Method
Every engagement follows the same spine: understand the estate, design the target, cut over in phases, leave the docs, stay for a defined window. Scope is written down before anyone touches production.
We map identity, mail flow, devices, sharing, and the security controls that exist on paper versus in the tenant. Pain points get named. Gaps get evidence. You leave this phase with documentation, not a recap email.
A target architecture that can survive your users, your budget, and your compliance bar. Migration paths and timelines are part of the design — including what we will not do, so there are no quiet assumptions.
Pilot groups first. Validation checkpoints. DNS and identity changes only when rollback is written. The constraint is business continuity: if a step can’t be reversed, it doesn’t happen on a Friday.
Technical documentation, admin runbooks, and user guides. We train the people who will own it next. An environment nobody can explain is just a future outage.
A support period with explicit scope: configuration issues from the engagement, not a new helpdesk. When the window ends, you have a tenant you can run — or a conversation about retainers, not a surprise.
Operating principles
If Entra ID isn’t right, nothing downstream is. UPN, MFA, and Conditional Access get settled before we decorate the tenant.
Every irreversible step has a written reverse. If we can’t say how we’d undo it, we don’t do it in production.
We’d rather decline a workstream than absorb it silently. Clear edges keep cutovers calm and invoices honest.
