December is when infrastructure leaders pretend they can still shape next year’s budget. 2021 made that exercise brutal: Exchange vulnerabilities at internet scale, Skype for Business Online retirement, Windows Virtual Desktop rebranded as Azure Virtual Desktop, Zero Trust posters in every board pack, and hybrid estates that refused to become pure cloud just because a keynote said so. This year-end field note captures what we are telling Microsoft-shop clients right now, in late 2021 — what burned us this year, what to fund in the coming year, and what we will push back on when planning decks fill with product names instead of owners.
We write as practitioners who spent 2016–2021 on mailbox migrations, private cloud, VDI, identity, and security emergencies. The archive ends this month on purpose. The work does not.
What 2021 actually taught
Internet-facing on-premises Exchange is existential risk. ProxyLogon and the HAFNIUM-associated wave turned migration debt into incident response. Estates that had already moved mailboxes to Exchange Online and left a small hybrid footprint had less blast radius. Estates running full DAGs on the open internet lived a longer March. That lesson does not expire in December.
Identity is the perimeter that still works from home. Conditional Access, MFA, and legacy-authentication kill switches mattered more in 2021 than another edge firewall rule. Password spray loves basic auth. The shops that inventoried service accounts and printers before blocking legacy auth finished the year calmer than those who flipped a tenant-wide switch and discovered HVAC mail relays on Monday.
Desktop is an Azure workload when you choose AVD — with ops, not only licenses. The rename from WVD to Azure Virtual Desktop was strategy: session hosts live next to identity, monitor, network, and cost. Profiles (FSLogix), image factories, and N+1 math did not get easier because of a logo change.
Collaboration defaults are security defaults. Teams went wartime in 2020 and stayed. Guest access, recording, and team sprawl without lifecycle rules are not “culture problems.” They are control failures with audit trails.
Cost visibility without owners is waste. Cloud made bills legible. Legible bills without a FinOps owner become surprise slides in Q4. Tagging, budgets, and “who pays for this host pool” belong in architecture, not in a finance afterthought.
What to fund in the year ahead
From a December 2021 vantage point, these are the workstreams we rank above “adopt the newest portal blade.” The table is a funding priority list for the year ahead (the next planning cycle starting in January).
| Workstream | Why it earns budget |
|---|---|
| Hybrid Exchange minimization | Shrink ProxyLogon-class surface and residual on-prem mail exposure |
| Legacy authentication to zero | Highest-ROI identity hygiene against password spray |
| AVD image and FSLogix maturity | Remote work is structural; desktop UX is profile and storage math |
| Thin Azure landing zone | Stop subscription chaos before the next product team lands |
| DR tests that actually run | Binder-only DR failed the last decade of audits |
| Admin tiering and break-glass | Tenant takeover resistance when CA policies misfire |
Each row needs a named owner, a first milestone in Q1, and a risk if slipped. If the planning deck only has product logos, rewrite it until those three columns exist.
How we socialize this with finance and security
Finance hears “fund AVD maturity” as opex growth. We translate: cost per active user, reserved baseline versus burst, and the avoided cost of another on-prem VDI hardware refresh done badly. Security hears “Zero Trust” and expects a three-year program. We translate: MFA rings, legacy auth inventory, Conditional Access in report-only then enforce, admin tiering — measurable in a quarter, not a decade.
The estates that improve next year will not be the ones with the longest strategy PDFs. They will be the ones that close three of the six rows above with evidence.
What we will challenge in planning meetings
- “We’ll stay hybrid forever” with no risk acceptance document and no isolation for residual Exchange
- AVD mega-projects without profile storage design, image cadence, or FinOps ownership
- Zero Trust programs that skip MFA and legacy auth because the slides look better with network diagrams
- Lift-and-shift of everything “because cloud” without right-sizing or exit criteria for dead VMs
- Teams growth without governance after two years of wartime sprawl
- DR that is a contract with no measured RTO from a real test this year
Challenge is not obstruction. It is how you keep capital attached to risk reduction.
Continuity from the 2016–2021 archive
From early Exchange 2010 capacity honesty through Office 365 assessments, ADFS and Azure AD Connect, multi-tenant Skype, Hyper-V private clouds, WannaCry patching discipline, WVD preview and GA, COVID surge remote access, Conditional Access as perimeter, ProxyLogon triage, and the AVD rename — the constant is production ownership. Tools renamed. Urgency increased. The work remains: measure, design, pilot, operate, hand off.
If you only read one theme from this archive into next year’s plan: do not leave identity and on-prem mail surface area for “later.” Later arrived in March 2021 for a lot of people.
A practical December checklist
Before the holiday freeze:
- List internet-facing on-prem Exchange (if any) and patch/isolation status
- Pull legacy auth sign-in volume for the last thirty days
- Name the AVD or VDI owner and the profile storage owner (must not be “TBD”)
- Confirm last DR test date and measured RTO — or admit there was none
- Count standing global admins; schedule reduction
- Write the six workstreams above into the budget narrative with owners
Bring that list to the first planning meeting in January. It beats another Ignite summary.
Portfolio view for the year ahead
Think in portfolios, not projects: identity portfolio, desktop portfolio, mail residual portfolio, Azure platform portfolio. Each has a backlog, an owner, and a quarterly outcome. Conference-driven projects that do not map into a portfolio get deprioritized.
Resourcing reality
Hiring is hard at year-end. Prefer fewer initiatives fully staffed over ten initiatives each at ten percent attention. The six workstreams in the priority table above are already ambitious for most mid-market teams; pick three if you must, finish them, then expand.
Vendor and partner management
Force vendors to attach to your workstreams. “We implemented Product X” is not an outcome. “Legacy auth reduced 90 percent” is an outcome. Rewrite statements of work around metrics.
Closing the archive year
This post sits at the end of a six-year field-notes arc. The lessons of 2021 are continuous with 2016: inventory before tools, identity before features, pilots before promises, operations before architecture diagrams. Carry that into the year ahead.
If you're facing this
If next year’s plan is still a list of product names from the last conference, replace it with risk-ordered workstreams and named owners. We help Microsoft estates turn hybrid reality into funded roadmaps that survive contact with operations — bring this year’s incidents and the budget themes you are already fighting for.