Book a consultation

Identity.

Microsoft 365, Google Workspace, Entra, and AD. MFA, conditional access, DMARC at enforce.

Book a consultation All services

01Overview

C:\HOWL\SOLUTIONS\SERVICES\IDENTITY\

Identity is where most IT problems hide. We design and deploy identity stacks across Microsoft 365, Google Workspace, Entra, Active Directory, and the hybrid environments most businesses actually run. The boring parts (MFA, conditional access, password policy) configured without breaking the people who use them, and the email security layer done properly.

 ONE IDENTITY, EVERY DOOR

     you ───▶ ┌─────────┐
              │ [ MFA ] │
              └────┬────┘
        ┌─────────┼─────────┐
        ▼         ▼         ▼
   ┌────────┐ ┌────────┐ ┌────────┐
   │ M365   │ │ NETWORK│ │ DOORS  │
   └────────┘ └────────┘ └────────┘

 one lifecycle: joiner, mover, leaver

 // disable once. locked out everywhere.
FIG 01 · ONE IDENTITY, EVERY DOOR

02Microsoft 365 administration

C:\HOWL\SOLUTIONS\SERVICES\IDENTITY\MICROSOFT-365\

Tenant configuration, governance, and the operational work that turns a Microsoft 365 license into a working productivity environment.

What’s included

  • Tenant configuration and licensing review
  • SharePoint and Teams governance, sprawl cleanup, and information architecture
  • Exchange Online configuration, shared mailboxes, distribution lists
  • Mobile device management with Intune
  • Compliance and retention policies
  • Admin role hygiene and least-privilege design
 A LICENSE ISN'T AN ENVIRONMENT

 C:\M365> audit
 sharepoint ..... sprawl found
 teams .......... unowned rooms
 exchange ....... undocumented

 C:\M365> configure
 governance ..... [ OK ]
 intune mdm ..... [ OK ]
 retention ...... [ OK ]
 admin roles .... least-privilege

 // the operational work that makes
 // it a working environment.
FIG 02 · A LICENSE ISN'T AN ENVIRONMENT

03Google Workspace administration

C:\HOWL\SOLUTIONS\SERVICES\IDENTITY\GOOGLE-WORKSPACE\

Tenant configuration, shared drive design, and the operational work that turns a Google Workspace subscription into a working productivity environment.

What’s included

  • Tenant configuration and license review
  • Shared drives architecture and access controls
  • Groups, aliases, and email routing
  • Mobile device management
  • Security controls (2SV enforcement, context-aware access, DLP where it fits)
  • Admin role hygiene and least-privilege design
 STRUCTURED, NOT SPRAWLED

 SHARED-DRIVES\
 ├── STAFF\ ......... named access
 ├── PROJECTS\ ...... per-team
 └── ARCHIVE\ ....... read-only

 2sv ............. enforced
 context access .. where it fits
 admin roles ..... least-privilege

 // a subscription isn't an
 // environment either.
FIG 03 · STRUCTURED, NOT SPRAWLED

04Identity stack

C:\HOWL\SOLUTIONS\SERVICES\IDENTITY\IDENTITY-STACK\

Entra, Active Directory on Windows Server 2025, hybrid identity, Windows Hello for Business, and the UniFi Identity integration for clients running UniFi. We design the stack so the cloud and on-prem sides authenticate the same user the same way.

What’s included

  • Entra tenant design and configuration, including hybrid join planning
  • Active Directory on Windows Server 2025: fresh deployments and clean-ups of inherited domains
  • Hybrid identity: Entra Connect, password hash sync, hybrid join, seamless SSO
  • Windows Hello for Business deployment and policy
  • UniFi Identity integration for clients running UniFi
 ONE USER, BOTH SIDES

 ┌─ CLOUD ────────┐  ┌─ ON-PREM ──────┐
 │ ENTRA          │  │ AD / WS2025    │
 └───────┬────────┘  └───────┬────────┘
         └────── sync ───────┘

 same user, same way, both sides

 hello for business · unifi identity

 // the cloud and on-prem sides
 // authenticate the same user
 // the same way.
FIG 04 · ONE USER, BOTH SIDES

05Email security

C:\HOWL\SOLUTIONS\SERVICES\IDENTITY\EMAIL-SECURITY\

We harden email properly. SPF, DKIM, DMARC (set to enforce, not just monitor), MTA-STS, and BIMI where it adds value. We’ll audit what you have, fix the gaps, and document who needs to do what to keep it clean.

What’s included

  • SPF, DKIM, and DMARC configuration moved to enforce, not just monitor
  • MTA-STS and TLS-RPT for inbound mail integrity
  • BIMI where it adds brand value and the prerequisites are met
  • Lookalike domain monitoring and registration of defensive variants
  • Documentation of every record, every change, and the operational handoff to whoever maintains DNS
 AT ENFORCE, NOT MONITOR

 your mail ──▶ SPF ──▶ DKIM ──▶ DMARC
                                  │
 delivered, signed ◀──────────────┘

 spoofed mail ......... [ !! ] rejected

 mta-sts ....... inbound integrity
 lookalikes .... monitored, registered

 // authentication that actually
 // authenticates.
FIG 05 · AT ENFORCE, NOT MONITOR

06Access controls

C:\HOWL\SOLUTIONS\SERVICES\IDENTITY\ACCESS-CONTROLS\

The boring parts of identity, configured so they protect without breaking people. Conditional access policies that fit the threat model. MFA enforced where it matters. Password policy that meets compliance without 90-day rotations.

What’s included

  • Conditional access policies tied to risk signal (location, device compliance, sign-in patterns)
  • MFA enforcement strategy: phishing-resistant where available, fallback paths that don’t undercut the policy
  • Password policy that meets compliance without forcing 90-day rotations
  • Privileged access review and standing-admin reduction
  • Documentation of every policy, every exclusion, and the rationale behind it
 PROTECT WITHOUT BREAKING PEOPLE

 sign-in         │ policy says
 ────────────────┼───────────────
 known device    │ let through
 new location    │ mfa, phishing-
                 │ resistant
 risky pattern   │ blocked

 passwords ...... no 90-day churn
 standing admin . reduced

 // every policy documented, with
 // the rationale.
FIG 06 · PROTECT WITHOUT BREAKING PEOPLE

Want to talk through a identity project?

Book a consultation All services