Hidden Costs of a Blackbaud CRM Migration

If you’re moving your Blackbaud CRM from a hosted environment to an on-premise setup, don’t assume you’re in the clear. Ask for details from your IT team on their plans.

In order to save on licensing costs, your internal IT team might make Blackbaud CRM and other internal applications share the same SQL resources.

We highly recommend the Online Transactional Processing (OLTP) portion of Blackbaud CRM reside on a dedicated SQL server.

Blackbaud CRM doesn’t like sharing. It’s demanding on resources. It might not be long before you start seeing performance issues from multiple applications sharing the same SQL server, or its supporting plug ins and apps.

A dedicated server won’t have to worry about additional load from any other internal processes that rely on Microsoft SQL Server, and can stay focused on Blackbaud CRM.

Public cloud services bundle many costs, including SQL server, into the cost you pay for the subscription. So when you pay the subscription, part of what you pay is what they paid for Microsoft SQL Server.

Independent hosting providers have been doing much of the same thing, paying for it through their SPLA, and including it as part of the base price for simplicity. Thus, you pay for it through the base subscription. It’s there, it’s just harder to see. It can even be a little convenient, in that it’s managed for you.

Makes sense, but what if you already have a license?

We like options, so Concourse offers a BYOL or “Bring Your Own License” program. This way, you can bring your current license, or get a discounted one from TechSoup to bring aboard.

There are two qualifications to keep in mind though:

1. The hosting provider MUST be an Authorized Mobility Partner with Microsoft. (Somebody like Concourse.)

2. Blackbaud CRM MUST be delivered on dedicated hardware. (We have that too!)

Okay, now you’ve navigated the cost of your SQL licensing. You’ve reviewed the options for where your Blackbaud CRM is going to live.

What other factors should you be considering?

The instances will need to be fine tuned to work with Blackbaud CRM, and your Databases will need to be closely watched. Get a SQL Superhuman.

Here's a few subjects to cover with your chosen SQL Expert:

Ask them how they plan to manage temp file growth. It's going to be an important part of managing and understanding your storage needs.

Make sure they understand how and when to set up re-indexing and integrity checks. Regular maintenance is important.

They should be well versed in the ways of SQL Server Reporting Services to maintain visibility, and SQL Server Integration Services is going to be key to getting this data from one place to another.

More than anything, when asking our own Database Specialist about what you should be looking for, they said BACKUPS. In all caps. A lot. Whoever is going to be handling your Databases better have a plan to keep them safe in the event of an emergency.

Security should be a consideration from start to finish.

Ransomware is a booming business, don’t become a customer.

Your plans should have a stamp from your security team at every step to ensure your data is protected.

Here is a quick list of skills that your Migration Security Lead should have down pat before taking this on:

All aspects of securing MSSQL and Active Directory. These are crucial to getting CRM working, and safe.

Encryption: They should have a base level understanding of the encryption methods used on the CRM webpage, as well as those used to encrypt your backups.

They should understand network segmentation: There are considerations to be made in order to secure the different environments between Dev, Testing, and Production.

Experience is valuable.

Having somebody with experience installing Blackbaud CRM is priceless for a Migration.

Blackbaud has experts available, and of course, so do we!

But we would be remiss to not bring up that there are third parties that provide excellent consultancy for Blackbaud CRM.

Barker and Scott Consulting has been to the rescue of many Blackbaud CRM deployments, at almost any stage of the process.

Still figuring out your CRM strategy? They can help.

Want to make sure your IT Strategy is up to snuff for the deployment? They can help you with that too.

There's a lot more that they offer too, so we highly recommend checking them out.

This is a good question.

Your specialist migration team can be valuable at any point: Planning, Implementation, Testing, and even after the migration for assistance with your reports and customization efforts.

Our suggestion: Bring them on before you begin.

They can provide guidance on your first steps, help build the blueprints as you go, and give you the kind of insight you can only get from a sharply focused specialist. Their attention can be kept on specific, sensitive, and important aspects of the migration, while the rest of your team can stay focused on what they do best.

It’s a strategy we have formulated after overseeing many migrations for Blackbaud CRM.

