Microsoft 365 & Azure

How It Works & Technology Overview

The Microsoft cloud stack centers on identity: Entra ID (formerly Azure AD) is the control plane every other workload hangs off — Exchange Online, SharePoint/OneDrive, Teams, Intune (device management), Defender (security), and Azure infrastructure. Identity topology comes in three states: cloud-native, on-prem AD only, or hybrid via Entra Connect sync — and the topology determines the migration path for everything. Licensing is the second axis: Business Basic/Standard/Premium (≤300 seats) and Enterprise E3/E5 differ enormously in what's technically possible (Intune, conditional access, Defender tiers, Copilot eligibility, Teams Phone); the requested controls must exist in the client's SKUs or the project hits a mid-flight paywall. Engagement patterns: greenfield (new tenant — fastest), migration (on-prem Exchange, Google Workspace, or tenant-to-tenant — timeline driven by data volume and file counts, not just gigabytes), and remediation (existing tenant with years of sprawl — always longer than it looks).

Common Deployment Scenarios

• Email/collaboration migration to M365: mailboxes, shared mailboxes, file shares to SharePoint/OneDrive, Teams enablement, cutover communication plan and hypercare window.
• Tenant-to-tenant (M&A): identity, mail, files, Teams data across tenants; API throttling makes elapsed time longer than active time — staging buffers are mandatory.
• Intune rollout: enrollment (Autopilot for new devices), compliance policies, app deployment; device health determines per-device friction.
• Security baseline/remediation: conditional access, MFA enforcement, Defender configuration, Secure Score-driven hardening — staged in report-only first.
• Teams Voice: PSTN calling via Calling Plans, Operator Connect, or Direct Routing with an SBC; ports and analog exceptions dominate (see the VoIP category).
• Azure infrastructure: lift-and-shift VMs, Azure Virtual Desktop, site-to-site VPN/ExpressRoute hybrid networking, backup/DR to Azure.

Products, Vendors & Characteristics

• Licensing: CSP through a distributor is the common MSP resale path (NCE terms: monthly vs annual commitment pricing). Changes take up to 24–48 hours to propagate. Copilot requires eligible base licenses and is priced per user per month. Since April 1, 2024, new Enterprise suites (Microsoft 365 / Office 365 E-plans) are sold without Teams worldwide — Teams Enterprise is a separate line item, while existing subscribers can renew what they have; check the client's actual SKUs before quoting a migration or Teams Voice.
• Migration tooling: native Migration Manager/Exchange tools (free, adequate for standard moves), BitTitan MigrationWiz, ShareGate, AvePoint (per-user/per-GB licensed; better for tenant-to-tenant, Google-source, and complex file moves).
• Entra Connect: the hybrid sync engine — versions age out of support; an unsupported sync server discovered mid-project is the #1 escalation generator.
• Intune/Autopilot: zero-touch provisioning for new hardware; retrofitting old, unpatched, or consumer-edition devices stalls automated enrollment.
• Azure: consumption-billed; costs need a monthly estimate up front (calculator-based) and governance (budgets/alerts) as part of any deployment; reserved instances/hybrid benefit change the math materially.

What Makes It Hard (Gotchas & Failure Modes)

• Identity assessed last instead of first: discovering a broken/unsupported Entra Connect during cutover week. Identity assessment is step one of every engagement.
• Data topology surprises: 1.2 million small files behave nothing like 800 GB of large ones; decades-deep nested folder trees paralyze OneDrive/SharePoint sync limits without flattening; PSTs on local drives aren't in any migration count.
• Conditional access without report-only staging: global lockouts of users and service accounts. Stage 7–14 days, always exempt a break-glass account.
• Copilot on a dirty tenant: wide-open sharing links + broken inherited permissions turn an AI assistant into a confidential-data search engine — governance remediation precedes rollout.
• The "temp" SharePoint site that's actually critical, undocumented service accounts, and mailbox rules that break on migration — remediation tenants punish assumptions.
• Human-layer failures: no user communication plan, no post-cutover support window, no training — a technically clean cutover still generates a day-one ticket surge that lands somewhere; price it or absorb it.

Effort & Estimation Patterns

• Tenant setup + policy baseline: 4–8 hours (greenfield).
• Mailbox migration (hybrid/tool-assisted): 15–30 minutes active work per mailbox plus 1–2 weeks elapsed cutover planning; add throttling buffer on tenant-to-tenant Teams/SharePoint data.
• File-share → SharePoint: driven by file count and permission complexity — assess with a scan; small orgs 1–3 days, permission-heavy estates far more; flattening/cleanup is its own phase.
• Intune baseline (policy set for ~100 devices): 1–2 days policy build, then per-device enrollment 15–45 minutes depending on device health and Autopilot vs manual.
• Conditional access baseline: 4–6 hours including testing plus the report-only soak window (calendar time).
• Teams Voice: 20–30 minutes per user (calling plan); 1–2 days for a standard single-site Direct Routing SBC build (see VoIP category for the analog/port world).
• Copilot readiness: sharing/permissions assessment 1–3 days at SMB scale before any license assignment; training/enablement 1–2 days.
• Post-cutover hypercare: budget junior-resource coverage for the first 1–3 days — the surge is inevitable and should be a line item.
• Azure migrations: ~1 day per straightforward VM (replicate, test, cut) plus network/DNS design; AVD and ExpressRoute are their own multi-day designs.