SaaS datacenter migration, as SQL SME
Served as subject-matter expert and lead engineer from the SQL team on the datacenter migration for Expesite, supporting production systems across both public and private cloud throughout the transition.
Ziyad Uqdah
Senior Systems Engineer | Cloud, Data Platforms & Analytics | DevOps, Migrations & Integrations
Nineteen-plus years across systems administration, infrastructure engineering, and cloud architecture. For the last four I have been the escalation point for Microsoft Premier Support customers — inside other organisations' Azure, SQL Server, and hybrid estates at the moment they fail — and the labs on this page are where I keep the build work current. I work on the parts of a migration that carry real risk: estate discovery, wave planning, cutover, and recovery that has been tested rather than assumed.
New Orleans, LA
Open to remote & hybrid
19+ years in the field
B.S. Information Technology
19+Years across systems, infrastructure, and cloud engineering
LabsPublished labs, each measured against the live platform it is about
SMEOn the SQL team for a production SaaS datacenter migration
What I build
Six areas, each with the work to show for it
Migrations rarely fail on the technology. They fail on the dependency nobody mapped, the runbook nobody tested, and the cutover window that turned out to be four hours shorter than it needed to be. These are the areas I have spent a career in — and under each one, a lab built and measured against the live platform rather than described.
01
Cloud & hybrid architecture
Azure landing zones, hybrid connectivity, and identity integration designed so the foundation is reproducible rather than a set of portal clicks nobody can repeat.
Proven in
azure-agent-landing-zoneA Terraform landing zone deployed by GitHub Actions with no stored cloud credentials — every hop on managed identity, spend bounded by design.
entra-cutover-without-lockoutConditional Access evaluated against a declared sign-in matrix before enforcement: 7 of 7 scenarios as declared, 0 lockouts.
least-privilege-provenRBAC in Terraform, then each identity signs in and attempts what it must not. The pipeline fails if anything succeeds.
02
Migrations & cutover
Moving real estates, not lab samples. Dependency mapping, wave planning, rehost-versus-replatform calls, a pilot wave before the fleet, and a rollback path worth using.
Proven in
sql-migration-with-rollbackRefuses a source that is not migratable, proves parity by content checksum rather than row count, and restores the rollback to show it works.
before-the-first-syncEverything that has to be right before a forest syncs to Entra ID, checked against a real forest built from scratch and torn down in the same job.
03
Data platforms & analytics
SQL Server upgrades and platform transitions with performance baselines captured before and after, plus the warehouse and analytics layer on top — and the ways it quietly stops being trustworthy.
Proven in
the-database-was-not-busyAn Azure SQL database held at 98% of its log-write ceiling while reporting 8% CPU. The throttled workload was the fastest of the three.
queries-that-quietly-fell-backA Direct Lake model that silently fell back to DirectQuery, and the one API able to detect it cannot be put in a pipeline.
the-rows-that-failed-and-loaded-anywayA Databricks pipeline declared two constraints, reported COMPLETED, and loaded all 340 rows that broke them.
04
DevOps & automation
Release gates that have been tested rather than trusted, baselines declared as data, and idempotence measured against the host — so the second run genuinely changes nothing.
Proven in
pipelines-that-refuseBranch policies, review rules and environment approvals with every bypass attempted for real against a live project, and graded.
the-second-run-changed-nothingAnsible idempotence measured against a host fingerprint, because changed=0 is wrong in both directions.
windows-baseline-automationA legacy hardening script turned into a tested module that audits, remediates only drift, and supports -WhatIf — with no RDP and no credentials on the wire.
05
Integrations & resilience
Message pipelines built for the failure at 2am, and DR designed against the SLA, RTO, and RPO actually committed to in customer contracts — with runbooks someone other than the author can execute.
Proven in
integration-that-survives-failureDuplicate delivery, poison messages and a consumer dying mid-work, each provoked and survived against a real Service Bus namespace.
disaster-recovery-actually-failed-overA cross-region failover with recovery time measured from the first failed write and data loss counted, not quoted — graded against the objectives the plan claims.
06
AI platforms & low-code governance
Agents that call real tools and cannot change anything without a person approving it, and low-code products treated as source — with a diff, a review, and a promotion path that says what it will change first.
