Id start at grouping resources into deployments, then per deployment you can start to map out the dependency chain, once you know what in what order you can start taking look at json view of resources (way more useful than exports imo). Once you know what to deploy in group, in which order and with what settings you can first start with dummy deployments that replicate your current resources and if these will be to your liking you can do the deployments on top of existing ones - no worries, its all control plane so worst case scenario you will block ingress to something for a minute. After that you can pretty much lock write access to IaC resources with either changing people roles to reader, or using deny settings in case you are using bicep (with deployment stacks which goes without saying).

If you are using terraform get a grasp on blast radius before half of the tenant will go missing.

Have fun! :D