Having recently completed a migration of a significant estate (~500 secrets, 1000+ users, hybrid Windows/Linux server population) from an on-premises Thycotic Secret Server v10 instance to the Delinea Cloud Suite (PAM, Cloud PKI), I feel compelled to document the technical and procedural friction points. The promise of a managed service, integrated modules, and a modern API was compelling, but the transition was far from a lift-and-shift. For teams contemplating a similar move, the devil is in the migration methodology and the delta between the old and new data models.
The primary pain point was the lack of a deterministic, scriptable migration path for complex objects. The provided migration tools focus on basic secret and user data, but fail catastrophically on dependencies and metadata. Our custom Thycotic instance had extensive:
* Custom secret templates with unique field layouts and embedded scripts.
* Complex dependency chains (e.g., secret A retrieves a value from secret B for rotation).
* Granular folder-level permissions that didn't map cleanly to Delinea's role/access model.
Attempting to use the standard CSV import resulted in a corpus of broken, non-functional secrets. We were forced to build a custom middleware using the Thycotic SOAP API (painfully slow) and the Delinea REST API. The key challenge was state management and error handling during the multi-hour transfer. Below is a simplified excerpt of our reconciliation logic, which had to run in waves:
```python
# Pseudocode highlighting the stateful migration challenge
def migrate_secret_with_dependencies(thy_secret_id, delinea_folder_id):
thy_secret = thycotic_api.get_secret(thy_secret_id)
# Check for embedded references to other secret IDs
dependency_ids = parse_dependencies(thy_secret.fields)
# Pre-migrate dependencies recursively, mapping old IDs to new
dependency_map = {}
for dep_id in dependency_ids:
new_dep_id = migrate_secret_with_dependencies(dep_id, delinea_folder_id)
dependency_map[dep_id] = new_dep_id
# Rewrite secret fields with new Delinea secret IDs
migrated_fields = remap_fields(thy_secret.fields, dependency_map)
# Create in Delinea, handling API rate limits and retries
delinea_payload = {
"name": thy_secret.name,
"folderId": delinea_folder_id,
"secretTemplateId": map_template_id(thy_secret.template),
"fields": migrated_fields
}
response = delinea_api.create_secret(delinea_payload)
if response.ok:
log_migration_map(thy_secret_id, response.json()['id'])
return response.json()['id']
else:
raise MigrationError(f"Failed for {thy_secret_id}: {response.text}")
```
Secondary issues emerged post-migration:
* **Cost Model Surprise:** The per-secret pricing in Cloud Suite can become punitive compared to the on-prem concurrent license model if you migrate "everything." We had to rationalize and archive thousands of obsolete secrets before migration to avoid cost blowout. The elasticity of the cloud bill is a double-edged sword.
* **API Inconsistency:** The Thycotic DevOps API (v1) and the newer Delinea API (v2) have significant differences. Our existing Terraform code for secret provisioning broke entirely, requiring a rewrite. The new API is more RESTful but lacks feature parity in some areas, particularly around secret rotation engine configuration.
* **Observability Gap:** The Cloud Suite provides basic audit logs, but for a compliance-heavy environment, we needed to pipe these logs into our existing SIEM (Splunk). The Cloud API for log streaming required a separate integration setup (AWS EventBridge) that wasn't documented in the migration guide, causing a compliance visibility gap for the first week.
In conclusion, the migration to Delinea Cloud Suite is a re-platforming project, not an upgrade. It demands a phased approach: inventory and rationalization, dependency mapping, custom tooling development, and a revised operational playbook for cost and observability. The end state is more scalable and secure, but the journey requires significant cloud-infrastructure and scripting rigor. Teams should budget for at least 2-3 months of parallel run and validation for anything beyond a trivial deployment.