Proven in
agentic-ops-copilotAn agent that investigates Azure through an MCP server and cannot change anything without a human approving it. The model never approves its own actions.
self-healing-aiopsAn agent diagnoses, policy — not the model — decides whether the fix may run unattended, and every incident is measured in time-to-recovery and dollars.
copilot-studio-almA Copilot Studio agent kept as source in git and promoted dev to prod by a script that reports what it will change before it changes it.
the-import-said-successA managed Power Platform import that reports success, advances the version, and changes nothing — the hand edit in the target wins.
Selected impact
Work with a deadline and consequences attached
A shortlist of engagements where the outcome was measurable and the failure mode was public.
A DR runbook written against real numbers
Authored the disaster recovery runbook and method of procedure for Expesite, built against the product's actual SLA, RTO, and RPO commitments rather than aspirational targets — then maintained the plan and ran regular tests against it.
SQL Server 2016 → 2019 platform upgrade
Led the version upgrade for SaaS application Lucernex, alongside building and maintaining multi-layered redundant production environments sized to meet committed SLAs.
Azure hybrid cloud across a regulated enterprise
Designed, integrated, and implemented a Microsoft Azure hybrid cloud solution enterprise-wide at a bank — running alongside core banking platforms from FIS, Fiserv, Finastra, Banker's Toolbox, and Ellie Mae.
Space Launch System program infrastructure
Supported Boeing's SLS program at NASA MAF: VPN and network connectivity, certificate, token, and smart card access, and a fleet-wide replacement of VMware ESX 6.0 hosts with 6.5 across the datacenter.
Full virtualization of a hosting estate
Ran hosting infrastructure at a peak of roughly 300 domains, 150 websites, and 6,000 mailboxes — and virtualized every last physical server on the network.
Professional experience
Nineteen years, told in order
From Tier 2 network support to senior escalation engineering for Microsoft Premier customers — with datacenter, banking, aerospace, and SaaS environments in between.
Senior Microsoft Systems Engineer, Premier Support — US Cloud
Dec 2023 — PresentSt. Louis, MO · Remote
- Serve as a primary escalation point for expert-level Microsoft technology tickets, resolving advanced issues across cloud and on-premises environments.
- Sit on the hiring panel for the Data Platforms & Analytics and BST teams, and author the technical interview questions used across the hiring process.
- Mentor and cross-train Associate and Premier Support Engineers through shadowing, knowledge-sharing, and structured onboarding, building a team resilient to absence in critical processes.
- Author and maintain Knowledge Base articles that reduce resolution time for recurring escalations, and lead process adherence and service-delivery practice for the pod — including QA improvements to automated escalation workflows.
Microsoft Systems Engineer, Premier Support — US Cloud
Dec 2021 — Dec 2023St. Louis, MO · Remote
- Delivered client-facing technical guidance across Microsoft cloud and on-premises solutions, supporting cloud-first deployment strategies.
- Supported clients through new deployments and migrations, resolving technical issues that could affect go-live timelines.
- Reduced ticket onboarding and resolution time through high-quality case data and proactive account management.
- Named Engineer of the Month, December 2022 — peer-nominated, one recipient monthly; promoted to Senior Systems Engineer, December 2023.
Systems Engineer, Cloud Operations — Accruent
Dec 2018 — Dec 2021New Orleans, LA · Hybrid
- Served as SME and lead engineer from the SQL team on the datacenter migration for SaaS application Expesite, supporting production systems across public and private cloud.
- Authored the disaster recovery runbook and method of procedure for Expesite based on product SLAs, RTO, and RPO targets, and performed regular tests against it.
- Led the SQL Server 2016 to 2019 upgrade for SaaS application Lucernex.
- Built and maintained redundant production environments to meet committed SLAs, using configuration management tooling to build and scale application environments.
- Developed automation scripts to reduce manual configuration work, and planned capacity expansion across the customer-facing estate.
- Won the Accruent CloudOps C.H.A.M.P.I.O.N. award, Q1 2020 — peer-nominated, one recipient per quarter.
System Administrator II — Fidelity Bank LA
Dec 2017 — Dec 2018Greater New Orleans Area
- Designed, integrated, and implemented a Microsoft Azure hybrid cloud solution across the Fidelity enterprise.
- Deployed ConnectWise Manage and ConnectWise Automate enterprise-wide.
- Managed Hyper-V, VMware, and Azure infrastructure, storage networks, physical servers, and multiple colocation spaces.
