What good IT looks like in practice.

The Challenge

A staff member signed in during an ordinary working day, on their own machine, on the office network. The password was strong. Multi-factor authentication was enabled and it worked. The account was compromised anyway.

The attack was adversary-in-the-middle: the attacker sat between the user and the real Microsoft sign-in page, relayed every step to the genuine service, and kept a copy of the session token issued after MFA succeeded. Nothing about the sign-in looked unusual, because nothing about it was unusual.

What We Did

• Detection fired automatically and the account was locked while the attacker was still in the mailbox
• Found and removed a device the attacker had registered against the account — the access that survives a password reset
• Found a hidden inbox rule created to silently delete mail from one company, so a conversation could be conducted without the real owner seeing it
• Reconstructed the intrusion timeline independently from the tenant evidence rather than relying on the security vendor’s summary
• Revoked sessions, reset credentials, and reviewed every other account in the tenant for the same pattern
• Wrote the findings up so the same attack is recognisable next time

The Result

• The lesson we took from it is on the blog: resetting the password does not remove a registered device
• Conditional Access rules restricting device registration were tightened afterwards, here and across the wider estate

The Challenge

Offboarding had never been a defined process. When someone left, their manager told whoever was around, and the account stayed as it was. Over several years that produced a tenant where nobody could say with confidence which accounts belonged to current staff.

Alongside it, email addresses had grown organically — role addresses, short forms, initials, inconsistent spellings — so mail sometimes reached the wrong person or nobody at all.

What We Did

• Pulled the full account roster and put it in front of HR rather than guessing from the directory
• Had HR mark each person as current, departed or on leave — their decision, recorded in writing, not ours
• Removed licences from departed accounts while preserving the mailboxes, so nothing was destroyed in the process
• Standardised addresses to a single First.Last convention and kept the old addresses as aliases so nothing in flight bounced
• Notified every affected person individually before their address changed
• Scripted the whole run so it was repeatable and auditable rather than done by hand

The Result

• Recurring licence spend dropped immediately, with no service change for anyone still working there
• Offboarding now has a defined process, so the problem does not rebuild itself
• No mailbox was deleted — departed staff data stayed retrievable, which matters for access requests and disputes

The Challenge

Staff signed in twice: once to a legacy on-premises domain for files and printing, once to Microsoft 365 for mail and documents. Two passwords, expiring on different schedules, with a help desk call every time they drifted apart.

The organisation also needed staff to work from more than one site without carrying data on laptops, and the on-premises domain name no longer matched what the organisation was called.

What We Did

• Deployed cloud desktops so staff reach the same environment from any site, with data staying in the tenant rather than on the device
• Connected the on-premises directory to Microsoft Entra ID so one identity and one password covers both
• Enabled single sign-on to the cloud desktops and verified it against real user sessions, not just a working config screen
• Replaced open management ports with brokered administrative access
• Sized the session hosts and set autoscaling so capacity follows the working day instead of running flat out
• Had the migration runbook independently reviewed before execution — the review found problems, and the plan was rewritten before anyone touched production

The Result

• One password for everything, and the password-mismatch help desk calls stopped
• Staff work from any site with nothing sensitive stored on the endpoint, which also makes a lost laptop a much smaller event
• The working configuration and its evidence are documented, so it can be rebuilt or handed over without archaeology
• Administrative access no longer depends on exposed remote-desktop ports

The Challenge

We took over an existing Azure Virtual Desktop environment. It ran, users could sign in, and on paper everything was covered. Under inspection it was not.

A migration some months earlier had moved the user profile share. The backup job was never repointed, so for roughly three months it had been faithfully protecting a share that no longer held anything. Backups were green. There was nothing in them.

Separately, every user on the domain could read and write every other user’s profile container — the file that holds their desktop, documents and saved sessions. We found no sign that anyone had used that access; they simply had it.

