Our company is separating from a larger organization and will become an independent manufacturing site with fewer than 70 employees. We are getting a brand-new Microsoft tenant but keeping the existing physical equipment, including Cisco routers, switches, access points, Dell servers, and PCs. I will be responsible for essentially all IT: helpdesk, deployments, identity, networking, Microsoft 365 administration, and infrastructure.
I have experience handling these responsibilities, but the previous environment already had much of the infrastructure established, and my earlier networking experience was mostly with Ubiquiti equipment. I would appreciate advice on several decisions:
1. Should we stay cloud-only with Microsoft Entra ID, or is on-premises Active Directory still worthwhile for a small manufacturing site with existing servers?
2. Should we continue using the Cisco network equipment, or replace it with something simpler and less expensive? I have some older Cisco training but no current certification, and I am concerned about support and licensing costs.
3. What are reasonable business ISP options in the southeastern United States? We currently pay more than $500 per month for a 100 Mbps AT&T fiber circuit and use Starlink as backup. We need more bandwidth and reliable service without paying enterprise-level prices.
4. What are the most important best practices for a fresh setup involving Azure, Exchange, Teams, SharePoint, identity, security, and backups?
5. What mistakes should I avoid?
6. Is Intune and Windows Autopilot worth the cost for fewer than 70 employees?
7. Is TeamViewer still a good choice for remote support, or are there better alternatives?
I would also appreciate advice on making this manageable for a solo administrator, including documentation, disaster recovery, and coverage when I am unavailable.
4 Answers
Do not replace the Cisco gear automatically. First check the exact models, software versions, warranties, SmartNet or other support status, licensing requirements, and whether they are still receiving security updates. Unsupported inherited equipment can be more expensive during an outage than a planned replacement.
If the equipment is current and stable, document the configuration and keep it while you build a replacement plan. If it is old, overcomplicated, or unsupported, a simpler managed platform may make sense for a small single-site business. Ubiquiti can reduce cost and administrative overhead, but compare its monitoring, support, security, and redundancy features against the needs of the production environment rather than choosing solely on price.
Intune and Autopilot are worthwhile at this size if you standardize the device lifecycle. They can handle Entra join, security baselines, BitLocker, application deployment, compliance policies, and repeatable laptop provisioning. Start with a small pilot and keep the configuration simple instead of trying to automate everything at once.
For remote support, ScreenConnect, Splashtop, and similar business tools are common alternatives to TeamViewer. Choose based on unattended access controls, MFA, audit logs, licensing, vendor security history, and whether technicians can restrict access by device or group.
The most important early work is less glamorous: use a password manager, document network and recovery procedures, establish least privilege and MFA, and create tested immutable off-site backups. A backup that has never been restored is only an assumption. Since you are the only administrator, arrange emergency support or co-managed coverage before you need time off or encounter a major incident.
Start by inventorying the applications and devices that might require traditional domain services. If there are no manufacturing applications, file servers, printers, or other systems that depend on domain authentication, Entra ID join with Intune can work very well for a site this size. Do not deploy a domain controller merely because servers are available; it creates another critical system you have to maintain.
On the other hand, manufacturing environments often have older line-of-business systems that quietly depend on on-premises DNS, DHCP, SMB, or Active Directory. Validate those dependencies before committing to cloud-only. Keep the existing servers only if they have a clear purpose, and plan their replacement rather than letting them become permanent because they are already there.
That was my concern too. We used a cloud-only setup earlier, but I will inventory the production and business applications before deciding. I do not want to maintain a domain controller without a real requirement.
For the internet connection, a telecom broker or local fiber providers may uncover better options, but $500 for a business-grade 100 Mbps circuit with a meaningful SLA is not necessarily unusual. Ask about higher speeds, static IP requirements, repair commitments, contract terms, and whether the provider uses a physically diverse path.
Your AT&T and Starlink dual-WAN setup is a reasonable starting point. Test failover regularly and confirm that critical services, VPNs, DNS, voice, and production applications behave properly on the backup connection. If internet availability is important, a second terrestrial circuit from a different provider may be more predictable than relying only on satellite.
We already have Starlink configured as backup and will probably keep it. I will compare the cost of a second fiber or cable circuit against the value of a better SLA and physical diversity.
I will prioritize the backup and documentation work instead of treating them as cleanup tasks. I also want to test an actual restore and make sure administrative credentials and recovery information are not stored only in my head.