2023.12.12
Year-end 2023: AI, identity, and hybrid lessons
2023 year-end: Azure OpenAI landings, Copilot permissions reality, Storm-0558, MOVEit, Entra rename, and funded priorities for the next year.
NotesArchive
Field notes archive.
Microsoft infrastructure, migrations, identity, VDI, Azure, and security — written as we ran the work (2016–2023). Current practice lives on the main notes page.
Archive
// pre-2024 field notes// 96 posts across 8 years · pick a year above or scroll the full archive.
2023// 12 posts
2023.11.14
Secure Future Initiative: what customers should ask Microsoft — and themselves
Microsoft Secure Future Initiative 2023: engineering culture signals, customer logging expectations, identity hardening, and questions for your QBR.
2023.10.17
Copilot readiness checklist: permissions first, licenses second
Microsoft 365 Copilot readiness 2023: oversharing cleanup, labels, pilot cohorts, network, and why buying seats before ACL hygiene is backwards.
2023.09.19
Microsoft Entra ID: the rename, and the operations that did not change
Microsoft Entra ID 2023 rename field notes: portal labels, Conditional Access, app registrations, and identity ops discipline under a new brand.
2023.08.15
MOVEit, Cl0p, and third-party risk for Microsoft-centric shops
MOVEit Cl0p 2023 lessons: file transfer surfaces, vendor inventory, isolation, and how Microsoft estates still get burned by non-Microsoft edges.
2023.07.18
Storm-0558 and signing-key lessons for every Microsoft tenant
Storm-0558 July 2023 field notes: consumer key abuse, mailbox access lessons, logging gaps, and what customer tenants should verify and demand.
2023.06.13
AVD FinOps in 2023: autoscale, reservations, and unit cost truth
AVD FinOps 2023: host pool unit economics, autoscale pitfalls, reservations, FSLogix storage cost, and chargeback that changes behavior.
2023.05.16
Phishing-resistant MFA mandate reality
Phishing-resistant MFA 2023: number matching is not enough, FIDO2 and WHfB for admins, legacy exceptions, and measuring authentication strength coverage.
2023.04.18
Data governance for AI: Purview and DLP readiness
Data governance for AI 2023: labeling, DLP, retention, dataset inventories, and readiness work before Copilot or Azure OpenAI touch sensitive corpora.
2023.03.21
Microsoft 365 Copilot announced: a field read for IT and security
Microsoft 365 Copilot March 2023 field read: permissions are the product, SharePoint hygiene, DLP, pilot design, and why oversharing becomes an AI incident.
2023.02.14
Azure OpenAI Service landing for regulated organizations
Azure OpenAI Service 2023 landing: subscriptions, private networking, logging, abuse monitoring questions, RBAC, and a responsible first workload.
2023.01.17
Enterprise GenAI: from panic to pilot discipline
Enterprise generative AI January 2023: shadow usage, approved Azure OpenAI paths, data boundaries, and pilot metrics that survive the board.
2022// 12 posts
2022.12.13
Year-end 2022: hybrid identity and desktop lessons that stuck
2022 year-end lessons: passwordless progress, AVD vs Citrix honesty, landing zones, token theft, and the generative AI governance wake-up.
2022.11.30
The ChatGPT moment: what IT leaders should do this month
ChatGPT November 2022 IT response: data leakage policy, approved tools, shadow AI, and a sober 90-day plan before the hype cycle eats governance.
2022.10.18
Token theft and session hijack: defenses for a Microsoft estate in 2022
Token theft defenses 2022: CA continuous access, device compliance, admin protection, legacy auth, and detection when cookies and tokens walk away.
2022.09.20
Azure Arc hybrid management: when it earns its keep
Azure Arc 2022 field notes: servers, Kubernetes, policy at scale, and when Arc is platform leverage versus dashboard sprawl.
2022.08.16
Microsoft Purview and the compliance center: a practitioner field guide
Microsoft Purview 2022 field guide: information protection, DLP, retention, eDiscovery — what to configure first without boiling the ocean.
2022.07.19
Exchange hybrid residual risk, two years after ProxyLogon
Exchange hybrid residual risk 2022: last servers, internet publish, CU discipline, and why “temporary hybrid” remains a security program.
2022.06.14
Windows 11 enterprise deployment reality in mid-2022
Windows 11 enterprise deployment 2022: hardware blocks, app compat, Autopilot, VDI images, and why rings still beat big-bang OS flips.
