Thank you so much for reading my blog about: How to build your modern workplace with Microsoft 365. In this article I've written a high-level approach of an implementation and shift from a more traditional organization towards a cloud focused organization. I would love to receive feedback in the comments, on LinkedIn or Twitter.
This blog describes the strategic, high-level possibilities of Microsoft 365. Also read the high-level technical implementation of M365 and The value of Microsoft 365 E3 and E5.
Strategy and vision
Welcome in 2021! The world has changed since the last pandemic. Organizations are struggling to anticipate better on their workforce to help and achieve their ultimate goals.
To collaborate better, to get in contact differently than before, a more modern approach is necessary — change is required.
It is a huge challenge for CIOs, CTOs and IT Managers since the world has shifted into a new era. Working differently has become a new standard. And the change driver is from the outside towards inside. It is happening — there is no way not to accept the signals. There is no way not to change to stay relevant, to stay in a leading position in a disruptive market.
When mapping these challenges on the real technological needs I've summed up some topics that will come back in this article later on. The main challenges are:
- To connect people to collaborate in a different way with new technical possibilities — keeping in mind that the experience needs to be great. It should be simple. Transparent. Team driven, no individuality.
- To use proven standards that do work — because they are used in multiple organizations. The slowness of not believing these standards and references and going the own way is killing organizations. This results in slow implementation speed, lack of confidence and trust which results in over-thinking. And conclusion: failing.
- To provide the right tools that do work for organizations — in a modern world — without the fence of physical locations and more importantly with the same security level as in the early on-premise days.
- To be fast enough and accelerate your business goals. Timing = everything.
- To get your security maturity in order, better, safer, to grow to a technically safer workplace — this is more important than ever. If you see the cyber risk trends growing, something needs to change.
Companies are working differently than before. And I truly believe that the one that is most adaptable to change will survive.
The traditional corporate infrastructure is isolated from the outside world
As you can see in this picture brought by Microsoft in the Zero Trust concept — organizations did build great solutions in their datacenters on their premises. Decentralized redundant datacenters with everything in place to have their DRP and failover working great. I'm not bashing on smart people who did a great job fixing these massive complex integrations to keep everything running 24/7.
The problem is, the solution is… Organizations did a great job on their premises to get everything working great. But the world has changed.
Disruptive cloud organizations as Microsoft, Amazon and Google came with scalable and relatively quick-deployable solutions. Solutions that didn't require the technical need of the on-premise or 'self-owned' infrastructure. SaaS solutions that were isolated from these corporate environments with plug-and-play capabilities — and this is the most important aspect of it all. Solutions for organizations, to achieve more. To get to the ultimate goals of these organizations. Non-technical driven scenarios, business cases and business scenarios.
Imagine a new Office 365 customer in a cloud scenario with Exchange, SharePoint, Teams and mobile device management. They can start after some hours of implementation in M365. Imagine this setup on-premises. How long will it take? Perspective = everything.
A new concept of layered approach which kills the fish tank within corporate infrastructure
In the picture below you will see the corporate datacenter with all servers running in a virtualized state, segmented with additional security solutions. Segmentation on networking, storage and many more services. It's so extremely complex. One mistake could impact everything. Next to mistakes: ransomware, targeted attacks, phishing attacks, and all other bad actors took this opportunity to infiltrate and bring this infrastructure down.
Microsoft didn't invent the layered approach when it comes to Identity, Devices, Services, Data and Network. It's no new model nor real solution that fixes any problem. No, it's a way of understanding and integrating your assets to bring them in a layered solution where each layer cannot touch the asset next to it. The right conclusion: Layered approach.
Building your foundation identity management solution
Almost every organization started with Microsoft Active Directory Servers/services with Windows 2000 or Windows Server 2003. Cloud solutions came disruptively like BPOS, Office 365 — and we integrated our current infrastructure with Identity federation solutions like Microsoft FIM to provision on-premise active-directory accounts towards Azure Active Directory. Later the process was well optimized with Azure AD Connect.
Azure Active Directory is different from Active Directory on-premise. It has more features and a better security baseline. The options are there to start with a better secure platform. Building blocks. Easier for activations — for example: Azure AD Security Defaults. Maximum value, less complexity, faster implementation speed.
Enterprise hybrid cloud solution to extend to Office 365 and Azure
Before 2020 a lot of organizations shifted workloads from their on-premises infrastructure to Office 365. The most common workload was Exchange On-premise to Exchange Online. Later these workloads shifted across the Office 365 landscape:
- File servers became → OneDrive, SharePoint or Microsoft Teams
- SharePoint on-premise → Hybrid → SharePoint Online
- Mail/Exchange on-premises → Exchange Online
- Voice/Skype to hybrid Skype → Skype Online → now Microsoft Teams with PSTN, Direct routing and all voice capabilities
As you see — once the biggest workloads are migrated on paper there is nothing left except application servers, other e-mail systems, voice solutions and other solutions. Old legacy — phase it out, migrate to different solutions. Focus long-term. Focus strategic.