What We Did

• Repointed the backup to the live profile share and put it on a four-hourly schedule
• Rewrote the share permissions so a user can reach their own profile and nobody else’s, then confirmed it with a real sign-in rather than a settings screen
• Removed Everyone: Full Control from the finance file share and replaced it with the finance group only — granted first, revoked second, so the share was never left without access
• Checked for service accounts that would break before touching those permissions, and found none at risk
• Resized the session hosts and verified the new capacity from inside the guest, not just in the portal
• Moved the autoscale shutdown an hour earlier, because the last user of the day signs off around four
• Cleared the wreckage of earlier work: a dead storage account, stale images, an orphaned network interface, and sixteen computer objects in Active Directory for five real machines
• Granted tenant-wide sign-in consent so users stop being asked to approve a permission prompt every session

The Result

• Every fix was confirmed by a real user signing in and working, because a correct configuration screen is not evidence
• One idle licence was handed back after two unused desktops were retired
• The environment is now documented, so the next person does not have to work out which parts are load-bearing

The Challenge

During a routine audit across every server we manage, one was flagged as claiming Azure Hybrid Benefit — a discount that requires eligible Windows Server licences you already own, with Software Assurance or a qualifying subscription licence, applied to servers running in Azure.

There was no qualifying entitlement behind it — no Software Assurance and no subscription licence that conveys Windows Server rights. Nothing recorded anywhere, and the subscription type in use conveys no Windows Server licensing on its own. The setting had been switched on at some point and nobody had checked whether it was allowed. It had been quietly saving money it was not entitled to save.

What We Did

• Checked the licensing attribute on all ten servers across the three tenants, rather than assuming the one we noticed was the only one
• Confirmed there was genuinely no entitlement before changing anything — the answer could have been that paperwork existed and was simply unrecorded
• Turned the claim off and verified by reading the setting back afterwards
• Told the client what correcting it would cost them, before doing it
• Wrote the correct position into our documentation so nobody helpfully switches it back on later

The Result

• The money here is not the point. Correcting it added a few dollars a month — trivial next to being asked in an audit to produce entitlement for a discount you have been claiming for years
• Unwinding an unsupported claim after someone else finds it is a different conversation entirely, and a more expensive one
• No downtime — it is a billing attribute, so nothing needed restarting
• The other nine servers were confirmed correct in the same pass, so the question is settled rather than open

The Challenge

Organisations across Northern Ontario that look nothing like each other but all need a phone to ring in the right place: band administration offices, health clinics, schools, lands and resources departments, trucking and drilling operations, mental health services and housing providers.

The requirements genuinely differ. A clinic needs calls answered and routed with discretion. A school needs a receptionist who can reach a classroom. A trucking dispatcher needs to be found wherever they are. A housing or mental health provider takes calls that matter, from people who will not ring back if nobody answers.

What they share is geography. Buildings spread across the region, some on connections you would not find in a city. Systems this size do not fail loudly — they degrade quietly. A site gateway drops off and nobody notices until somebody tries to ring that building, staff counts drift past what the licence covers, and a menu tree nobody has revisited in years still routes callers to a role that no longer exists.

What We Did

• Designed and run hosted 3CX across all of them, with a session border controller at each site so a building keeps working on its own connection
• The two largest run roughly 99 and 142 extensions — around 85 desk phones at one — with reception queues, ring groups and auto-attendants per department
• Departmental routing that matches how each organisation actually works, rather than one template stretched over eight different kinds of organisation
• Carrier service supplied through our own VoIP division rather than a third party we cannot get on the phone
• Handsets, cabling and site network work done by the same team, so nobody gets told the problem belongs to somebody else
• Quarterly reviews that actually pull the live system rather than repeating last quarter’s document
• Each review reports call volumes, per-extension activity, handset inventory, gateway health and licence position — in plain language, to people who are not telecom engineers

The Result

• The most recent reviews found three site gateways showing no registered handsets, and both systems running more staff than their licence covered — neither had been reported by anyone, which is exactly why the review exists
• Twenty-four thousand voicemails sit on one of these systems, which is its own argument for why call handling has to be right
• We would rather tell a client their licence count has drifted than have them find out from the vendor