Capabilities · M-Bee IT & Security

Messaging & email architecture

Mail is the system users notice first when it breaks and the one attackers reach for first when it works. It is the area I know deepest.

Exchange Online and Exchange hybrid topology, including coexistence during long-running migrations.
Mail flow design: connectors, transport rules, routing decisions, and tracing a message end to end when the answer is not obvious.
Authentication and anti-spoofing — SPF, DKIM and DMARC taken from monitoring-only through to enforcement without breaking legitimate senders.
Deliverability and reputation work, plus the tenant-side controls in Exchange Online Protection and Defender for Office 365.

Tenant-wide configuration treated as an architecture, not a checklist of toggles.

Entra ID design — identity model, conditional access, authentication methods, privileged access and role assignment.
Licensing structure and group-based assignment, including working out what a given capability actually requires.
Security baselines and the trade-offs between a policy that is strict and one that people will not route around.
Compliance and data governance surface: retention, sensitivity labelling, audit and eDiscovery.

Designing the platform an organisation builds on, with the governance to keep it coherent a year later.

Subscription topology, management groups, and landing-zone structure sized to the organisation rather than to the reference diagram.
Networking and segmentation — virtual networks, peering, private endpoints, and where the identity boundary sits relative to the network one.
Governance through policy, RBAC and tagging, so drift is visible rather than discovered.
Cost-aware service selection, including the honest cases where IaaS remains the right answer.

End-user compute where the desktop is a managed service, with all the identity and storage plumbing that implies.

Host pool topology and session-host sizing, pooled versus personal, and what each choice commits you to operationally.
Image lifecycle — building, versioning and rolling out session-host images without a maintenance-window scramble.
FSLogix profile container design, storage backing and the failure modes worth planning for.
Autoscale configuration, plus the licensing and identity prerequisites that most AVD problems trace back to.

Devices provisioned, configured and kept compliant without hands on the hardware.

Intune configuration and compliance policy, and joining those to conditional access so compliance actually gates something.
Windows Autopilot provisioning, including enrolment profiles and the hand-off from procurement.
Application packaging and deployment, detection logic, and update ring strategy.
Endpoint security policy and Defender for Endpoint onboarding across the estate.

Windows, Linux and macOS as one estate. Most environments are mixed; pretending otherwise is where the gaps appear.

Windows Server roles, Active Directory, and the hybrid identity link into Entra ID.
Linux server administration and hardening, with configuration held in version control rather than in memory.
macOS management and enrolment alongside the same identity and compliance controls applied elsewhere.
Integration work across the three — authentication, certificates, file services, and scripting that has to run everywhere.