Microsoft
Why I recommend the modern workplace identity + endpoint stack
I’ve been administering Microsoft 365 + Entra ID since 2018, through the Office 365 rebrand, the Azure AD to Entra ID rename, and the Intune consolidation under the Endpoint Manager umbrella and back out again. This is the case I make to clients evaluating their identity and endpoint stack, and the SKU traps no one in marketing prints.
Why Microsoft works
Four reasons hold up across deployments.
Identity is the perimeter
Entra ID with conditional access and MFA enforcement ships out of the box. One identity carries the user into M365, Azure, and third-party SaaS via SCIM and SAML, which means you stop maintaining six different user directories.
Blocking legacy auth in Entra ID kills the entire password-spray attack class. See the legacy auth post. Single biggest security delta you can ship in an afternoon.
One admin tenant, one bill
M365, Entra, Intune, and Defender all sit under one tenant with one billing relationship. Per-user pricing scales linearly, and you stop chasing renewals across three vendors with three calendars.
Replaced an MDM contract, a separate AV vendor, and a legacy identity tool with one M365 Business Premium tenant for a 60-user client. Net subscription cost dropped roughly 40% and the audit trail finally lived in one place.
Endpoint management ships included
Intune covers Windows natively, iOS and Android through native MDM hooks, and Mac through configuration profiles. BYOD is handled with app-based conditional access, so you can enforce policy on corporate data without fully enrolling personal devices.
Pushed a corporate VPN profile to 80 BYOD devices in 20 minutes via Intune app protection policies. Zero help-desk tickets, zero personal-data exposure.
Compliance baseline included
SOC 2, GDPR, and HIPAA controls are available at the platform level, so you inherit a meaningful chunk of audit evidence rather than building it from scratch. Microsoft Purview handles DLP, data classification, and retention from the same admin surface.
Pulled an audit-ready evidence package for SOC 2 Type II from Purview and Compliance Manager in an afternoon. The auditor accepted the bundle on first review.
Where it fits best
Not every shop. The fit is sharpest when one of these describes you:
Adding Entra and Intune on top of an existing M365 tenant is incremental work, not a migration. Same admin surface, same identity, same bill.
Intune is honest about Mac: decent, not best-in-class. Pure-Mac shops still want Mosyle or Jamf, but mixed shops with mostly Windows and some Mac get one MDM that covers both.
SOC 2, HIPAA, and ISO prep is dramatically easier when the platform carries a real chunk of the controls. Purview plus Compliance Manager carries the audit-evidence weight.
If your team already thinks identity-first (groups drive access, conditional access drives posture), Entra rewards that mental model. If they think network-first, expect a learning curve.
The honest tradeoffs
Marketing won’t print these. I have, in production. Tap to expand.
LicenseSKU complexity is genuinely hard to internalize
Business Basic vs Standard vs Premium, Enterprise E1 vs E3 vs E5, frontline F1 vs F3, plus Defender add-ons, EMS bundles, and Copilot per-user. Dozens of valid combinations, only a few right for any given client. The failure mode I see most often: customer underbought on PO 1 (usually skipping Defender for Business or AAD P1), hit a feature gap mid-year, renewed early at full list. Have your reseller price three scenarios before you sign.
AdminAdmin UX is fragmented across four portals
admin.microsoft.com, entra.microsoft.com, intune.microsoft.com, and security.microsoft.com all have slightly different conventions: different search UX, different blade behavior, different policy assignment patterns. Muscle memory doesn't transfer cleanly between them, and Microsoft moves blades around between portals every couple of releases. Bookmark deep links, document the path in your runbooks, and budget time for the next reshuffle.
MacIntune for Mac is honest but not best-in-class
Configuration profiles work, app deployment works, compliance posture works. None of it is as polished as Mosyle or Jamf, and the lag on supporting new macOS releases is real. Pure-Mac shops should keep using a Mac-native MDM. Mixed shops with maybe 20% Macs are fine on Intune. The line gets fuzzy somewhere around 50/50 and is worth deciding before you commit.
