Your company plans to migrate hundreds of on-premises vSphere VMs to Azure with minimal downtime. Some applications must retain their IP addresses during migration. The VMs will need private access to Azure PaaS services from the migrated environment. Which two actions should you include in the design?

Azure VMware Solution (AVS) is ideal for migrating hundreds of vSphere VMs with minimal downtime and retaining IP addresses. VMware HCX, included with AVS, provides live migration (vMotion) and replication-assisted vMotion, which are key for minimizing downtime and preserving IP configurations. To provide private access to Azure PaaS services, connecting the AVS private cloud to an Azure hub VNet via the dedicated AVS ExpressRoute is the recommended approach. This allows for high-bandwidth, low-latency private connectivity. Within the hub VNet, Private Link and Private Endpoints ensure that PaaS services are accessed privately over the Azure backbone, enhancing security and meeting the requirement for private access. Incorrect options: Migrating directly to Azure VM Scale Sets with Azure Migrate Server Migration does not offer live vMotion between on-premises and Azure VMs in the same way HCX does for AVS, nor is it designed for retaining IPs across a large-scale vSphere migration with minimal downtime in the same seamless manner. Using a site-to-site VPN from AVS to a spoke VNet is less performant and secure than ExpressRoute, and exposing PaaS over public endpoints contradicts the requirement for private access. Placing PaaS services in the AVS vCenter using nested virtualization is not how Azure PaaS services are consumed; PaaS services are native Azure offerings.