Home Modern Workplace Mastery Modern Workplace Mastery: Week 1 – What Have We Achieved So Far?

Modern Workplace Mastery: Week 1 – What Have We Achieved So Far?

Why the End of Week 1 Matters (and why it comes now)

There’s a point in every Microsoft 365 journey where the temptation is to rush ahead.

Licensing is “good enough”, security has some sensible toggles, branding is live… and the anticipation of Conditional Access, Intune and automation gets louder by the day.

For CalderCloud, that moment comes now. Week 1 has already laid serious groundwork:

The CalderCloud Foundations Workshop (Day 0),
Tenant creation (Day 1),
Domains and identity patterns (Day 2),
Licensing and First Purchases (Day 3),
Safe-by-default security (Day 4), and
Branding plus a trustworthy sign-in experience (Day 5).

On paper, the tenant looks solid.

What isn’t clear yet is whether that solidity is real or assumed.

Today, Instead of adding new configuration, I stop and ask a harder question:

“What have we actually achieved, what can we prove, and are we really ready to layer identity, access and device complexity on top of this?”

This is where we turn scattered decisions into a single, honest checkpoint. An opportunity to prevent stress, rework, and burnout for the Sysadmins that keep a tenant live.

Remember – CalderCloud is a fictious story, it is a journey for all Microsoft Tenant businesses, ones that are about to start the journey as well as those that are on an existing journey, but need to “Understand, Evolve and Transform” what they have into something smarter and better.

TL;DR - Modern Workplace Mastery - Week 1 Recap

If you’re short on time, this TL;DR turns this Post into a quick, slide-style checkpoint you can scan in minutes. It’s a direct summary of the full post below, pulling out the core decisions, information and “are we actually ready?” questions so you can sanity-check your own tenant foundations before moving into Week 2.

The aim is simple: you should be able to mirror this journey in your own tenant or dev environment, learning from CalderCloud’s choices without exposing any real organisation or real people, and without wading through yet another pile of shallow “how-to” snippets.

Where CalderCloud Stands Now

CalderCloud started this journey with a familiar knot in the stomach: a messy global parent organisation, limited time, and a technology estate that felt more like something done to people than for them. The risk wasn’t just security or compliance; it was burnout, anxiety and the constant sense that “we’re winging it” with something as critical as identity and collaboration.

By the end of week 1, that picture has shifted. CalderCloud now has a Microsoft 365 tenant that exists on purpose, not by accident. There is a clear Business Charter agreeing why this tenant exists, what it should and should not be used for, who is accountable for it, and the non-negotiables around security, privacy and wellbeing. The tenant has a name, lives in chosen regions for data residency, and has properly defined admin accounts; including break-glass accounts – instead of the typical “whoever signed up first” account.

Names and identities now make sense. Domains are chosen and aligned with how CalderCloud actually presents itself to customers and staff. User principal names and email addresses follow reviewed and approved design patterns that are understandable for all employees and predictable for the IT team – now and in the future. Licensing is no longer a random mixture of trials, leftovers and wishful thinking; it’s mapped to real workplace rolls / people that do real work.

On the security side, the most dangerous legacy behaviours and defaults have been discussed, reviewed and replaced. Key settings have been pulled into a baseline that makes the tenant “safe by default” instead of “wide open until someone complains”. When someone signs in, they’re greeted with a calm, consistent, legitimate sign-in experience that reduces doubt and makes phishing harder, not easier.

So today’s post is not about adding another pile of configuration. It’s a checkpoint. A moment to stop, take a breath, look at what exists, and make sure the reality of your tenant matches the story you think you’re telling yourself.

From Blank Canvas to Intentional Tenant (Days 0 – 1)

The Tenant Foundations Workshop – Saying Things Out Loud

Before a single licence was bought or domain added, CalderCloud held a Tenant Foundations workshop. That session forced some uncomfortable but necessary questions:

Why are we creating or reshaping this tenant at all?
Who is ultimately accountable when something goes wrong?
What are our non-negotiables for security, privacy, data residency and user experience?
How much change can our people realistically absorb over the next 6–12 months?

From that conversation came two critical artefacts: the Tenant Foundations Charter that also contained a RACI (who is Responsible, Accountable, Consulted and Informed). This charter document turned vague intentions into written commitments. It captured the constraints (budget, time, skills), the intended scope (what this tenant is and isn’t for) and the early guardrails (no shadow tenants, no personal sign-ups, no unapproved connectors, and so on).

The value isn’t that this charter is beautiful; it’s that they are written down and agreed. People can point at them during later arguments about “why can’t we just…?” and remember the decisions that were made when everyone’s head was clear.

