Modernize + SaaS-ify AdventureWorks with @Modernize + Multi-Tenant Row-Level Security
Lift legacy ASP.NET 4.8 to .NET 10 via @Modernize + pivot to multi-tenant SaaS with RLS + EF query filters + Entra onboarding.
About This Course
Lift a legacy ASP.NET Framework 4.8 web app to .NET 10 with Copilot's @Modernize upgrade workflow, then pivot the Halcyon Sales Portal from single-tenant to multi-tenant SaaS using SQL Server Row-Level Security + EF Core global query filters. Learn the three-stage @Modernize assistant (assess, upgrade, verify), the design patterns for retrofitting tenant isolation onto an existing schema, the backfill strategy for migrating existing customers into tenants, and the Entra ID B2B/B2C tenant-provisioning flow for onboarding new distributors. By the end you will have a modernized multi-tenant Sales Portal running on .NET 10 with RLS-enforced isolation + a documented onboarding runbook.
Course Curriculum
7 Lessons
@Modernize + GitHub Copilot upgrade for .NET
Learn the Visual Studio 2026 @Modernize specialized agent that lifts legacy .NET Framework apps to current .NET. The three-stage workflow (Assess → Upgrade → Verify), the framework-to-target mapping decisions Copilot defers to you, the categories of change Copilot proposes automatically (TargetFramework switch, package upgrades, namespace migrations) vs the categories Copilot flags for human judgement (System.Web → ASP.NET Core shape, HttpContext.Current → HttpContextAccessor), and the strategy for reviewing + applying the upgrade diffs. By the end you will be able to run @Modernize end-to-end on a real app and know which proposed changes to accept blindly vs scrutinize.
Lift the legacy Adventure Works web app to .NET 10 with @Modernize - Lab Exercises
Note: This lab pre-provisions a Windows VM and the Halcyon.Adventure.Legacy starter files at start — allow up to 10 minutes for the environment to become ready before beginning the exercises.
Start from a real ASP.NET Framework 4.8 web app Marcus inherited in the Adventure Works acquisition — Web Forms + classic MVC + System.Web + packages.config. Run Copilot's @Modernize agent through the three-stage workflow, triage the proposed edits, apply the compilable baseline, and run the resulting .NET 10 app with the same business behavior. By the end you will have the legacy app lifted to current .NET with a documented list of the deferred-for-later items @Modernize surfaced.
Design patterns for multi-tenant SaaS on an existing schema
Learn the design patterns for pivoting a single-tenant SaaS app to multi-tenant without rebuilding the data layer: tenant-ID header routing via middleware, EF Core global query filters that scope every read to the current tenant, SQL Server Row-Level Security (RLS) as the defense-in-depth layer that enforces isolation even when the app layer is bypassed, and the migration strategy for adding a TenantId column + backfilling existing rows into a default tenant. By the end you will be able to choose between three multi-tenant isolation models (shared DB + shared schema + TenantId column vs shared DB + schema-per-tenant vs database-per-tenant) + judge when RLS is sufficient vs when the app also needs hard tenant isolation.
Add tenant isolation to the Sales Portal with RLS + EF global query filters - Lab Exercises
Note: This lab pre-provisions a Windows VM and the Halcyon.Adventure.SalesPortal starter files at start — allow up to 10 minutes for the environment to become ready before beginning the exercises.
Retrofit tenant isolation onto the Course 5 Sales Portal. Add a TenantId INT NOT NULL column to Sales.Customer + Sales.SalesOrderHeader, create a SQL Server RLS security policy that filters rows by the current session's TENANT_ID, write a header-based tenant-resolver middleware that reads X-Tenant-Id and sets the SQL session context, and add an EF Core global query filter as the app-layer belt alongside the RLS braces. By the end you will have a Sales Portal where Tenant A reps cannot see Tenant B customers even if the app layer is bypassed.
Partition existing customers into tenants via a Copilot Agent-mode migration - Lab Exercises
Note: This lab pre-provisions a Windows VM and the Halcyon.Adventure.SalesPortal starter files at start — allow up to 10 minutes for the environment to become ready before beginning the exercises.
Backfill the newly-added TenantId column across the existing AdventureWorks customer base. Design the partition heuristic (Halcyon rule: group customers by SalesTerritory into 3 regional tenants), prompt Copilot Agent mode to scaffold the migration SQL + the idempotent backfill script, verify the backfill via a cross-tenant leak test, and plan the deployment staging (migrate dev → run smoke → swap-slot to prod). By the end you will have a repeatable migration pattern for retrofitting tenant isolation onto any single-tenant SaaS schema.
Tenant-aware auth + onboarding with Entra ID
Learn the auth + onboarding patterns for multi-tenant SaaS: Entra ID B2B (guest users invited into Halcyon's directory) vs Entra ID B2C (consumer-style tenant isolation at the directory level) vs home-grown multi-tenant Identity schemes, the tenant-provisioning flow (admin API creates tenant row + seeds admin user + sends invite), and the admin-API design that lets Halcyon self-serve-onboard a new distributor without engineering intervention. By the end you will be able to choose between B2B, B2C, and home-grown auth for a given SaaS shape + design the minimum admin-API surface for tenant provisioning.
Onboard a new distributor end-to-end + ship the SaaS cutover - Lab Exercises
Note: This lab pre-provisions a Windows VM and the Halcyon.Adventure.SalesPortal starter files at start — allow up to 10 minutes for the environment to become ready before beginning the exercises.
Build the tenant-provisioning API (POST /api/admin/tenants), seed data for a new distributor "Nimbus Outfitters", run the end-to-end onboarding smoke test (admin creates tenant → invited rep signs in → sees only Nimbus customers + orders), write the operations runbook covering tenant lifecycle (create / suspend / delete / data-export), and ship the ship-it PR with Copilot code review green. By the end you will have a production-shape multi-tenant SaaS with the first external distributor onboarded through the self-serve admin API.