Endpoint devices and future-proof device management
Microsoft Endpoint Manager is a combination of SCCM + Intune — to get the best of both worlds. Manage workloads from cloud and on-premises. The possible scenarios for managing your endpoint devices:
- SCCM only or third-party solutions
- SCCM Co-Management with Endpoint Manager
- Endpoint Manager only
I'm a total fan of going for Endpoint Manager in the cloud-only world. Because if you're new to modern management you have the opportunity to use your hybrid identity (from on-premises) and your cloud-only joined Azure AD Windows 10 workstation. Here's why:
- First reason: The configuration and implementation is easy. Creating simplified standard solutions to manage Windows 10 Devices is so important. Standard sets in Intune that are on or off. It helps the dialogue and complex discussions at high speed.
- Second reason: Mobile device management with basic functionality is very easy and transparent with Endpoint Manager. You need scenarios for BYOD, CYOD, COPE and COBO. Are you able to securely work on your mobile applications and protect your company's IP? Do you know where your company data is located?
- Third reason: Security maturity and implementation — BitLocker activation, Windows Hello For Business, easy activation. Segmentation of the device layer is important to prevent lateral movement.
- Fourth reason: No hybrid complexity, easier staging with Windows Autopilot. Staging from anywhere.
- Fifth reason: Go cloud. If you have no on-premises infrastructure left and are able to go without traditional domain controllers to Azure AD or ADDS — the baseline is the most important real touchable factor.
Services, servers and infrastructure
It's all about responsibility, complexity, standards, governance, and the way of stabilising your business-critical systems.
As you can see — the shift of on-premise servers, appliances and services running Windows Server or different operating systems means ownership is fully in the organisation's hands. The downside in general is security. It's difficult to segment, patch, upgrade, update and keep track of risks in the attack chain.
Example: Azure File Server, Azure SQL — not Windows Server 2016 running SQL instances. Just a SaaS solution. Easier for technical workers.
Data (documents)
Data maturity. Automatic processing. Automation. Document data is crucial and needs protection. Data is the core of every organisation. And still we are sending documents over e-mail, sharing over third-party solutions that are not trusted. We need a consolidated approach to fix the document data 'problem' and discover security risks and compliance issues. We need to take back control of corporate data.
- Trust / Platform / Decide → Choose Microsoft. If you chose Office 365 to collaborate better and you don't trust the environment you made the wrong choice. Use the technology to make your environment more secure.
- Migrate personal documents to OneDrive, organisational documents to SharePoint or Teams, and other application data to Azure File Server.
- The main reason is data control. When file servers and local copies are gone, Microsoft 365 cloud can deliver automated labeling and classification — or at least insights on confidential data.
- Cloud App Security can help you remediate and take actions when necessary, discover document flows and set rules on documents when the risk of data leakage is valid.
- Security and governance in Microsoft 365 is hard. But it's even harder if you also have on-premises resources and non-controlled instances. The advantage of O365-only is actionable insights.
Network
I'm not a network specialist. But what I do know is that because of this 'gap' of IT-Pros, the opportunity for hackers rises. If you are able to shift all workloads to Microsoft 365 the network part — and the network security — will become less important when it comes to information breaches and core infrastructure is gone on-premises.
Every organisation needs stable network, shaping, priorities and everything else to regulate network infrastructure. It is super important. But we need to stop trusting our own networks as much as we did before. Because the silo walls are gone. The crucial organisation data has shifted elsewhere.
Strategic modern workplace decisions
Strategic long-term definitions are important to set milestones to grow to a real modern workplace. Most of the time we are delivering workplace optimisations for just 20% of the possibilities and needs.
- Shifting all traditional infrastructure to Azure and Microsoft 365 is crucial for the long-term. For future-proof architecture.
- Buy-in of the business has become one of the most important steps in building a great workplace. If you are talking to IT staff only…
- Modern Management is a part of a workplace — for managing assets, devices, updates, applications and deployment. But we make this the most important part. It's the easy part.
- Security baselines became important to get easier packages with big value, low cost, maximum impact. Building blocks to implement to get your organisation to a higher security level.
- Consolidation and migration to Microsoft 365 gives control to start with Unified Classification of documents and rich integration with, for example, Power Platform. It creates insights to get things in order.
- Real communication and collaboration is possible from anywhere if you've brought all services from on-premises to Microsoft 365. Using Teams with an on-premise Exchange? What's the strategy for that?
There is no room for traditional workloads when your strategy is to invest in security optimisations. There is no room for traditional Exchange, SharePoint and file servers when you want to be a flexible cloud company.
We have seen the world changing. The choice now is:
- Would you be the company that is prepared for the next trends of working from anywhere — with a future-proof architecture to build on, to grow security, data maturity and easiness of future integration?
- Would you go back and use the old tech? Until your organisation is irrelevant because someone will change faster someday.