2022.05.17
Conditional Access hardening wave: what we enforce in 2022
Conditional Access hardening 2022: authentication strengths, legacy auth zero, device filters, continuous access evaluation, and VIP-safe rollout rings.
2022.04.12
AVD vs Citrix in 2022: a decision matrix that survives procurement
Azure Virtual Desktop vs Citrix 2022 decision matrix: multi-session Windows, FSLogix, HDX needs, cost models, and when hybrid brokers still win.
2022.03.15
Enterprise-scale landing zones without the theater
Azure landing zones 2022: management groups, platform vs app landing, policy, connectivity, and how mid-market avoids CAF cargo-cult while staying governable.
2022.02.15
Hybrid work year two: make Office 365 path optimization permanent
Hybrid work networking 2022: forced-tunnel debt, Teams media, split tunnel permanence, Secure Web Gateway conflicts, and measuring quality after the emergency.
2022.01.18
Passwordless and FIDO2 in the enterprise: a rollout that survives helpdesk
Passwordless FIDO2 enterprise rollout field notes: Conditional Access, Windows Hello, security keys, break-glass, and phishing-resistant MFA without locking out the business.
2021// 12 posts
2021.12.14
Year-end 2021: hybrid cloud lessons from a hard twelve months
2021 hybrid cloud lessons: ProxyLogon urgency, AVD rename, SfB Online end, Zero Trust basics, and what Microsoft estates should fund in the year ahead.
2021.11.16
Exchange Online security posture after a brutal year for mail
Exchange Online security after ProxyLogon year: reduce on-prem surface, MFA, legacy auth, external forwarding, and hybrid server hardening.
2021.10.19
Azure landing zone for mid-market: the minimum that still works
Azure landing zone mid-market minimum: management groups, identity, network hub, policy, and FinOps without enterprise bureaucracy theater.
2021.09.14
Windows 11 and VDI/AVD: what we are testing this fall
Windows 11 VDI and Azure Virtual Desktop testing: hardware readiness, image strategy, FSLogix, and when not to rush multi-session estates.
2021.08.17
Zero Trust for a Microsoft estate: practical steps, not posters
Zero Trust practical steps on Azure AD and Microsoft 365: identity first, legacy auth, device trust, admin tiering — without boiling the ocean.
2021.07.20
Skype for Business Online is gone: the week-after field notes
Skype for Business Online retirement aftermath: residual tickets, hybrid leftovers, rooms still broken, and closing the Teams migration properly.
2021.06.15
Windows Virtual Desktop becomes Azure Virtual Desktop. Five years of VDI, one direction
Azure Virtual Desktop rename and AVD vs WVD: from XenDesktop and RDS through WVD preview and GA to AVD — lessons from a decade of desktop delivery.
2021.05.11
Skype for Business Online's last 90 days: the final migration checklist
Skype for Business Online end of life checklist: 90 days to July 31, 2021 — voice stragglers, rooms, contact centers, assisted upgrade, if you do nothing.
2021.04.13
From SCVMM to Azure: translating a decade of private-cloud skills
SCVMM to Azure skills map: clouds and host groups to subscriptions, templates to ARM/Bicep, orchestration to Automation — what transfers and what to unlearn.
2021.03.09
HAFNIUM and ProxyLogon: a very bad month for on-prem Exchange
HAFNIUM Exchange vulnerability and ProxyLogon response: patch vs mitigate vs isolate, IOC hunting, why hybrid-minimal paid off, the last-server conversation.
2021.02.16
Zero data loss across multi-domain estates: the migration architecture
Zero data loss migration architecture for multi-domain Office 365: inventory as contract, delta-sync cutovers, verification, chain-of-custody for government.
2021.01.19
An honest anatomy of a 35% cost reduction
Cloud migration cost savings analysis: five years of programs — hardware avoidance, licensing, DR, ops hours — and where costs move instead of vanish.
2020// 12 posts
2020.12.15
Solorigate: rethinking supply-chain trust in a Microsoft estate
Solorigate response, week one: what the SolarWinds supply chain attack means for ADFS token-signing certs, federation trust, and what we audited across client estates.
2020.11.17
Hybrid identity health: AD Connect, PTA agents, and the 3 a.m. page
Azure AD Connect monitoring, PTA agent redundancy, and staging servers: how we run hybrid identity health as a tier-0 service after this year's 3 a.m. lessons.
