Microsoft 365 Services
Five kinds of work, all of it inside Microsoft 365. Narrow on purpose — it is the only way to be genuinely deep in something.
Microsoft 365 Security Hardening
Multi-factor authentication enforced across every account including the owner’s, conditional access policies that fit how your staff actually work, legacy authentication switched off, mailbox auditing turned on, and auto-forwarding rules brought under control. Most tenants arrive with these left at their defaults — we work through them methodically and document what changed.
Compliance Readiness
We help practices meet their HIPAA Security Rule obligations as they apply to Microsoft 365 — access controls, audit logging, retention, encryption in transit and at rest, and the documentation that shows the work was done. The same configuration and evidence answers most cyber-insurance questionnaires and client security reviews.
Migrations & Tenant Work
Email and file migrations into Microsoft 365, tenant-to-tenant moves after an acquisition, domain and licensing changes, and the offboarding cleanup that usually gets skipped. Project work is scheduled after hours so it lands without taking a day out of your calendar.
AI & Workflow Automation
Microsoft 365 already includes automation most small businesses never switch on: Power Automate for the repetitive admin work that eats afternoons, and Copilot where it genuinely earns its licence. The order matters, though. Copilot surfaces whatever a user already has access to — so in a tenant where everyone can open everything, it will cheerfully surface the wrong document to the wrong person. Getting permissions right first is what makes turning AI on a good idea rather than a liability.
Ongoing Management
Configuration drifts. Staff join and leave. Microsoft changes defaults and adds features you now own. Ongoing management covers user onboarding and offboarding, license right-sizing as headcount moves, review of new security settings as they ship, and a periodic re-check of the posture we established.
Compliance experience, not just configuration
I've completed NIST and HIPAA compliance audits that law firms, medical and optometry practices, and accounting firms used to meet their cybersecurity and cyber-insurance requirements, and I led an IT services company through SOC 2 from readiness to a completed audit. Smaller offices with little day-to-day PHI get a standard NIST baseline; practices with real HIPAA exposure get the full review.
The process is the same every time: an as-is assessment, a review of what the data shows, a fiscally responsible plan, the implementation, and ongoing monitoring for long-term clients. You hear about risk, penalties and consequences. Not jargon.
Not sure where to start?
Start with the Microsoft 365 Security & Licensing Consultation — a working session and a written report telling you which of these you actually need.