Creating a Named, Owned Tenant – Without Regrets

Only after that workshop did CalderCloud move into the practical “create the tenant” steps. In Day 1, the focus was less on the sign-up wizard’s screens and more on the decisions behind them:

Choosing appropriate regions and understanding data residency implications.
Using organisational accounts, not personal ones, for sign-up and ownership.
Defining a small, controlled set of global administrators and creating break-glass accounts designed for emergencies, not daily work.
Giving the tenant a sensible, durable name rather than something that would look amateur or confusing five years later.

Day 1 also highlighted what CalderCloud deliberately refused to do:

No “let’s just try it with someone’s personal account”,
No mystery test tenants that accidentally become production, and
No untraceable one-off changes made by whoever was nearest the keyboard.

By the end of that phase, the tenant existed, but more importantly, it had clear ownership, documented intent and an agreed story about how it came into being.

Names, Identities and Licences that Match Reality (Days 2 – 3)

Domains and Identity Patterns that Don’t Fight You

In Day 2, CalderCloud tackled something many organisations leave until far too late: domains and identity patterns. They chose a primary domain for employees that matches how the organisation is known externally, and they identified where secondary or service domains made sense (for example, system accounts or special-purpose services).

From there, they committed to a clear model for user principal names (UPNs) and email addresses. Instead of a patchwork of firstname.lastname here, random numbers there and inherited oddities from a previous system, they agreed a small number of requirements that:

Are easy for users to remember and say out loud.
Are predictable enough that IT can script against them.
Avoid unnecessary exposure of sensitive information (no national IDs, dates of birth, etc.).

This gave CalderCloud a coherent identity model. When a new starter joins, it’s obvious what their sign-in and email should look like. When systems integrate, they aren’t guessing which format to expect.

Licencing that Reflects Real Work, Not Fantasy

Day 3 moved from “who are you?” to “what do you actually need to do?”. CalderCloud identified a set of personas / rolls – simple, realistic groupings such as front-line worker, knowledge worker, manager, contractor and admin and mapped each persona to the capabilities they genuinely need.

From those capabilities, they built a licence matrix. Instead of buying the biggest SKU for everyone and calling it a day, they:

Matched features to personas, not to individuals’ ability to argue loudly.
Avoided over-licensed purchasing by only enabling high-value advanced features where there was a clear plan to use them with suitable licenses assigned accordingly.
Documented why some roles don’t get certain features yet, so it doesn’t become a personal value judgement.

This wasn’t just a cost exercise. It created a clean link between identity, role and capability. When a user’s role changes, it’s clear what should happen to their licence. When security features like advanced auditing or endpoint protection are only available in certain SKUs, everyone understands who is covered and why.

By the end of Days 2 and 3, CalderCloud had a tenant where names, identities and licences line up with reality rather than wishful thinking.

Safe and Trustworthy by Default (Days 4 – 5)

Baseline Security – Turning off “Bad by Default”

In Day 4, CalderCloud faced the slightly grim fact that many “out of the box” behaviours are not designed for the world we actually live in. Old protocols, wide-open permissions and silent defaults can create hidden risk that only surfaces when something goes badly wrong.

Instead of chasing every advanced feature at once, CalderCloud built a baseline security posture with a few clear principles:

Turn legacy and risky behaviours off by default, and only re-enable them for documented exceptions.
Make sure core logging and alerting are switched on so that incidents aren’t invisible.
Prefer consistent, policy-based controls over one-off tweaks.

The result is not a perfect Zero Trust architecture. It’s something more achievable and immediately valuable: a tenant where the default state is “fairly sensible and predictable” rather than “full of unknowns”.

For Sysadmins, that reduces background anxiety. You may still have plenty to improve, but you’re no longer living with the uneasy feeling that there are doors you forgot you’d left open.

First Impressions, Legitimacy and Mental Load

Day 5 then looked at the first thing many people actually see of all this work: the sign-in experience. It’s easy to dismiss branding as cosmetic, but from a real person point of view it matters enormously.

CalderCloud invested in:

A calm, low-noise sign-in background that feels like it belongs to the organisation.
A logo and favicon treatment that is clear without being overwhelming.
Sign-in wording that reassures users they are in the right place and reminds them of safe behaviour (for example, not entering their password into unknown prompts).

This isn’t about impressing people with design. It’s about reducing doubt. When users recognise the environment, they’re less likely to fall for phishing and more likely to trust legitimate security prompts. For individuals who already feel anxious about technology, that familiarity can be the difference between “I can do this” and “I’m going to avoid using this at all”.

For Sysadmins, a coherent sign-in experience also lowers the volume of “is this real?” tickets and gives them one less chaotic variable to juggle.

In the following sections (below) you have a personal choice that you will have made – either a single charter document (this is what I prefer) or a multitude of documents used for different requirements – the choice is yours.

