Rebuilding identity and detection for a community college

The situation

A community college needed four related pieces of work that most providers would treat as four unrelated projects: an identity platform rebuild on Microsoft Entra ID, a Microsoft Defender deployment, disaster recovery for critical systems using Azure Site Recovery, and an Azure Virtual Desktop environment for lab and remote instruction.

The work reached us through a reseller partner who held the college relationship and had supplied the licensing, but had no in-house depth in Entra ID or Defender. We delivered all four workstreams under their brand.

What we did

Identity first, because everything else depends on it. Entra ID configuration, hybrid identity, and conditional access were sequenced ahead of the other workstreams. Break-glass accounts were created and excluded before any policy existed. Every conditional access and multi-factor policy went to report-only first and was reviewed against real sign-in data before enforcement, then rolled out by ring rather than flipped for the tenant. On a campus with thousands of staff and student accounts, an identity mistake is not a ticket — it is a closure.

Defender deployed and then actually tuned. Microsoft Defender was configured across endpoint and identity, with policies tuned rather than left at defaults. The most common failure in Defender deployments is not absence but noise: an alert stream nobody reads because the false positive rate makes it unreadable.

Recovery for the systems that matter. Azure Site Recovery was configured for the college’s critical workloads, with replication policies aligned to agreed recovery point and recovery time objectives, and recovery plans defining boot order and dependencies. Test failovers were executed and validated rather than assumed.

Virtual desktops for instruction. Azure Virtual Desktop was designed and deployed to support lab and remote instruction scenarios, sized against real concurrency rather than headcount.

The outcome

The college received a coherent identity, security, and continuity platform rather than four disconnected deployments — with the sequencing that made each one safe to deliver. The reseller partner retained the relationship, presented the work as their own delivery, and gained a capability set they could offer to other education clients.

Documentation and knowledge transfer were delivered to the partner’s team as well as the college, which was the point: the partner wanted to be able to operate what had been built without calling us every month.