Cloud workspace architect

• About 40 people, one office, working hybrid.
• Devices: Both. Email today: an email server in the office. Files today: a file server in the office.
• Security: MFA for everyone.

• People: About 40 people, between home and the office.
• Devices: Windows laptops and Macs, plus phones for email and sign-in prompts.
• Connectivity: One office’s internet line, plus home connections.
• Identity and sign-in: One account per person, with multi-factor authentication for everyone.
• Email and calendars: Cloud mailboxes, migrated from the email server in the office.
• Chat and meetings: Team chat, video meetings and calling, tied to the same accounts.
• Files and sharing: Team sites or shared drives, replacing the file server’s shares.
• Shared mailboxes and calendars: Shared addresses (such as info@ or accounts@), room and team calendars.
• Security controls: Email protection, sign-in alerts, and protection on every device.
• Backup and recovery: A separate backup of mailboxes and files, with restores tested.
• Administration and support: Licences, joiners and leavers, and a service desk for about 40 people.

• Conditional access: People sign in from home and on the move, so it’s worth controlling which devices and places are trusted.
• Device management: Managed devices can be set up, updated and wiped centrally; without it, every laptop is set up by hand.

• Every service depends on identity: get accounts, groups and MFA right first.
• Conditional access depends on identity and sign-in and device management.
• Device management depends on identity and sign-in and devices.
• Security controls depends on identity and sign-in and email and calendars.
• Backup and recovery depends on email and calendars and files and sharing.

• Discovery and inventory: Know what you have before you move any of it.
• Identity and tenant preparation: Set up the accounts, the domain and security before anyone moves.
• Information architecture and permissions: Decide where things will live and who can open them.
• Pilot and validation: Move a small group first, and learn from it.
• Migration: Move everyone else in planned batches.
• Communication and adoption: Make sure people know what changes, and when.
• Post-migration checks: Prove nothing was lost and everything works.
• Operational handover: Hand over a workspace someone can run.

• The switch of mail delivery, and retiring the old server cleanly.
• Two device platforms to manage and support.

• Who owns your domain name and its DNS today?
• Which licences and contracts do you already have, and when do they renew?
• How much data is there, and how much of it is still used?
• What else depends on the email server: scanners, applications, website forms?
• Which applications use the file server directly?
• Who buys and owns the devices, and how are they set up today?

• Licensing: which plans fit these needs and any existing contracts.
• Security settings: conditional access, MFA methods and data protection.
• Data protection and regulatory obligations for your records.
• Migration tools and timing for your actual data volumes.

Platform-neutral: Microsoft 365 and Google Workspace both provide these components under different names. Which suits you depends on what you already use, your devices, applications and contracts. No prices or licence advice are given here.