OperationsUpdated July 3, 2026

ODBA East Training/Dev/Test - Knowledge Transfer

operationsknowledge-transferdatabaseodbatrainingdevelopmenttesteast-regionsql-dbaazureepicanalyticsnon-prod

ODBA Epic on Azure Knowledge Transfer

East Training – MST, ACE 1-5, PLY, EXAM, REF, PREP
East Dev– SBOX, POC
East Test – OLDTST, TST, TSTRPT

The following Optum and Accenture team members were identified as key stakeholders for ODBA related knowledge transfer:

Name	Organization
Jordan Lambert	Optum
Mason Chanthavatdy	Optum
John Keane	Optum
Laura Vaughn	Accenture
Christopher Land	Accenture

The following items were identified as requiring Knowledge Transfer to transition the in-scope environments to the Optum ODBA team for ongoing support:

Server names and corresponding Epic groups

1. East Non-Prod VMs: Current Machines in Kuiper.csv
2. Kuiper URL: <https://kuiper.uhc.com>
3. System Pulse URL: <https://systempulse.uhc.com>

Server Naming Conventions

3.4 Virtual Machine Naming Convention

To ensure consistency across all resources it is important to follow a standard naming convention. A standardized format will allow for resources, such as virtual machines, to be easily identifiable.

VM Naming Convention

This standard naming convention will be used for naming hosts in Azure VMs:

Position 1: Hosting Platform (Z=Azure, A=AWS, G=Google, Oracle Cloud, etc.)
Position 2: Region (E, C, W)
Position 3: Environment (P=Prod, N=Non-Prod, D=Dev, R=Disaster Recovery, S=Shared)
Position 4: OS Platform Type (W=Windows, L=Linux)
Position 5: Purpose (AD=Active Directory, EPS=Epic Print Server, KUI= Kuiper, BCA, etc.)
Position 6: Instance Identifier (EE = Epic East, EW = Epic West, CL = Community Lead)
Position 7: Series Number starting at 001, incrementing as required.
Server hostnames will vary from 13-15 characters depending on role and/or purpose.

Z W P L EPS CL 001
Platform Region Environment OS Type Purpose Instance Identifier Series

Z	W	P	L	EPS	CL	001
Platform	Region	Environment	OS Type	Purpose	Instance Identifier	Series

VM Configuration Checks

OS Changes
ESMP
Unit Infrastructure Test Cases (Unit Testing tab (filter on ODBA cases)): Optum_Epic to Azure Migration_Test Cases.xlsx

Confirm Server Access & corresponding tools required for access

Ensure access to Hashicorp Vault (https://vault.uhg.com)
- Namespaces: Aide-0085665 (West), Aide-0085666 (East)
- Used for Static secrets
  - Local admin passwords
    - Follow-up with Infrastructure team to get naming decoder ring for local admin passwords Followed up with Indhu and Jeff 4/22 -
  - Msnonprod service accounts
    - Cloudtest infrastructure – ONLY Epic infrastructure in msnonprod domain
    - Msnonprod.dsnonprod.uhc.com
  - EMPs or ESMP passwords
  - Etc.
Ensure access to Cyberark (same as on-prem) https://cyberark.optum.com/PasswordVault/v10/logon)
- View and Copy service account passwords
- Domain based secrets
  - Epic service accounts: Epic on Azure Service Accounts.xlsx
- It is now accessible from Cloud SAW
Ensure access to Cloud SAW
- VMWare Horizon
- Cloud SAW is the preferred way to RDP into Azure VMs
  - Request Cloud SAW access via Secure
    - Application: Secure Workbench
    - Choose Create New ID to populate with Secondary ID
      - If one does not exist, it will create a secondary ID for use.
    - Role: Cloud SAW
Ensure your elevated credentials are in the AD group below for your secondary account:
- ocnational_epic_azure_odba GPO is applied to Epic on Azure Windows VMs to allow admin access to this AD group
Check adlookup.optum.com to ensure access has been granted
Linux Server access
- Follow process outlined in this link: https://github.com/optum-tech-compute/ohemr-issue-tracker/issues
- Contact Manuel Palacios or Patrick O’Shea for any Linux access concerns
- Public/Private Key Access
  - Process for identifying Public Key (Putty)
    - Search within this file path: \epicfilesnp.uhc.com\technical\Epic_Azure\Private_Keys
      - Search for your MS ID folder
      - the file with the “PUB” extension
      - technical > Epic_Azure > Private_Keys > jrobe224
        
        Name Date Modified Type
        id_ed25519 3/26/2025 12:45 PM File
        id_ed25519.pub 3/26/2025 12:45 PM PUB File
        privatekey.ppk 3/26/2025 12:45 PM PPK File
  - Process for creating/identifying private key access
    - \epicfilesnp.uhc.com\technical\Epic_Azure\Private_Keys
      - Search for your MS ID folder
      - Select the file with the “PUB” extension
  - technical > Epic_Azure > Private_Keys > jrobe224
    
    Name Date Modified Type
    id_ed25519 3/26/2025 12:45 PM File
    id_ed25519.pub 3/26/2025 12:45 PM PUB File
    privatekey.ppk 3/26/2025 12:45 PM PPK File

Name	Date Modified	Type
id_ed25519	3/26/2025 12:45 PM	File
id_ed25519.pub	3/26/2025 12:45 PM	PUB File
privatekey.ppk	3/26/2025 12:45 PM	PPK File

Name	Date Modified	Type
id_ed25519	3/26/2025 12:45 PM	File
id_ed25519.pub	3/26/2025 12:45 PM	PUB File
privatekey.ppk	3/26/2025 12:45 PM	PPK File

Backup and Restore

Need to confirm the request process? ServiceNow Ticket? Working Session?
Kunal performs ad hoc backup of the server using AZ Backup tool
Kunal specifies the backup file to perform restore
ODBA performs restore
ODBA performs data integrity check
ODBA confirms freeze/thaw script is working
Kunal deletes restore file from server to prevent capacity issues~

Automation Handoff to ODBA

Need to confirm Optum Stakeholders owning the automation configuration/maintenance
Automation Team is using ansible/terraform tools to configure the Linux/storage components prior to handoff to ODBAs to initiate environment build
OBDA Team will need to perform the following prior to handoff
- Confirm access to server following Github access process
- Validate ability to run instaserver to build the environment
Here’s link to the Automation vs. ODBA responsibilities for the Linux servers: Automation Requirements to Solution Summary.xlsx

LDAP/User or Group Creation/SSH

Need to collaborate with Larry Anderson to review /var logs for user access
In future, this step will be owned by Optum’s operations

Azure Access

Ensure log in and access to Virtual Machine details located in the portal (https://portal.azure.com)
Currently not aware of the process to get “Contributor” access in Azure – Placeholder follow-up – Optum Cloud Operations – Followed up with Indhu and Jeff – 4/22 jm
Use for Azure Bastion – Console level access to VMs if they are unreachable via RDP

List of deliverables

Artifactory: repo1.uhc.com
GitHub Scripts:
Quick Reference Guide: Optum_Epic on Azure Infrastructure - Quick Reference Guide.xlsx
Low-level Design Document: Low-Level_Design_v1.0.docx
Deployment Plans: Deployment Plan
Epic IP Address Allocation: EPIC IP Address Allocation-100%CDO.xlsx
Network Architecture Diagram: Optum - Network Diagrams Draft v2.6-updated2.vsdx

Architecture & Business Continuity (DR considerations/config for specific environments)

This will be applicable for Production. It is not applicable for non-prod.

Server configuration details

Please see the Bill of Materials that were used to request the infrastructure that has been deployed here: Deployed

Application Config details