Architecture
Reaching internal apps without a VPN: application proxy, Private Access and a migration plan
Replacing the VPN with per-application access: Entra application proxy, Global Secure Access and Private Access, Conditional Access integration and a gradual migration plan.
ArchitectureDesigning your log architecture: which sources to send to Sentinel, for how long and at what cost
Entra ID, Microsoft 365, Active Directory, Defender: which sources to collect in a SIEM such as Sentinel, how to tier retention and keep costs under control by starting from detections.
ArchitectureExchange hybrid today: what the on-premises server still does and how to do without it
Recipient management, SMTP relay, hybrid server security and AD permissions: what the last on-premises Exchange server really does, and the path to removing it.
ArchitectureConsolidating Active Directory forests and domains: approaches, SID history risks and trust clean-up
Why legacy multi-domain designs persist, how to migrate towards a simpler forest, and how to stop SID history and trusts from becoming attack paths.
ArchitectureZero Trust for Microsoft 365: a pragmatic reference architecture and the order in which to build it
Identities, devices, apps, data, network and telemetry: a concrete Zero Trust architecture for Microsoft 365, stripped of marketing talk, with a realistic build order.
ArchitecturePrivileged access workstations: designing PAWs that genuinely respect the clean source principle
Admin tiers, the clean source principle, jump servers versus PAWs, cloud-managed workstations: how to design the devices from which your critical systems are administered.
ArchitectureDesigning a two-tier AD CS PKI: offline root, Tier 0 issuing CAs and controlled templates
Offline root, issuing CAs treated as Tier 0, template hygiene, CRL and AIA publishing, HSM use: the architectural choices behind a sound Active Directory PKI.
ArchitectureHybrid identity: choosing between Entra Connect Sync and Cloud Sync, and scoping what gets synchronised
Connect Sync or Cloud Sync, supported topologies, a staging server for resilience, OU filtering and source of authority: the design choices behind a sound hybrid identity.
ArchitectureBacking up Microsoft 365: retention is not backup, and restores must be tested
Shared responsibility, the limits of retention, Microsoft 365 Backup or a third-party tool, ransomware and mass deletion scenarios: how to design a backup that actually restores.
ArchitectureOne or several Microsoft 365 tenants: the criteria that should drive the decision
Mergers, subsidiaries, sovereignty, admin isolation: when a single tenant makes sense, when several should be kept, and what each choice really costs to run.