Hybrid Cloud Design and Management
Operate connected on-premises and cloud environments as one service landscape.
Design integration, identity, connectivity, monitoring and recovery across hybrid infrastructure.
Discuss this requirement →Start with the environment, risk and required outcome.
Design integration, identity, connectivity, monitoring and recovery across hybrid infrastructure. Namandla Consultants begins with evidence and recommends a proportionate engagement rather than a generic technology package.
Connected expertise for the wider environment.
Clear steps. Visible decisions.
Hybrid cloud is a destination, not a phase
Most writing on hybrid cloud treats it as a temporary state on the way to being fully cloud-based. That framing does not match what South African mid-market estates actually look like or where they are going.
The typical position is a line-of-business application on an on-premises server, Microsoft 365 in cloud, some workloads on AWS or Azure, file storage in a mix of both and identity spanning all of it. That is not a migration halfway done. It is the arrangement that suits the economics, and there is usually no compelling reason to complete a move to full cloud.
Workloads that stay on premises for good reasons: latency-sensitive production systems, applications with licence models that penalise cloud infrastructure, systems certified against specific hardware, operational technology and stable workloads on hardware with life left in it.
Workloads that belong in cloud: email and collaboration, backup targets, development and test, anything with unpredictable demand, and anything that needs to be reachable from anywhere.
A hybrid cloud designed deliberately is a good architecture. A hybrid cloud that happened by accident is a set of disconnected environments with three identity systems and four backup arrangements, and that is the common state.
Hybrid identity
The foundation. Everything else depends on people and services being able to authenticate consistently across both halves.
Directory synchronisation from on-premises Active Directory to Entra ID, with a decided authentication method. Password hash synchronisation is the more resilient choice for most organisations because it survives an on-premises outage. Pass-through authentication keeps validation on premises and creates a dependency on those servers being reachable.
Synchronisation health is a genuine single point of failure and it fails quietly. A sync failing for three weeks presents as new starters unable to sign in and leavers still able to. Monitor sync status, staleness and error count as standing items rather than checking when something breaks.
One identity, one lifecycle. A joiner, mover or leaver process that only touches one directory leaves accounts active in the other. This is the most common finding in a hybrid access review.
Conditional access covering both. Cloud applications governed by conditional access while on-premises applications are reachable with a password alone is a gap, and application proxy or similar publishing closes it.
Connectivity
Site-to-site VPN over the internet is adequate for most mid-market hybrid estates. It is quick to establish and its performance follows the internet path.
Dedicated connectivity, meaning AWS Direct Connect or Azure ExpressRoute, gives predictable performance and lower egress rates. It is worth it where data movement between on-premises and cloud is constant and substantial, and it is over-specified where the traffic is modest.
Bandwidth and egress deserve early attention in South Africa. Moving data out of cloud services is a real cost, and hybrid architectures that move large volumes back and forth produce bills nobody modelled. Where an application on premises reads constantly from a cloud database, or the reverse, the design is fighting the topology.
Resilience. If a business process depends on traffic crossing the boundary, that link is production infrastructure. It needs a second path and tested failover, per multi-site connectivity.
Consistent management across both halves
The failure mode in hybrid cloud is two of everything: two monitoring systems, two patching processes, two backup arrangements, two sets of documentation. That doubles the operational effort and guarantees the halves drift apart.
One monitoring platform covering on-premises and cloud, with alerting and thresholds set the same way in both.
One patching process. Cloud virtual machines need patching exactly as on-premises ones do, on the same ring structure, per patch and vulnerability management.
One backup position, with recovery objectives set per system regardless of where the system runs. Covered on backup and recovery.
One policy and security baseline. Tools such as Azure Arc extend cloud management planes to on-premises and other-cloud servers, bringing policy, monitoring and update management under one control point. AWS has equivalent capability through Systems Manager. Both are worth evaluating where the on-premises estate is large enough to justify the setup.
One asset and configuration record, covering both. A record that stops at the boundary is a record of half the estate.
Hybrid cloud in South Africa
Three local factors shape the design.
Local regions reduce the friction
AWS Africa (Cape Town) and Azure South Africa North and West mean the cloud half sits in-country, which lowers latency between the halves and simplifies the residency position considerably compared with a European or American region.
POPIA sits across the boundary
Personal information moving between on-premises and cloud, and possibly offshore through backup or logging, needs a mapped position. Hybrid makes this harder to see than a single-location estate, which is a reason to write it down rather than a reason to avoid hybrid.