2020.10.20
Exchange 2010 is out of support. Post-mortem on a decade-long goodbye
Exchange 2010 end of life arrived October 13. A post-mortem on why estates lag — app dependencies, relay sprawl, budget cycles — and what the late migrations taught us.
2020.09.15
Exchange 2010's final month: last-call triage
The Exchange 2010 October 2020 deadline is four weeks out. Our last-call triage: minimal hybrid express paths, what unsupported means, and compliance.
2020.08.18
Conditional Access is the new perimeter
Conditional Access best practices Azure AD: named locations, device compliance, break-glass accounts, report-only mode, and the legacy-auth kill switch.
2020.07.28
WVD's spring update goes GA: ARM portal, and what actually changed
WVD spring update ARM and Windows Virtual Desktop 2020: Azure portal objects, RBAC, autoscale improvements, migration from classic fall-2019 deployment.
2020.06.16
FSLogix profile containers in production: what breaks and what to tune
FSLogix best practices and profile container tuning: sizing, Azure Files vs file servers, Outlook cache, exclusions, and the profile-load metric we watch.
2020.05.19
Split-tunnel VPNs and Office 365: Microsoft's guidance, our field results
Split tunnel VPN Office 365 and Teams: forced tunnel failure under media load, implement optimize paths, latency wins, security objections answered.
2020.04.21
Teams at wartime scale: governance when adoption happens overnight
Microsoft Teams governance rollout under surge: pilot to company-wide in two weeks, sprawl control, external access, meeting hygiene, deliberate deferrals.
2020.03.24
The week everyone went home
Remote work infrastructure COVID surge: VPN at 4x load, emergency WVD and Citrix capacity, prioritizing critical workers, decisions in 72 hours.
2020.02.11
Sizing WVD host pools: the math that keeps costs sane
WVD host pool sizing and Windows Virtual Desktop cost field notes: users-per-vCPU by workload, load balancing, autoscale, and telemetry over vendor ratios.
2020.01.14
CVE-2019-19781: the Citrix ADC emergency, weekend edition
CVE-2019-19781 Citrix ADC mitigation field notes: what we ran on internet-facing NetScaler gateways, indicator sweeps, and trusting an appliance mid-crisis.
2019// 12 posts
2019.12.10
A decade of migrations: ten rules we never break
Migration project best practices from a decade of mail, directory, desktop, and datacenter moves: ten rules on pilots, rollback, comms, and cutovers.
2019.11.12
Ignite 2019 field notes: hybrid is the strategy, not the compromise
Microsoft Ignite 2019 takeaways for Microsoft-shop CIOs: Arc, Edge Chromium, Teams momentum, and hybrid as strategy for 2020 planning.
2019.10.15
Basic auth is going away in Exchange Online. Find your legacy clients now
Basic authentication deprecation Exchange Online: discovering legacy clients, ActiveSync fleets, service accounts, and staged modern auth enforcement.
2019.09.30
Windows Virtual Desktop hits GA: first production deployment notes
Windows Virtual Desktop GA deployment field notes: host pool sizing, image management, FSLogix in production, and cost model vs on-prem VDI.
2019.08.13
Windows 7 end of life: triage for the machines that can't move
Windows 7 end of life plan and ESU field notes: five months out, app-compat blockers, VDI containment, and network isolation for stragglers.
2019.07.30
Skype for Business Online retires July 2021. Your two-year Teams runway
Skype for Business Online retirement and Teams migration plan: coexistence modes, meeting-first moves, and why voice is the long pole.
2019.06.11
The 99.95% VDI: designing for an availability target, not a vibe
VDI high availability design field notes: where the nines are lost, N+1 pool math, user-experience monitoring, and the SLA post-mortem habit.
2019.05.14
Azure Site Recovery as the DR plan: replication, runbooks, and the annual test
Azure Site Recovery Hyper-V and DR testing field notes: recovery plans as code, real RTO measurements, and cost versus a second datacenter.
2019.04.16
SCOM in anger: monitoring 400 virtualized servers without alert fatigue
SCOM alert tuning field notes from a 400-server Hyper-V estate: management pack overrides, maintenance mode automation, and the 20 alerts that matter.
2019.03.26
Windows Virtual Desktop public preview: first build notes
Windows Virtual Desktop preview setup notes from week one: tenant and host pool model, Windows 10 multi-session behavior, FSLogix, and the gaps vs Citrix.