Tangible Outputs / Documents You Should Have by Now

By this point in the series, CalderCloud doesn’t just have a different feeling about their tenant; they have a folder of actual artefacts. If you’ve been following along, you should be able to point to equivalents in your own environment. At a minimum, you should now have:

Tenant Foundations Charter – a written statement of why the tenant exists, its scope, constraints and non-negotiables.
RACI for the tenant – clarity on who is responsible, accountable, consulted and informed for tenant-level decisions and operations.
Tenant decisions / change management log – a simple record of the key decisions from Day 0 to Day 5, including the “we will not do this” choices that are easy to forget.
Domain and identity design sheet – documentation of primary and secondary domains, plus the UPN/email designs tied to them.
Licence matrix and assignment model – rolls, personas, their associated licences, and how those licences are actually assigned and managed.
Baseline security configuration snapshot – a record of the key toggles and policies that define your “safe by default” posture, so you can detect drift later.
Branding pack – logo variants, favicon, sign-in background image and reference sign-in copy that can be reused consistently across environments.

None of these documents need to be pretty. They do need to be findable, shareable and kept up to date. They are what separates “we vaguely remember deciding that” from “here is what we decided, and here is why”.

If you’re reading this and realising that some of these are missing, that’s not a failure. It’s a prompt. This post is your chance to pause and fill in those gaps before the complexity ramps up.

Quick Health Check: Are You Actually Here Yet?

Before charging into identity, access and device controls, CalderCloud uses a short health check to sanity-check their foundations. You can adapt it for your own organisation. You should be able to honestly answer “yes” to most of the following:

We have a written Tenant Foundations Charter that is stored somewhere obvious and has been agreed by the right people.
We can name the individuals who are accountable for this tenant and show a RACI that reflects reality.
Our primary and secondary domains are documented, and people know which are for humans and which are for services or special cases.
We have a clear design for UPNs and email addresses, and we aren’t inventing new formats on the fly.
We have a licence matrix based on rolls, personas, and we know roughly how many licences of each type are in use and why.
We have changed at least some default security settings and can show what we turned off or tightened and why.
We have a basic record of our baseline security posture so that we can spot when something drifts or is changed unexpectedly.
Our sign-in experience looks and feels like our organisation, and users are not routinely asking “is this real?” when they see it.

If several of these are “no” or “not really”, that’s your signal to slow down. It is far kinder to yourself and your colleagues to correct those fundamentals now than to layer complex Conditional Access, device onboarding and automation on top of shaky ground. You don’t need to be perfect; you do need to be honest.

What These Foundations Enable Next

Week 1 has been about making the tenant real, intentional and safe enough that you can build on it without constant dread. By establishing a clear charter, aligning domains and identities, mapping licences to reality, tightening dangerous defaults and presenting a trustworthy sign-in experience, CalderCloud has laid the groundwork for the next phase.

In Tenant Foundation – Week 2, the focus shifts to identity, access and devices. That means:

Stronger sign-in journeys with multi-factor authentication and Conditional Access that take your personas and risk appetite seriously.
A coherent device story using Intune and related tools, so that laptops, mobiles and other endpoints are onboarded and managed intentionally, not chaotically.
Joiner, mover and leaver flows that treat identity lifecycle as a first-class process rather than an afterthought.

For organisations with existing, messy tenants, this post also offers something else: a reset marker. Even if you can’t rewind history, you can draw a line here, document your current reality, and start building the same kind of logical and effective documents CalderCloud has created.

From here on, identity and device decisions get more powerful and more sensitive. These foundations aren’t optional polish. They are the support structure that lets you protect people, reduce stress and still get real work done without turning Microsoft 365 into a source of constant fear.

Outcomes – what week 1 gives you

Week 1 is designed to do one thing well: turn 6 separate posts into a single, recognisable milestone.

If you’ve worked through week 1, you should now have:

A joined-up understanding for what changed in your tenant from Day 0 to Day 5.
A concrete list of documents / information – Charter, RACI, decisions log, domain and identity patterns, licence matrix, baseline security snapshot and a branding pack – that you can point to in real life, not just in theory.
A simple health check that helps you answer an uncomfortable but essential question:

“Are we genuinely ready to move into identity, access and devices, or are we still running on wishful thinking?”

This post doesn’t add new technical configuration. Instead, it helps you see what you already have, what you’re missing, and what that means for the next phase.

