INSIGHTS
What we check, and what we’d tell you not to do.
24 notes from the work itself — Microsoft tenants, Zero Trust rollouts, and the websites and applications we build. No case studies, no client names, just the detail that makes these projects go well or badly.
MICROSOFT
Microsoft managed services
- 5 min read
What a Microsoft 365 tenant assessment actually looks at
The eight things worth checking before anyone proposes a migration, a security project or a licence change.Read - 5 min read
Choosing a Microsoft partner: what the badges do and don’t mean
Partner tiers describe a company’s relationship with Microsoft, not the quality of the engineer who will be in your tenant.Read - 5 min read
Joiner, mover, leaver: the offboarding gap in most tenants
Onboarding gets automated because people complain when it is slow. Offboarding stays manual because nobody is waiting for it.Read - 5 min read
Intune device compliance without locking people out
A compliance policy that blocks the wrong person on a Monday morning gets switched off by Tuesday. Here is how to avoid that.Read - 5 min read
Licensing drift: how Microsoft 365 spend grows quietly
Nobody decides to overspend on licences. It accumulates from decisions that were each reasonable at the time.Read - 5 min read
Azure landing zone: what you commit to on day one
Subscription layout, naming and network addressing are cheap to decide and expensive to change. Most other things are the reverse.Read - 5 min read
Copilot and Microsoft AI: what has to be true in your tenant first
Copilot respects the permissions you already have. That is the feature, and for most tenants it is also the problem.Read - 5 min read
Managed Microsoft services: what belongs in the service level
Response time is the easiest thing to put in an agreement and the least useful thing to measure a provider by.Read
SECURITY
Cybersecurity
- 6 min read
What a Zero Trust consultant actually does in the first 30 days
Not a product rollout. Four weeks of establishing what your identity, device and access position actually is.Read - 5 min read
Zero Trust is a sequence, not a product
The order matters more than the tooling. Do identity before devices, devices before applications, and measure between each.Read - 5 min read
Conditional Access policies worth having before anything else
Six policies cover most of what a mid-sized tenant needs. The seventh is the one that keeps you locked out.Read - 5 min read
MFA isn’t finished when you switch it on
Coverage, method strength and the exemption list are three separate problems, and only the first one is ever reported.Read - 5 min read
How to choose a Zero Trust implementation partner
The proposals will look similar. These are the questions that separate them.Read - 5 min read
What a vulnerability scan with 4,000 findings is telling you
Mostly that you ran a scanner. Severity is a property of the vulnerability, not of your risk.Read - 6 min read
Readiness, not certification: Cyber Essentials, Essential Eight, NIS2
Knowing which frameworks certify, which are self-assessed and which are law changes what you should be asking a supplier for.Read - 5 min read
Offboarding is a security control
If you cannot produce evidence that someone’s access ended, you have a checklist rather than a control.Read
BUILD
Website & application building
- 5 min read
When a website stops being a website and becomes an application
The moment someone logs in, you are maintaining software. Most briefs are written before anyone notices.Read - 5 min read
The brief that makes a web application project go well
Six things a developer needs to know. None of them is what the site should look like.Read - 5 min read
Replacing the spreadsheet: internal tools that get used
The spreadsheet wins because it lets people do the wrong thing when they need to. Software that forbids that gets worked around.Read - 5 min read
Customer portals and the integration question asked too late
A portal is a window onto systems you already have. Whether those systems can be read is the whole project.Read - 5 min read
What launch day should include
Going live is a configuration task. The list below is what separates a launch from a handover you will regret.Read - 5 min read
Where an AI assistant helps on a website, and where it doesn’t
It is good at routing and retrieval. It is bad at being the only way to reach a person.Read - 5 min read
Building with AI vs building AI into the product
Two different things, often sold as one. Only the second changes what your software has to guarantee.Read - 5 min read
Core Web Vitals: what actually moves them
A handful of causes produce most failures, and the lab score you are optimising may not be the one being measured.Read
ONE CONNECTED PARTNER