2019.02.12
G Suite to Office 365: what actually moves and what doesn't
A G Suite to Office 365 migration field guide: Gmail and calendar fidelity, Drive to OneDrive mapping, the Sites and Forms gaps, and coexistence that works.
2019.01.15
Exchange 2010 end of support: your 12-month runway
Exchange 2010 end of support lands January 14, 2020. A field-tested triage matrix for the migration: hybrid to Office 365, Exchange 2016, or decommission.
2018// 12 posts
2018.12.11
Tenant-to-tenant migrations: the M&A playbook
Tenant to tenant migration Office 365 and M&A IT integration: domain cutover sequencing, mail flow, BitTitan vs bodies, and identity re-homing.
2018.11.20
Microsoft buys FSLogix: profile management just got interesting
FSLogix acquisition Microsoft field notes: why VDI profiles break, what profile containers fix versus UPD and roaming, and what it means for WVD.
2018.10.23
Windows Server 2019 and Exchange 2019 are here. Should you still deploy on-prem?
Exchange 2019 vs Office 365 decision field notes: who still needs on-prem Exchange, Windows Server 2019 S2D, and the hybrid-minimal vs cloud-first fork.
2018.09.25
Ignite 2018: Windows Virtual Desktop announced — why we're paying attention
Windows Virtual Desktop announcement 2018 field notes: multi-session Windows 10, licensing entitlement, and what it means for Citrix and RDS estates.
2018.08.14
SCCM 2007 to Current Branch: the upgrade that's really a migration
SCCM 2007 to Current Branch migration field notes: side-by-side hierarchy, client reassignment waves, package-to-application conversion, and boundary redesign.
2018.07.17
The 35% Number: How Hybrid Coexistence Actually Cuts Infrastructure Cost
How to reduce infrastructure costs with cloud migration, honestly itemized: retired Exchange and SharePoint farms, storage tiers, DR simplification — and what never shrinks.
2018.06.12
Cutover vs Staged vs Hybrid: Picking Your Office 365 Migration Path
Cutover vs hybrid migration for Office 365, decided by mailbox count, directory state, and coexistence needs — with real timelines from 500, 4,000, and 15,000 seats.
2018.05.15
RDS 2012 R2 + App-V: The Pragmatic VDI Nobody Blogs About
RDS 2012 R2 deployment with App-V is the unfashionable VDI that works: session host economics, packaging discipline, broker HA, and when Citrix earns its premium.
2018.04.17
GDPR and Your Office 365 Tenant: The Questions Clients Keep Asking
GDPR enforcement is five weeks out. A practitioner's checklist for Office 365 compliance: data residency, retention vs deletion, DSRs, and what the processor agreement covers.
2018.03.13
Windows 7 to 10 at enterprise scale: task sequences that survive contact with reality
Field notes from a Windows 10 migration with SCCM: in-place upgrade vs wipe-and-load, driver management, USMT, and task sequences that survive reality.
2018.02.13
GPO, DHCP, and DFS: the unglamorous plumbing of AD consolidation
GPO cleanup consolidation and DFS namespace migration field notes: rationalizing 900 policies, DHCP failover cutover, and the plumbing between org charts.
2018.01.16
Meltdown and Spectre: what hypervisor patching did to our density math
Field notes, two weeks into Meltdown and Spectre: the antivirus registry gate, enabling Windows Server mitigations, and the hit to Hyper-V performance and density math.
2017// 12 posts
2017.12.12
Azure IaaS assessments: sizing lift-and-shift honestly
Field notes on running an azure migration assessment before you commit to lift and shift sizing: measured load, right-sizing down, and what should stay put.
2017.11.14
vSphere replication between sites: DR that actually fails over
vSphere replication disaster recovery, field notes: honest RPO/RTO tiers, stretch vs re-IP, and the DR runbook that has to actually fail over.
2017.10.17
Pass-through Authentication vs ADFS: when to decommission the federation farm
Azure AD PTA reached general availability at Ignite. Our pass-through authentication vs ADFS decision tree for the multi-domain federation farms we operate.
2017.09.26
Ignite 2017: Teams will replace Skype for Business. Our migration math
Microsoft says Teams is replacing Skype for Business. What Ignite 2017 actually announced, what it means for SfB estates, and the migration math we run.
2017.08.15
XenDesktop 7.15 LTSR: the VDI build we standardize on
Why XenDesktop 7.15 LTSR is our standard Citrix VDI architecture for 10,000-user estates: MCS vs PVS, NetScaler HA, and profile strategy that holds.
