[In preview] Public Preview: Azure Migrate – GitHub Copilot Modernization integration for at scale code assessments

What the Integration Actually Ships

At its core, the integration surfaces Azure Migrate's portfolio-level assessment findings alongside GitHub Copilot Modernization's AI-assisted code analysis in a shared workflow. Instead of pivoting between your Migrate assessment dashboard and a separate code review environment, AppCat's compatibility findings and infrastructure dependency signals appear in the same context where Copilot can generate explanation, documentation, and remediation suggestions.

Copilot's role in this pipeline is concrete and bounded. It helps engineers understand unfamiliar legacy code faster. It generates documentation for codebases that have none, which covers most of what actually shows up in a migration backlog. It proposes pattern translations: sync to async, .NET Framework 4.x idioms to modern .NET equivalents, with enough surrounding context that a developer can evaluate and commit rather than write from scratch.

All of that is useful for the execution phase. None of it is assessment, and keeping that boundary clear is where programs succeed or fail.

The Right Mental Model

Structured assessment tools produce authoritative, auditable, at-scale readiness signals. AppCat's output is consistent. DMA's findings are reproducible. You can defend them in a governance review. Copilot's output is probabilistic and contextual. It reasons well within a bounded scope. It does not produce consistent scoring across a portfolio, and it was never designed to.

They are not competing capabilities but sequential stages in the same pipeline. The structured tools give you the source of truth. Copilot helps engineers act on it faster.

Feed AppCat and DMA output into Copilot's remediation scope. Organizations that flip this and use Copilot for initial assessment will get inconsistent results, spend more time validating outputs than they save, and arrive at governance with nothing auditable.

Where You'll See Real Throughput Gains

Three scenarios where the integration adds concrete, predictable value:

Legacy documentation gaps. Most applications flagged by AppCat as high complexity have either no documentation or documentation that describes an earlier version of the code. Copilot accelerates this phase materially, and the effect compounds across a large migration backlog.

Identified pattern translations. When AppCat flags synchronous file I/O in code targeting containerized workloads, the fix pattern is known. The work is mechanical but dangerous if done inattentively across hundreds of callsites. Copilot handles the generation while the engineer owns the judgment call on each instance, a split that works precisely because the fix pattern is known but the application context is not.

Triage acceleration. Not every AppCat finding is an actual blocker. Some flagged patterns are inert in the specific application context. Having Copilot explain what a callsite is actually doing, in plain language with surrounding context, lets senior engineers triage faster and delegate routine remediation more confidently.

All three are execution work, not assessment. Assessment is already done before Copilot enters the picture; these scenarios accelerate the phase that comes after.

The Context Window Problem Is Real

The integration does not resolve one of the fundamental constraints with LLM reasoning applied to large codebases: context window limits fragment analysis. A monorepo with 40 interdependent services does not fit in a context window. Copilot analyzes fragments, and those fragments have no native awareness of Azure Migrate's dependency graph. If Service A calls Service B asynchronously and Migrate has flagged that topology as a migration dependency, Copilot does not know this unless you surface it explicitly in the prompt context.

This matters most for cross-service pattern changes. The risk is locally plausible suggestions that create integration failures at the seams. The mitigation is scope discipline: treat Copilot analysis as bounded to individual services or modules and enforce that boundary explicitly. Do not let the shared tooling surface tempt you into portfolio-level AI analysis. The tool does not support that use case, regardless of how the interface presents it.

Warning: The bidirectional data flow between Copilot Modernization outputs and Azure Migrate assessment records is still forming as of mid-2025. Before building architecture that depends on native integration between the two surfaces, verify the current capability boundary against Microsoft Learn documentation. Public preview means the contract is not stable.

The Security Tax Nobody Prices In

Legacy codebases contain secrets. Not occasionally. Routinely. Embedded connection strings, hardcoded API keys, PII in log scaffolding, business-sensitive logic that was never designed to leave the enterprise network. AppCat does not flag these. DMA does not flag these. They surface when you start putting code into an AI pipeline, and by then you've already created exposure.

Two non-negotiable prerequisites before any code enters the Copilot pipeline:

• Secret scanning first. Run a full secret scanning pass, whether that's GitHub Advanced Security, Trufflehog, or your organization's existing tooling, and remediate before any code enters AI-assisted analysis. Discovering secrets mid-analysis is not a recoverable state.

• Enterprise-tier Copilot is the floor. GitHub Copilot Enterprise with no-training-on-your-code is the minimum acceptable baseline for production migration work. If you're running Business tier, verify the organizational data handling settings before proceeding. The AI vendor terms matter here in a way they did not when developers were using Copilot for greenfield feature work.

Data classification on legacy codebases is expensive and slow. Build it into the program plan before the migration backlog starts moving.

How to Layer This Correctly

1. Run structured assessment first. Complete AppCat, DMA, and Azure Migrate discovery across the full portfolio. Produce ranked, auditable readiness scores. This is the source of truth for what needs remediation and in what priority order. Do not shortcut this step.

2. Classify and scan before AI ingestion. Run secret scanning and data classification across any codebase before it enters the Copilot pipeline. Remediate findings first. Confirm Enterprise-tier Copilot is active with no-training settings verified at the organization level.

3. Define bounded remediation scopes. Take AppCat findings for a single application, not a portfolio. Define the remediation scope explicitly: one application, one set of identified blockers, one iteration. Copilot analysis at portfolio scale produces unreliable signal. Resist the interface.

4. Use Copilot for execution, not discovery. Inside the bounded scope, use Copilot to document, translate patterns, and help engineers understand unfamiliar code. Keep a human on every commit. Copilot proposes; the engineer decides. That split is not a workaround for immaturity but the correct architectural response to probabilistic tooling applied to production-grade systems.

5. Validate against the original assessment signal. After Copilot-assisted remediation, re-run AppCat or the relevant assessment tool on the modified codebase. The structured tool's output is the audit trail. AI-generated suggestions are not. Governance reviews require the former.

This is the standard human-in-the-loop pattern applied to the migration pipeline. The integration lowers friction at steps 3 and 4. It does not change the underlying workflow.

The Bottom Line

The expensive part of a migration program has never been knowing what's broken. It has always been fixing it, application by application, at the pace of qualified engineers already stretched across a large portfolio.

The integration is in public preview and the capability boundary is still moving. Do not build hard dependencies on native Copilot-to-Migrate data flow until the contract stabilizes. The thesis holds regardless: structured tools find the problems, Copilot accelerates fixing them, and the engineer stays in the loop on every decision that matters.

Organizations that sequence this correctly will compress execution timelines in ways that compound across a large backlog. Those that use Copilot for assessment will spend the first quarter rebuilding confidence in their signal and losing governance reviews. The preview tooling does not enforce the sequencing for you, so the discipline has to come from program design.

Feed Copilot from your assessment output, scope each AI-assisted pass tightly to a single application or module, lock down secrets before anything moves, and re-run structured validation after every change batch. That is the architecture the integration is designed to support.