Microsoft has an ingenious promotion for customers running Windows Server 2008 on-premises.  On January 14, 2020, support for Windows Server 2008 and 2008 R2 will end. That means the end of regular security updates. If, however, those servers are migrated to Azure there are three additional years of security updates.  That is a powerful incentive to migrate those workloads to Azure. 

The challenge is how to migrate security and segmentation when those servers are moved to the cloud.  One of the advantages of doing segmentation at the host level is that it doesn't matter where the server lives.  When those on-prem server move to the cloud, the segmentation policy goes with them.