2017.07.18
Multi-forest Active Directory consolidation: designing the target forest
Field notes on Active Directory forest consolidation: target forest design, trust topology, SID history, and ADMT migration phases from a real program.
2017.06.13
BitTitan MigrationWiz vs native tools: choosing your mailbox mover
A field-tested BitTitan MigrationWiz review vs native hybrid moves: which Office 365 migration tools win by scenario, with throughput and licensing math.
2017.05.16
WannaCry weekend: what patching discipline looks like across 700 servers
Field notes from the WannaCry weekend: MS17-010 patch management, SMBv1 eradication, and SCCM emergency deployment rings across a 700-server estate.
2017.04.18
Lotus Notes to Office 365: migrating the unmigratable
Lotus Notes to Office 365 migration field notes: NSF mail and calendar fidelity, Domino directory sync, coexistence, and triaging Notes applications.
2017.03.21
Microsoft Teams just launched. What it means if you run Skype for Business
Microsoft Teams vs Skype for Business in 2017: what Teams can and cannot do at GA, and what we tell clients running SfB 2015 estates to actually do.
2017.02.14
Exchange hybrid deep dive: coexistence, free/busy, and the ten things that break
Exchange hybrid configuration in the field: HCW quirks, autodiscover priority, why free/busy stops working, mail flow choices, and public folder access.
2017.01.17
SharePoint 2010 to 2013 farm migration war stories: database-attach done right
Field notes from a SharePoint 2010 to 2013 migration: database attach upgrade order, Test-SPContentDatabase triage, claims conversion, deferred site upgrades.
2016// 12 posts
2016.12.13
Year in review: virtualizing 400+ servers on Hyper-V — what we learned
Lessons from a Hyper-V P2V migration program spanning 400+ servers: candidate triage, where the utilization gains came from, cluster sizing, and the refusals.
2016.11.15
System Center 2016 first look: upgrading SCVMM, SCOM, and SCCM from 2012 R2 in the field
System Center 2016 upgrade field notes: sequencing SCVMM 2016, SCOM, and SCCM Current Branch from 2012 R2, coexistence gotchas, and what broke in our lab.
2016.10.18
Windows Server 2016 is GA: what Hyper-V 2016 changes for private cloud builders
Windows Server 2016 GA field notes: Hyper-V 2016 features, Storage Spaces Direct, shielded VMs, and nested virtualization judged against a 400-server private cloud.
2016.09.13
A multi-tenant Skype for Business 2015 environment that survives 10,000 concurrent users
Skype for Business 2015 architecture field notes: front-end pool design, edge topology, SIP domain isolation, and load testing a multi-tenant platform.
2016.08.09
ADFS 3.0 for Office 365: lessons from multi-domain federation
Field notes on ADFS 3.0 federated authentication for Office 365: WAP proxies, certificate rollover, UPN suffix cleanup, and multi-domain federation.
2016.07.12
Planning a 15,000-Mailbox Move to Office 365: The Assessment Phase
Field notes from an Office 365 migration assessment: sizing a 15,000-mailbox Exchange 2010 estate, egress math, ADFS mapping, and why discovery wins.
2016.06.14
Office 365 tenant readiness: the checklist before assessment theater
Office 365 tenant readiness checklist: domains, identity, licensing, networking, and governance gates before a 15,000-mailbox migration assessment.
2016.05.17
Hyper-V 2012 R2 cluster build discipline
Hyper-V 2012 R2 cluster field notes: storage, networking, CSV, patching cadence, and build standards before Server 2016 private cloud work.
2016.04.12
SharePoint 2010 farm health: triage before you upgrade
SharePoint 2010 farm health before migration: content DB inventory, customization debt, auth mode, and what blocks a clean 2013 or cloud path.
2016.03.15
Skype for Business 2015 on-prem: design decisions that age well
Skype for Business 2015 architecture decisions: topology, edge, HA, capacity for enterprise estates before multi-tenant complexity.
2016.02.09
Azure AD Connect and the hybrid identity first mile
Azure AD Connect hybrid identity field notes: DirSync legacy, UPN cleanup, filtering, staging mode, and why identity leads every Office 365 program.
2016.01.12
Exchange 2010 capacity: get honest before the cloud conversation
Exchange 2010 capacity planning field notes: mailbox growth, DAG reality, SAN pressure, and why you measure before any Office 365 pitch.