- Maintained backup and replication infrastructure across Veeam, Doubletake, and TierPoint/LiveVault cloud backup, including disaster recovery planning against multiple replication targets.
- Administered core banking and financial services applications — FIS, Fiserv, Finastra, Banker's Toolbox, and Ellie Mae — alongside Microsoft 365, Active Directory, Azure AD, SQL Server, SolarWinds NPM, IBM MaaS360, and KACE.
IT Specialist IV — All Points Logistics (Boeing contract)
Aug 2017 — May 2018New Orleans, LA
Concurrent contract engagement alongside the Fidelity Bank role above.
- Supported Boeing's Space Launch System (SLS) program at NASA's Michoud Assembly Facility, troubleshooting NASA and Boeing VPN and network connectivity and managing certificate, token, and smart card access for Boeing employees.
- Migrated NASA switch ports to Boeing VLANs and moved workstation block points to Boeing's network standard.
- Replaced VMware ESX 6.0 hosts with ESX 6.5 across the Boeing MAF datacenter.
- Configured and supported video teleconferencing hardware and sessions, imaged and hardened Boeing laptops, and handled offsite backup tape rotation for the MAF datacenter.
Earlier roles, 2007 to 2017 · select one to expand
Senior Network Administrator — Merchants FoodserviceHattiesburg, MS · Sep 2016 — Aug 2017
- Managed cloud and physical VMware infrastructure, storage networks, and Windows servers supporting the full company enterprise.
- Maintained network infrastructure across switches, routers, firewalls, VoIP, web content filtering, multiple internet circuits, MPLS WAN links, and datacenter colocation space.
- Administered Citrix XenApp, Honeywell VoCollect, Exchange, SQL Server, and Active Directory.
- Installed and configured CentOS 7 servers and open-source tooling, including Nagios Core, MediaWiki, and WordPress.
- Decommissioned legacy systems — ManageEngine OpsManager, SharePoint, and GS1 Imaging — as part of infrastructure consolidation.
System Administrator I — C SpireHattiesburg, MS · Oct 2014 — Sep 2016
- Migrated MegaGate systems — file shares, backups, workstations, applications, and servers — into the C Spire enterprise following acquisition, and decommissioned the legacy systems left behind.
- Managed multi-site VMware vCenter and ESX infrastructure, and administered Exchange, Active Directory, Nagios Core, KACE, and Edgewave iPrism.
- Maintained MegaGate datacenter facility operations, including vendor maintenance scheduling, generator load testing, cabling, and colocation customer support.
Systems Administrator — MegaGate BroadbandHattiesburg, MS · Aug 2012 — Oct 2014
- Managed web and email hosting platforms at a peak scale of roughly 300 hosted domains, 150 websites, and 6,000 mailboxes across Plesk, Surgemail, and Edgewave spam filtering.
- Virtualized every last physical server on the network.
- Administered VMware infrastructure, storage, and Windows and Unix systems including MySQL, SQL Server, BIND, Apache, IIS, Nagios XI, MRTG, and Ubiquiti AirControl and UniFi.
- Managed corporate firewall VPN access over RADIUS, the server public network firewall, and the full backup estate — VM, file-level, and telecom equipment backups, offsite replication, and DR planning.
- Maintained datacenter facility systems including diesel and propane generators, environmental monitoring, and equipment racking and cabling.
Network Support Specialist — MegaGate BroadbandHattiesburg, MS · Aug 2010 — Aug 2012
- Delivered Tier 2 technical support for network engineering and systems administration teams across Metro Ethernet, T1, DSL, VoIP, and web and email hosting products.
- Managed ITaaS client services including turnkey server deployments, hardware and software support, and LAN, WAN, and internet troubleshooting.
- Promoted to Systems Administrator, August 2012.
IT Support Technician — Pine Belt Mental Healthcare ResourcesHattiesburg, MS · Aug 2009 — Aug 2010
- Migrated all production systems and equipment to the corporate office datacenter.
- Maintained Exchange and Plesk email servers and Active Directory for agency operations.
Network Technician — Service Management GroupHattiesburg, MS · Jan 2007 — Jan 2009
- Managed server and network infrastructure, workstations, and datacenter colocation space.
- Automated manual server processes using VBScript and batch scripting.
