How fixed-scope engagements work
- Discovery: a short scoping call and review of your environment to confirm size, risks and goals.
- Proposal: written scope, deliverables, timeline and a fixed price.
- Delivery: the work is done by your assigned US-based specialists, with structured check-ins.
- Handover: documentation and knowledge transfer so your team can run what was built.
- Support: an optional retainer if you want help after the project ends.
Microsoft 365 security hardening
Businesses whose tenant grew fast and now has weak MFA coverage, broad admin rights or no Conditional Access.
Typical duration: 4 to 8 weeks (about 6 weeks for a tenant of around 350 users; set after discovery)
Scope
- Review sign-in methods, MFA coverage and legacy authentication use
- Design and roll out Conditional Access policies in report-only mode first
- Reduce standing admin rights and set up emergency access accounts
- Tighten Defender for Office 365 anti-phishing and Safe Links settings
- Check SPF, DKIM and DMARC for your sending domains
- Review external sharing and guest access defaults
Deliverables
- Conditional Access policy set, documented and enforced
- Admin role map with named owners
- Before and after Secure Score summary
- Runbook for break-glass accounts and policy exceptions
Tenant-to-tenant migration (M&A)
Organizations that need to consolidate or split Microsoft 365 tenants after an acquisition, merger or divestiture.
Typical duration: 6 to 12 weeks (about 8 weeks for around 1,200 users in 6 waves; set after discovery)
Scope
- Inventory mailboxes, OneDrive, SharePoint sites, Teams and domains in both tenants
- Plan identity mapping, UPNs and domain cutover
- Set up cross-tenant migration tooling and coexistence such as shared free/busy
- Move users in planned waves with pilot users first
- Handle domain moves, MX records and Autodiscover at cutover
- Decommission or reduce the source tenant after sign-off
Deliverables
- Migration plan with wave schedule and rollback steps
- User communication templates for each wave
- Cutover and validation checklists
- Handover documentation for the target tenant
Google Workspace to Microsoft 365 migration
Companies moving mail, calendar and Drive from Google Workspace into Microsoft 365.
Typical duration: 4 to 8 weeks (about 5 weeks for around 180 people; set after discovery)
Scope
- Inventory Gmail, Calendar, Drive and shared drives
- Map Drive and shared drives into SharePoint and Teams, not only OneDrive
- Set up identities, licensing and sign-in before users move
- Run a pilot group, then migrate in batches
- Cut over MX records and run coexistence during the move
- Provide role-based user guidance and hypercare after cutover
Deliverables
- Data mapping plan from Google to Microsoft 365 locations
- Cutover runbook and validation checklist
- User quick-start guides by role
- Handover notes for your IT team
Exchange Server exit to Exchange Online
Organizations still running on-premises Exchange Server that want to move mail to Exchange Online and retire the servers.
Typical duration: 4 to 10 weeks depending on mailbox count and relay dependencies (set after discovery)
Scope
- Inventory mailboxes, shared and resource mailboxes, and archives
- Find every app, scanner and device that relays mail through Exchange
- Choose hybrid or cutover migration based on size and identity setup
- Move mailboxes in planned batches
- Repoint mail flow, MX records and Autodiscover
- Plan the path to retire or minimize the last Exchange server
Deliverables
- Mail relay and dependency inventory
- Migration plan and batch schedule
- Mail flow design for apps and devices after the move
- Decommission checklist
Intune and Autopilot rollout
Businesses that want new and existing Windows devices managed from the cloud instead of imaged by hand.
Typical duration: 6 to 14 weeks (about 12 weeks for around 280 devices across 11 locations; set after discovery)
Scope
- Review current device management, Group Policy and imaging
- Set up Intune enrollment, compliance policies and configuration profiles
- Configure Windows Autopilot for new and replacement devices
- Package and deploy core apps through Intune
- Set update rings for Windows and Microsoft 365 Apps
- Move existing devices in controlled waves
Deliverables
- Intune policy and profile set, documented
- Autopilot deployment profile and device onboarding guide
- Wave plan for existing devices
- Admin runbook for day-to-day device tasks
Teams Phone deployment
Organizations replacing an on-premises PBX or hosted phone system with Microsoft Teams Phone.
Typical duration: 4 to 12 weeks depending on sites, number porting and call flows (set after discovery)
Scope
- Inventory numbers, sites, call flows and devices
- Choose Calling Plans, Operator Connect or Direct Routing
- Design auto attendants and call queues
- Set emergency addresses and emergency calling policies
- Plan number porting and cut sites over one at a time
- Train receptionists and users
Deliverables
- Number map and call flow design
- Site cutover plan with pilot site first
- Emergency calling configuration record
- User and admin guides
Microsoft 365 Copilot or Claude readiness and rollout
Businesses that want to roll out Microsoft 365 Copilot or Claude to staff with data access and usage rules in place first.
Typical duration: 4 to 10 weeks depending on data cleanup and pilot size (set after discovery)
Scope
- Review SharePoint, OneDrive and Teams sharing for oversharing risk
- Check sensitivity labels and data protection settings
- Draft an AI acceptable use policy with your team
- Set up licensing, admin controls and access for a pilot group
- Run a pilot with defined use cases and gather feedback
- Plan the wider rollout and user training
Deliverables
- Oversharing findings and fix list
- AI acceptable use policy draft
- Pilot plan and pilot summary
- Rollout plan and user guidance
Common questions
Not sure where to start?
Book a free consultation with a US-based specialist. If a project makes sense, you get a written plan with scope, a fixed price and a timeline.
Book a free consultation