By having our own team of experts, we know that assembling one isn’t an easy task.

So Concourse has a shortcut: When you host your Blackbaud CRM with us, we provide 6 of these roles right out of the box with your CRM Migration!

You get access to our very own:

• Project Manager
  

• System Builder
  

• SQL DBA
  

• Blackbaud CRM Expert
  

• Security Expert

• Database Wrangler

So if you’re following our migration playbook, you only have two roles to hunt down:

• Testers

• Software Developer

If somebody else is already handling your development efforts, you only need to find yourself a dedicated tester or two! That's a much shorter to-hire list!

(Take it from a former Software Tester: Testing is important. Test Early. Test Often.)

The most important note we can make when assembling your All Stars is that they should be DEDICATED to the role you will provide within your Blackbaud CRM migration. If you recruit from within, and they are already juggling projects for you, don't throw a chainsaw into the mix. If you lock them into this task, you have a much higher chance of success by giving them room for undivided focus.

You might be reassigning some duties from your current team to create these dedicated roles. There is a cost to that. You’re either going to be filling in a gap from recruiting within, or making a new seat for someone new.

It sounds costly, but the real savings become apparent as the project rolls along: An issue will arise.

But you will be prepared, with a dedicated, honed, and focused expert ready to tackle it and get things back on track.

This way, you won’t be ringing phones off the hook and sending support emails looking for someone that understands the issue. You won’t be at the mercy of a consultant that knows your desperate for help and on a deadline.

You may be aware that Blackbaud CRM already had a integration for your on-premise AD, but they are no longer actively supporting it.

It still works as of the time of writing, but it’s at the end of it’s life cycle. It isn’t getting checked over for security issues anymore and has no updates on the roadmap. This makes it a hard pass for a long term solution.

They’ve even squirreled away some of their pages on it at the time of writing.

In summary, it’s on it’s way out, if it isn't already gone.

So what options are there?

ADFS is provided as a service to use your on-premise Active Directory to authenticate and control access levels to other applications, including those on the web.

Sounds great, right?

Blackbaud CRM doesn't support ADFS. Other Blackbaud products do, but CRM isn't included.

In a nut shell, the credentials you use to sign on to Windows are used as authentication for other applications that support IWA.

Microsoft does a pretty good job of laying out the use cases and pros and cons, but it will require Kerberos or NTLM, it’s best suited for an intranet, not recommended for internet applications, and the client needs to belong on your AD Domain.

From our experience, another consideration to take into account is the size of your organization. The bigger your Active Directory, the less applicable and harder to manage this could be.

Zuri Group has been doing some excellent work for non-profits that power their efforts with Blackbaud CRM, including a Single Sign on utility.

This solution, as well as others, rely on the Security Assertation Markup Language, or SAML.

There are two moving parts to a SAML Solution, so get ready for more acronyms:

There is an IDP: A Identity Provider. It authenticates the user credentials and provides multi-factor authentication (Or MFA).

And then the SP: The Service Provider. For example, Blackbaud CRM would be the SP in most of our use cases.

The Zuri Group solution is great in that it works with multiple IDPs, including DUO.

The Zuri solution is particularly recommended for those clients that have a sizable AD to manage.

They have more information about the IDPs they work with and how things come together at the following link: https://zurigroup.com/solutions/sso-blackbaud-crm/

With this in mind, it's important to consider how important SSO is to your organizations goals and security guidelines. It's a matter of determining how much password drag is actually impacting your team, and how much it's worth to reduce.

So to re-cap, we've gone over the resources you'll need. We've reviewed ways to get the skills required. And you have all this intel ahead of time!

Check, check, and check!

Understanding your Hidden Costs covers all three of the project stalling hurdles that Henry has mentioned.

Armed with this information, you and your team are going to be much harder to slow down, and much more likely to triumph.

Remember: these aren’t issues to hide from or avoid. These are challenges to be expected, faced, and overcome in your greater quest for a Better home for Blackbaud CRM. By anticipating them, you can have a measured and planned response, then move onto your next phase without everything coming to a grinding halt.

Until next time!