Lock-inIdentity + MDM lock-in is multi-quarter to unwind
Once Entra is your IDP, every SaaS app is wired in via SAML or SCIM, every group drives access, every conditional access policy is part of your security posture. Once Intune is your MDM, every device profile, every compliance baseline, every app deployment lives there. Switching to Okta plus Jamf is a multi-quarter project, not a weekend. Not a reason to avoid Microsoft. A reason to enter eyes-open.
None of these are dealbreakers. They're the kind of thing you want to know before you put your name on the project.
Is it right for your company?
Four dimensions to check before you commit:
- Size: 10–10,000 employees. Below 10, even Business Basic feels heavy for what most micro-businesses actually need; a small Google Workspace plan or a hosted email service is often the right answer. Above 10,000, the conversation needs a real partner with deployment muscle, not a solo consultant.
- IT maturity: At least one admin who’s lived in admin.microsoft.com. They don’t have to be MS-102 certified on day one, but they have to be the person who designs your conditional access policies and tenant baseline. Those decisions are expensive to undo six months in.
- Existing stack: Already on Office, or on Google Workspace and outgrowing the admin tooling. If you’re deeply invested in Okta, Jamf, and a separate productivity suite, switching has to clear a higher bar than “Microsoft is cheaper bundled.”
- Geography: Global. LATAM has a good Microsoft partner network, regional pricing in USD with channel margin to negotiate, and CSP partners with hands locally for first deployments. EU has the strongest data-residency story. APAC works but country specifics matter.
If three of the four match, Microsoft is on the shortlist. If all four match, it’s probably the right answer.
Who implements it
Internally, the lead implementer should be an IT admin with real M365 admin-center exposure. MS-102 (Microsoft 365 Administrator Expert) is the practical baseline for the lead, with the Identity and Endpoint admin paths layered on as the team grows. They don’t have to be the only person who touches the tenant, but they have to be the one who decides the conditional access baseline, the Intune compliance posture, and the tenant-level guardrails on day one. Those decisions are expensive to refactor once production users depend on them.
External help is worth it for first deployments and for handover training. Microsoft CSP partners do this professionally; independent consultants (myself included) do too. The reason isn’t that Microsoft is hard. The admin portals are approachable and the documentation is genuinely good. It’s that tenant-level decisions get baked into your configuration in week one, and they’re expensive to refactor in week 52. Pay once for someone who’s done this twenty times, save a year of friction.
If you’re standing up your first Microsoft 365 tenant or migrating off Google Workspace, let’s talk. Start with a 30-minute scoping call; if it’s a fit, we’ll spec a one-week engagement from there.
First steps
- Read how to block legacy authentication in Microsoft Entra ID. The fastest single action that drops your attack surface. Most password-spray attacks rely on legacy auth protocols (POP, IMAP, SMTP basic auth) that should have been off years ago. One conditional access policy, big delta.
- Pick a tier before you spec anything else. My current cutoffs:
- Business Basic — email and web Office only, no Defender, no Intune. Below ~25 users with no compliance pressure.
- Business Standard — adds desktop Office apps. Most common SMB tier when there's no security or compliance driver.
- Business Premium — adds Defender for Business, Intune, and Entra ID P1. The sweet spot for 10–300 employees that need real security posture.
- E3 + EMS E3 — enterprise tier, adds Purview compliance and Defender for Endpoint Plan 1. Mid-market and up, especially when SOC 2 or HIPAA is on the roadmap.
- Plan tenant structure and conditional access policies BEFORE you migrate anything. Tenant-level decisions (custom domain, MFA defaults, named locations, baseline conditional access, break-glass accounts) are expensive to undo once production users are signed in. Draw it on paper, get a second pair of eyes, then provision.
Beyond first steps: I take on Microsoft 365, Entra ID, and Intune deployment, migration, and audit work for SMB and mid-market clients in LATAM and remote globally. Talk to me about your deployment. I’ll tell you in 30 minutes whether it’s a Microsoft job, a Google Workspace job, or a “just fix your DNS first” job.