- Contributed to a development team building a SQL-database-backed web application for archiving user-uploaded video content.
- Administered SQL Server and Active Directory, and made .NET and ASP code changes to homegrown company applications.
What this looks like in practice
Six things you might need, and what I would actually do
Every scenario below links to working code that proves the claim — infrastructure-as-code, tests, and a written account of what the build got wrong before it got it right. Ask the assistant at the bottom of this section if you want to dig into any of them.
Proven
“We need to migrate this database, and we need to be able to go back.”
A pre-flight assessment that blocks the migration if the schema will not survive it, then parity proven by content checksum rather than row count — because two tables with the same number of rows can still differ. The rollback is restored and verified in a drill, not documented and hoped for.
SQL ServerAzure SQLTerraformPester
Proven
“Our DR plan says four hours. Is that true?”
Almost certainly not, because the clock usually starts when somebody runs the failover command — which excludes detection and decision, the part of an outage that is actually longest. I fail the estate over for real and time it from the first failed write, then count data loss by comparing what the old primary acknowledged against what survived.
Azure SQLFailover groupsRTO/RPORunbooks
Proven
“We are about to turn on Conditional Access and we are nervous.”
Rightly so — it is the one control that can lock you out of the thing you would use to undo it. Policies deploy report-only and get evaluated against a declared matrix of sign-ins before anything is enforced, including a check that the break-glass accounts can still reach a recovery surface. Promotion is something the evaluation has to earn.
Entra IDConditional AccessGraph APITerraform
Proven
“We acquired a company and now we have two directories.”
The work that decides whether the cutover goes well happens weeks earlier, in the objects: namespaces that cannot be verified, two people holding the same address in different letter case, a disabled leaver holding the sign-in name a new starter needs. I assess that against the live directory, and I check the filter change that silently deletes accounts in the cloud rather than disabling them.
Active DirectoryEntra IDPowerShellMigration
Proven
“Show us that our access model is actually least privilege.”
Not by reading role assignments — by signing in as each identity and attempting what it is supposed to be refused. The analysis is written to avoid the false positives that make these reports unreadable: an account excluded from a policy by group membership is not a finding, and neither is the break-glass account that is meant to hold standing privilege.
Azure RBACABAC conditionsOIDCDrift detection
Proven
“Our integration loses messages and we cannot reproduce it.”
Then it needs to be tested against the failures that actually happen: the same message delivered twice, a poison message that must not block the queue behind it, two consumers racing for the same work, and a replay path that repairs what it understands and refuses what it does not. At-least-once delivery is a contract, and most code assumes exactly-once.
Service BusIdempotencyDead-letterPython
Labs & projects
Built in the lab, not just on the slide
Production experience is the record. These are the environments I stand up on my own time to keep the reference architectures current — and to have something to point at rather than describe. Each one is described under the specialty it proves, above; this is the full list, most recently updated first.
Published labs appear here automatically as each build lands on GitHub — every repository ships with its architecture diagram, infrastructure-as-code, and a written summary of what was proven.
Technical depth
The stack behind the work
Cloud & virtualization
AzureAWSGCPVMwareHyper-V
Databases & data platforms
SQL ServerAzure SQLPostgreSQLMySQLSnowflakeDatabricks
BI, analytics & automation
Power BIPower PlatformMicrosoft Fabric
Email & collaboration
ExchangeMicrosoft 365Entra IDPleskSurgemail
Automation & DevOps
PowerShellBashBatchCI/CDTerraform
Datacenter & disaster recovery
Backup & DR planningReplicationColocation managementCapacity planning
Identity, directory & OS
Active DirectoryEntra ID / Azure ADHybrid identityWindows ServerLinux
Education & honors
Credentials
Bachelor of Science, Information Technology
Franklin University · 2017
Associate of Arts and Sciences, Computer Information Systems & Technology
Jones County Junior College · 2007
President's List, Franklin University
CSEMS Scholarship Recipient
Francis T. Edwards Award for Scholastic Achievement
Engineer of the Month, US Cloud (Dec 2022)
Accruent CloudOps C.H.A.M.P.I.O.N., Q1 2020
Get in touch
Open to senior cloud, data platform and DevOps engineering roles.
If you are planning a migration, modernizing a data platform, or trying to find out whether your disaster recovery plan would survive being run — that is the conversation I am good at. Reply time is within one business day, in writing.