Risks & rollback – what happens if you sprint past this

It’s absolutely possible to ignore this checkpoint and jump straight into MFA, Conditional Access, Intune and automation. Lots of organisations do. The patterns that tend to show up later are depressingly consistent:

Licence sprawl and cost anxiety – different teams changing licences independently, nobody sure who has which capabilities, and a low-level fear of the next audit or renewal conversation.
Policy spaghetti – Conditional Access rules and device policies built on wobbly domains and identities, making troubleshooting slow, fragile and mentally exhausting.
Invisible decisions – changes made in a hurry, never written down, so every new admin spends months rediscovering “how things really work”.
User distrust and fatigue – frequent, inconsistent prompts and unfamiliar sign-in experiences that train people to click “approve” on anything just to get work done.
Admin burnout – one or two “hero” admins quietly carrying the risk because foundations were never agreed and documented.

For this week, “rollback” doesn’t mean reverting technical changes; it means rolling back assumptions. If week 1 makes it clear that your Charter is still in someone’s notebook, your licence model lives only in finance, or your baseline security posture is “whatever the defaults were that day”, the safest rollback is to:

Stop treating your tenant as if it has solid foundations, and
Declare a short, focused foundations project to close the biggest gaps before you add more moving parts.

That’s not failure. It’s damage limitation and a kindness to your future self.

Scope, caveats and sources

This recap reflects a particular moment in how Microsoft 365 behaves and how CalderCloud is using it. Product names, portals and best practices will continue to evolve. The principles in this weeks posts – intentional tenants, written documentation and decisions, clear identity and licensing models, baseline security and trustworthy sign-in are durable, but the exact buttons and screens behind them can change.

The primary sources for this post are:

Week 1, Posts 0 – 5 of the Modern Workplace Mastery series – the detailed stories and decisions behind each step.
Current Microsoft documentation on Microsoft 365 tenants, identity, licensing and baseline security – used to validate behaviours and terminology at the time of writing.

Nothing here is legal advice or a substitute for your own risk assessments. Treat this as a logical introduction and prompt, not a compliance certificate.

Next steps – what to actually do after reading this post

If you want this post to be more than a nice recap, use it as a working checklist:

Run a health check with real end users, admins and management – don’t do it alone at 23:00. Bring at least one other admin or IT lead into the conversation and walk through the “are you actually here yet?” questions together.
Mark the gaps in understanding and evidence reality – For each item in the documentation list, be brutally honest: do you have it, can people find it, and does it reflect reality? If not, add it to a small “foundations backlog”.
Decide your readiness level – On the back of that conversation, make a clear call:
- “We’re ready enough for Week 2 and we’ll keep improving foundations as we go”, or
- “We’re not ready – Week 2 will wait until we’ve closed these specific gaps.”
Plan a lightweight foundations mini-project if needed – If you’re not ready, define a short, time-boxed effort to get there: for example 2–4 weeks focused on the Charter, RACI, licence matrix and baseline security snapshot. Keep the scope realistic.
Then move into Week 2 on purpose – When you do start on identity, access and devices, you’ll be doing it from a calmer place: with shared language, written and approved decisions and fewer unknowns hiding under the floorboards.

Week 1 is your chance to understand, design, approve, review and name where you really are. Everything in Week 2 will be easier – technically and mentally – if you treat this as a genuine checkpoint rather than just another blog to skim.

Next up: Week 2 – Identity, Access & Devices (Entra ID + Intune)

Week 1 gave CalderCloud a stable tenant foundation. Week 2 is where that foundation becomes a usable, secure reality for employees: we review and design the identity model, sign-in experience, and device strategy so access is consistent, supportable, and doesn’t create constant lockouts or “nag fatigue”.

The core aim of Week 2 is simple: build CalderCloud’s identity, authentication and device approach on top of the decisions already made in Week 1 – so security improves without turning day-to-day work into a grind.

Day 6 – “Designing CalderCloud’s Identity Model: Users, Groups and Roles in Entra ID” – A practical design post that maps real-world departments and responsibilities into Entra ID users and groups, explains when to use Security Groups vs Microsoft 365 Groups (including dynamic rules), and ties everything back to the Day 0 charter and non-negotiables.

Day 7 – “Sign-In Without Meltdown: MFA and Conditional Access Baselines for CalderCloud” – Reviews CalderCloud’s default sign-in experience: MFA choices, registration flow, and self-service password reset, then establishes an initial Conditional Access baseline using locations, device signals and risk – balanced carefully to reduce lockouts and avoid constant prompts.

🧭 Follow the full journey: You’re welcome to follow along quietly, Questions, disagreements and “we tried this and it hurt” stories are all part of the point. You can catch each post right here and can follow along on LinkedIn, Instagram, or Bluesky.

Thank you for joining me on this journey and remember CalderCloud is a fictitious department in a fictitious global company – its aim is to simply reflect what should be considered and done for any sized business, whether a new start or an existing business needing to “clean the chaos”.

🔗 SharePointMark – Modern Workplace Mastery

#ModernWorkplace #ModernWorkplaceMastery #MentalHealthAtWork