Work we have actually done.
Client names and identifying details withheld. We are happy to walk through any of these in detail, and to arrange a reference where the client permits it.
Incident and recovery
Mail recovered from an encrypted Exchange server
Ransomware had encrypted the client’s on-premise Exchange database. With no usable server-side mailboxes, we recovered their mail from the OST cache files left on user machines and migrated the history into Microsoft 365.
A tenant taken back after business email compromise
Sessions revoked, exfiltration rules removed, MFA reset across every affected account, then Conditional Access rebuilt so the same route in was closed for good.
Security
600+ endpoints moved to Microsoft Defender
Migration from a third-party EDR to Defender for Endpoint across an estate of more than 600 devices, phased by department with no interruption to protection during cutover. The client was already paying for Defender inside their license.
24/7 monitoring without an internal SOC
Adlumin MDR deployed across endpoints, servers and Microsoft 365, with IT Next Door filtering every alert so the client’s internal IT team hears only about verified incidents.
Security built to survive an audit
Security program for a client working under GxP quality expectations, covering endpoint protection, identity hardening, audit logging and the documentation a quality function needs to evidence control rather than assert it.
Unknown local admin accounts cleared from an estate
A review found unmanaged local administrator accounts across a multi-site client’s devices. We standardized the local administrators group by policy and split day-to-day support from security operations into separate named admin accounts, so every privileged action is attributable.
Migration and consolidation
Legacy mail and Google Workspace to Microsoft 365
Migrations from POP/IMAP hosting and from Google Workspace, moving mail, calendars, contacts and file data with the mailbox history intact. Cutovers run outside business hours with rollback prepared in advance.
Tenants split and merged around a corporate change
Following a restructure, we separated one tenant into two and merged others together — mailboxes, files, groups and identities moved to match the new shape of the business, with access correct on the first working day under the new structure.
Several acquired tenants brought into one
A client had accumulated separate Microsoft 365 tenants through acquisition, each with its own identities and licensing. We consolidated them into a single tenant so every person has one account, one mailbox and one set of policies applied to them.
The last on-premise file server switched off
Shares moved to SharePoint with the permission model rebuilt from the business structure rather than copied across. Inherited folder permissions that no one could explain did not survive the move, which was the point.
An ageing server retired instead of replaced
Rather than buy replacement hardware at end of life, we assessed the workload and moved it to Azure. The client stopped maintaining a server room and started paying for what the workload actually consumes.
Infrastructure and workplace
20+ branches on one network dashboard
A branch network built up piecemeal over the years, standardized onto a single cloud-managed platform. More than twenty sites now run the same hardware and configuration, visible from one dashboard, so a fault at any branch is diagnosed without sending anyone to look at it.
Multi-level call routing across a large site
Teams calling deployed across a multi-storey facility, with layered auto attendants and call queues so a call reaches the right floor and the right team on the first attempt instead of going through a switchboard.
80+ websites consolidated onto one platform
A single client’s web estate, spread across multiple hosting providers, brought onto one highly available managed platform with a web application firewall in front and a single point of accountability.
Day-one access, granted automatically
A client was provisioning SharePoint and Teams access by hand for every new joiner. We rebuilt the site and group structure on a consistent naming convention and drove membership from Entra ID attributes, so a new starter has the right access on their first morning without a ticket.
Cost and compliance
Duplicate security spend removed
A license review found the client paying separately for protection their Microsoft plan already included. We right-sized the plans, deployed the bundled controls properly and canceled the duplicate subscriptions. Better coverage, lower monthly cost.
The evidence pack for a cyber insurance renewal
Insurers ask specific questions: MFA coverage, backup and restore testing, endpoint detection, log retention. We assembled the evidence for each control from the systems we already run, so the renewal was answered with fact rather than best guess.
Audit logging switched on before it was needed
A client discovered mid-investigation that they had no audit history to look at. We enabled unified audit logging and set retention appropriately, so the next time the question is asked there is a record to answer it with.