Connectivity reliability is a design input
Where a business process depends on the link between halves, the design has to assume the link will be unavailable sometimes. That means either local caching and tolerance of disconnection, or genuinely redundant connectivity, decided rather than hoped.
What Namandla delivers
Hybrid assessment
What runs where, how identity spans both, connectivity and its resilience, management consistency, backup coverage and where data actually moves.
Hybrid identity design and remediation
Directory synchronisation, authentication method, sync health monitoring, lifecycle process covering both directories, conditional access across cloud and on-premises applications.
Connectivity design
VPN or dedicated, sized from measured traffic, with resilience.
Consistent management
One monitoring platform, one patching process, one backup position, one policy baseline, one asset record.
Workload placement advice
Which systems belong where, reviewed periodically rather than decided once.
Ongoing operation of both halves under one agreement, per managed IT services.
Onsite work in Gauteng for the on-premises half. Cloud and remote management run nationally.
Common questions about Hybrid Cloud
What is hybrid cloud?
Hybrid cloud means on-premises infrastructure and cloud services operating as a single environment, with shared identity, connectivity between them and consistent management across both.
It is distinct from simply having some things on premises and some things in cloud, which is what most organisations actually have. The difference is whether the two halves are integrated deliberately or just coexisting, and the second arrangement costs more to run and drifts apart over time.
Is hybrid cloud just a stage before going fully cloud?
Not for most South African mid-market organisations. Plenty of workloads have good reasons to stay on premises indefinitely and there is usually no compelling case for completing a move to full cloud.
Latency-sensitive systems, applications with licence models that penalise cloud infrastructure, systems certified against specific hardware, operational technology and stable workloads on serviceable hardware all belong where they are. Treating hybrid as a permanent architecture leads to better decisions than treating it as an unfinished migration.
What is hybrid identity and why does it matter?
Hybrid identity means your on-premises directory and your cloud identity platform are synchronised so people and services authenticate consistently across both. It is the foundation everything else in a hybrid cloud depends on.
The part that needs attention is synchronisation health, because it fails quietly. A sync failing for three weeks shows up as new starters unable to sign in and leavers still able to, and neither gets attributed to the sync immediately. Monitoring sync status, staleness and error count is a standing item rather than a check performed when something breaks.
Do we need a dedicated connection to our cloud provider?
Usually not. A site-to-site VPN over your internet connection is adequate for most mid-market hybrid estates.
Dedicated connectivity such as ExpressRoute or Direct Connect is worth it where data movement between on-premises and cloud is constant and substantial, and it is over-specified where the traffic is modest. Measure the actual traffic before deciding, because the assumption is usually wrong in both directions.
How do we manage both halves without doubling the effort?
One monitoring platform, one patching process, one backup position, one policy baseline and one asset record, all covering both halves.
The default outcome is two of everything, which doubles the operational effort and guarantees the halves drift apart. Tools such as Azure Arc extend the cloud management plane to on-premises and other-cloud servers, and AWS Systems Manager offers comparable capability. Both are worth evaluating where the on-premises estate is large enough to justify the setup.
What about POPIA in a hybrid environment?
It applies across the boundary and hybrid makes the position harder to see, which is a reason to map it rather than a reason to avoid hybrid.
Personal information moving between on-premises and cloud, and possibly offshore through backup, logging or a managed-service control plane, needs a documented position. Hosting the cloud half in a South African region simplifies it considerably. Whether your processing complies is a question for your information officer, and we give them an accurate description of where data actually moves.
What breaks most often in hybrid environments?
Directory synchronisation, connectivity between the halves and backup scope that stops at the boundary. All three fail quietly.
Backup scope is the one that surprises people. A backup platform configured for the on-premises estate before cloud workloads existed will not be protecting them, and nobody notices because the reporting is green for everything it knows about. Verifying that backup covers both halves is a short exercise and a common gap.
Can you support both halves under one agreement?
Yes, and that is the arrangement that works. Splitting on-premises support and cloud management between two providers reproduces the two-of-everything problem at the contractual level.
One agreement covering both means one monitoring platform, one patching process, one backup position and one party accountable when something crosses the boundary. That last point matters most, because boundary problems are exactly where two providers point at each other.
When is hybrid the wrong answer?
Where you have genuinely nothing that needs to stay on premises. A small organisation with no servers, cloud-managed devices and everything in SaaS is fully cloud and should not build hybrid infrastructure to prove a point.
Equally, where an on-premises estate is substantial and nothing has moved, adding a small cloud footprint for its own sake creates a second environment to manage with no benefit. Hybrid is worth designing when both halves are load-bearing.