Azure and Microsoft 365 consulting for small teams

Most Azure advice assumes a platform team, a change board and someone whose job is cost. If you have those, you probably do not need us. This is for the companies where one or two people hold the whole estate, the documentation is eighteen months out of date, and the thing that broke last week is still on the list.

We work on the estate you actually have. Every engagement starts by finding out what is really there, because the answer is usually not what the diagram says.

Cloud migration

Moving workloads to Azure with identity, networking and cost worked out before anything moves. The order matters. A migration that starts with the VMs and leaves identity until later produces a working environment nobody can safely administer, and a bill nobody predicted.

In practice that means answering a short list of questions first. Which directory owns the identities, and does it federate with anything. What has to reach what, and over which private paths. What the landing zone looks like when there are eight resources in it and when there are eight hundred. What the resource naming and tagging will be, because retrofitting tags across a live estate is a project of its own.

Then the actual moves, in an order where each step is reversible, with the rollback written down before it is needed rather than improvised at the point it is.

Automation

PowerShell and Microsoft Graph automation for the work that should not need a person. Joiner, mover and leaver processes. Evidence collection on a schedule. Reporting that runs itself rather than being rebuilt by hand each quarter.

The failure mode we see most often is not a missing script, it is a script that lies. Something written in a hurry that prints a cheerful summary and exits zero whether or not it did anything. A leaver script that reports success having skipped the mailbox because the licence had already gone. A cost report that returns nothing because the token expired and nobody noticed the difference between "no findings" and "could not look".

So automation we hand over fails loudly, logs what it touched, and exits non-zero when it could not do the job. That is less satisfying to demo and much more useful at three in the morning.

Security and compliance

Hardening Azure and Microsoft 365, and getting the evidence into a state an auditor accepts. Those are two different problems and people usually have one of them solved.

The hardening half is Conditional Access that covers the gaps rather than the obvious cases, admin accounts that are not permanently privileged, break-glass access that has actually been tested, device compliance that is enforced rather than reported, and logging that is retained long enough to investigate something you find out about six weeks later.

The evidence half is what turns that into a certificate. Access reviews with dates and names on them. Supplier assessments. A risk register somebody maintains. Change records that show a decision was made rather than a change happening. If you are heading for ISO 27001, most of the work is not the controls, it is proving the controls operated over a period, and the book covers that in detail.

IT consulting and support

Practical help across the estate, whether that is a decision to make or a backlog to clear. Sometimes the useful thing is not a project. It is a second opinion on an architecture before you commit to it, a week spent closing the twenty small things that have been deferred, or someone to own a migration weekend so the person who normally does everything can be off the clock for it.

How an engagement runs

Four stages, in this order, with no surprises and nothing changing in production without a decision behind it.

Find out what is there. A read-only assessment of the estate. Often the same tooling we sell, pointed at your subscriptions. Read-only means we can start before anyone has to decide how much to trust us.

Agree what matters. Findings ranked by cost and risk, with the ones worth acting on separated from the noise. Cost figures are for prioritising work rather than for billing, and we say so up front rather than being caught out by it later.

Do the work. Changes made with a rollback, and automation handed over in a state you can maintain.

Leave it measurable. Reporting you can re-run yourself, so the improvement is still visible after we have gone.

The handover test

The test we hold ourselves to is simple. If you cannot maintain it after we leave, it was built wrong.

That rules out a few things people sometimes expect from consulting. No automation that only runs from a laptop that has left the building. No scripts authenticating as a named person. No documentation that stops at "run the pipeline". If a thing needs a service principal, you get the service principal, the permission list, the reason each permission is there, and the expiry date in your calendar.

Where this does not help

Worth saying plainly, because a wasted engagement is worse than no engagement.

If you need round-the-clock cover, you need a managed service provider and a rota, not one consultant. If the real problem is that nobody will fund the fix, an assessment will produce a document rather than an outcome, and you probably already know what it will say. And if you want a compliance certificate without changing how anything operates, an auditor will find that out faster than we can.

Getting started

Email info@acloud.solutions with roughly what the estate looks like and what is bothering you. A read-only assessment is usually the cheapest way to find out whether there is anything worth doing, and it produces a ranked list either way.

If you would rather start on your own, the free Orphaned Resource Finder will tell you what nobody deleted, and the notes cover the checks we run most often.