Your First 90 Days

First 1–2 weeks typically

Discovery & Planning

We audit your environment, document your current infrastructure, and build a tailored onboarding plan. This is where we learn your business inside and out.

Key activities (5)

• • Full environment audit and documentation
• • Stakeholder workshops and project scoping
• • Licensing review and optimisation recommendations
• • Migration planning, risk assessment, and timeline agreement
• • Communication plan for your team

Weeks 1–3 typically

Foundation & Identity

The groundwork goes in: securing your internet presence, locking down identity, and establishing the policies that everything else builds on.

Key activities (6)

• • DNS hardening and domain protection
• • External attack surface monitoring
• • Tenant configuration: branding, admin roles, licensing
• • Conditional Access policies and MFA enforcement
• • Single sign-on (SSO) configuration where applicable
• • Emergency access accounts and break-glass procedures

Weeks 2–5 typically

Security Stack Deployment

The core security stack rolls out across your Microsoft 365 environment. Email, apps, and identity all get hardened. Your Secure Score starts climbing.

Key activities (6)

• • Email hardening: anti-phishing, DKIM/DMARC, mail flow rules
• • Microsoft Defender for Office 365 deployment
• • Defender for Identity and Cloud Apps configuration
• • Sensitivity labels and data loss prevention policies
• • Secure Score optimisation begins, targeting 75%+
• • Ironscales email security integration

Weeks 3–8 typically

Endpoint Management & Device Migration

Devices get enrolled, configured, and brought up to standard. This is typically the longest operational phase. Each device needs individual attention during the Autopilot rebuild process.

Key activities (6)

• • Intune enrollment and device configuration policies
• • Compliance policies tied to Conditional Access
• • Application deployment: company apps, Win32 packaging
• • Device wipes and Autopilot rebuilds, scheduled per user
• • Windows Update rings and Autopatch configuration
• • Windows 365 Cloud PC provisioning where applicable

Weeks 5–10 typically

Communications & Advanced Security

With the core estate secured, we move to collaboration tooling and advanced threat detection. These workstreams run in parallel where possible.

Key activities (5)

• • Teams Phone setup: number porting, call policies, auto attendants
• • SharePoint and Teams governance policies
• • Microsoft Sentinel SIEM deployment
• • Data connectors, analytics rules, and automation playbooks
• • Advanced hunting queries and custom detections

Teams Phone and Sentinel are typically included in COSAINT Complete and COSAINT Cyber tiers.