Start with acceptance, not architecture
Before choosing services, agree per workload what “moved” means: the downtime it can tolerate, the checks that prove it works and who signs it off. Without this, cutover becomes a debate under pressure.
Move in waves you can reverse
Group workloads by dependency and risk. Stateless services go first because they are easy to roll back; stateful systems follow once replication and rollback have been rehearsed. Every wave should have a tested way back.
Rehearse the boring parts
DNS changes, certificate renewals, secrets and connection strings cause more cutover failures than the platform itself. Script them, rehearse them and keep the runbook next to the people who will run it.
Hand over a platform, not a project
The migration is finished when the team that runs the system can deploy, observe and recover it without help. Budget time for templates, dashboards and runbooks as part of the scope, not after it.