Arizona Department of Education boosts backup capability, compliance, and data privacy on a tight budget with Azure BCDR

Unlike some well-funded corporate entities, Block and Henry must fight for and maximize every penny. “We submit our requests to the Governor’s office for the annual budget, and we often don’t get anything new,” says Henry. “We’re working on a pretty static budget for our fourth or fifth year.” Block adds, “We treat every dollar like it came out of our own wallet.”

A wise investment in innovation: AzEDS

One of the things that ADE spent its money on was developing a new data management system: Arizona Education Data Standards (AzEDS). Built on Azure, AzEDS was developed to automate and consolidate student data tracking and reporting to help manage the thousands of data points that every school in Arizona is required to collect. AzEDS is the first of its kind in the nation and has since become a model for other school districts across the country. The system processes millions of daily transactions from multiple information systems spanning the state’s 650 districts. ADE collects and processes the data for a variety of purposes, including the annual distribution and management of $6.5 billion in school funding. 

Migration on a fast track: Arizona’s Cloud First Policy

In 2019, Arizona instituted a Cloud First Policy initiative for all of its approximately 200 departments, with a goal of getting out of datacenters managed and owned by the state and moving as much compute capacity as possible into the cloud. Block was already working on the AzEDS platform, and the initiative kicked the overall ADE cloud migration efforts into high gear.

Based on Azure, AzEDS allows ADE to align its infrastructure to the state’s Cloud First Policy initiative. “We now power an operational data store, support 30 different business unit data needs, and continuously update security to map to National Institute of Standards and Technology and other federal security guidelines,” says Block. “We’ve achieved sustained success regarding data stewardship and implementation.”

The evolution can only be described as transformative. The process has evolved from manual spreadsheet management of millions of records every 20 days to real-time data submission and daily calculation updates using Azure App Service and Azure Functions.

ADE leaps ahead with Azure migration

The ADE IT team has since made great strides in its large-scale migration to Azure. “When you don’t have a budget, you end up hanging on to hardware until it dies,” relates Block. “A nice side effect of moving to Azure is that we don’t have to maintain the technological churn, so the team consolidated a bunch of servers.” From its previous infrastructure environment that only a few years ago was completely on-premises, ADE reduced its datacenter footprint from ten 52-unit racks to just 38 units total, and it migrated 113 applications from standard web servers to App Service. Business continuity and disaster recovery (BCDR) is a critical element for the IT team, and with partner Veeam® Software, ADE implemented a new backup infrastructure that natively backs up to Azure Blob Storage. 

The ADE team also used Azure capabilities such as Azure DevOps Server to help streamline ongoing development tasks, experiencing greater resilience and reliability while increasing speed of delivery and scale. “Continuous integration and continuous development delivery is easier now that we have all of our tools in Azure,” says Henry. “We use Azure DevOps Server so that we easily integrate with Azure when we deploy into App Service.”

The ongoing challenge of cybersecurity

With cybersecurity challenges and ransomware attacks coming at a furious pace, protecting AzEDS is a top priority. “Education is a target right now,” says Henry. “Funding information and a lot of material that we have on students, parents, and schools—it’s a data gold mine.” A focus on Zero Trust and closed systems is an area that ADE takes further than the state requirements. “We block all traffic from outside of the United States from our Microsoft 365 environment, Azure, and our local datacenter,” says Henry. “I don’t allow anything exposed to the internet on my lower dev environments, and even with the production environments, we take extra care to make sure that we use a network security group to protect the app services.”

The older elements in ADE’s environment, such as early 2000s SQL infrastructure, also present security challenges. “Until our earlier infrastructure gets rewritten and moved over, we have no choice but to support it as-is. And not only support it, but secure it,” says Henry. He also points out that the organization will never be 100 percent in the cloud. “It’s against best practices because you always want to have a physical domain controller. That’s just one of Microsoft’s best practices. But it’s a goal to have as much as possible in the cloud.”

The AzEDS deployment has also presented other BCDR challenges for Block and Henry. Applications and infrastructure components that support identity, data, and operational services must remain on-premises, and the IT team faced issues with physical backups where native Azure backup wasn’t an option. The legacy data protection process was slow and unreliable, requiring complicated custom implementations.

Another challenge arose for ADE around Arizona’s law mandating long-term retention of public information. “We have a very heavy presence not only in Azure, but also in Microsoft 365,” notes Block. “We went all in on Microsoft Teams, moved everything to SharePoint Online, and got everybody on OneDrive.” However, Microsoft’s data retention policy didn’t align with ADE’s requirements, which necessitated long-term and complete control of the Microsoft 365 data.

Veeam partnership helps ensure BCDR

Henry turned to Veeam Software, which provides innovative backup, recovery, and data management solutions, and it has since become a key partner for ADE’s BCDR strategies. “I knew that Veeam was able to write directly to Blob Storage, and this was a primary driver that prompted our adoption.” ADE’s old backup system required partner implementations to write to it directly, but Henry then found out that Veeam had released Veeam Backup for Microsoft 365. “Now I could solve two problems with one solution,” he says.

ADE uses Veeam Backup & Replication with its on-premises storage area network capacity and with Blob Storage for its cloud-based services, both of which support BCDR efforts. “We find real value in how easily Veeam integrates with the Azure platform and with multitiered Blob Storage,” says Henry. Another big plus of Veeam’s partnership with ADE is immutable backups. “Veeam’s ability to work with Blob Storage is really powerful,” says Henry. “We have immutable backups coming from Veeam and immutable storage in Azure—both working in tandem protect our business continuity and data recovery.”

Block sums up ADE’s cloud journey. “As a state agency, we’re budget constrained in a time of rapid change and development. Navigating this is easy with Azure because the costs are very transparent, and the cost controls are straightforward,” he says. “Our Azure story is really one of increasing efficiency—we’re able to do so much more now with the same budget and the same staff.”

Find out more about the Arizona Department of Education on Twitter, Facebook, and LinkedIn.