration, policy, and workloads validated.

The delivery schedule is set at project initiation based on:

• Purchased package size
• Number of objects and the state of existing policy
• Number of VEN-managed workloads
• Results of the readiness review and dry run
• Availability of migration windows and change approvals
• Customer staff availability.

Delays in version upgrades, network changes, integration readiness, or change approvals may affect the schedule.

Talk to our Sales team to learn more about Services.

Explore our Professional Services at illumio.com/services/professional-services