Our company is separating from a larger organization and will operate independently from a single facility with fewer than 70 employees. I'll be the sole IT administrator. In the past, I supported several warehouse and manufacturing sites, but this new environment will use a brand-new Microsoft tenant while retaining the existing Cisco routers, switches, wireless equipment, Dell servers, and PCs.
I'm trying to make sensible long-term decisions before the split. Should we use Entra ID and stay cloud-only, or is on-premises Active Directory still worthwhile for a small manufacturing company with existing servers? What should we do with the Cisco equipment? I have some older Cisco training but no certification, and I'm unsure about licensing, support contracts, and whether moving to simpler equipment would be more practical.
We currently pay more than $500 per month for a 100 Mbps AT&T fiber connection and use Starlink as a backup. Are there better options in the southeastern United States, or is that normal pricing for a business circuit with a useful SLA? We have previously had poor experiences with daytime maintenance on other business providers.
I'd also appreciate a checklist of important items for a new Microsoft environment, including Entra ID, Exchange, Teams, SharePoint, security, backups, documentation, and disaster recovery. What mistakes should I avoid? Is Intune with Autopilot worthwhile for an organization this size, and what remote-support product would you choose instead of TeamViewer?
4 Answers
Before choosing cloud-only, inventory every application, machine, printer, file share, and manufacturing system. If nothing requires traditional domain authentication, Entra-joined devices managed with Intune can be a very clean solution for a single site of this size. But manufacturing environments often have older line-of-business or equipment software that quietly depends on local AD, DNS, SMB, or a server, so verify that first rather than assuming.
I would also check the Cisco support and SmartNet status immediately. Unsupported hardware may still work, but you could lose firmware updates and vendor assistance when you need them most. Don’t replace functioning equipment solely for familiarity, but compare its remaining life, licensing, configuration complexity, and replacement cost before committing.
For internet service, a telecom broker can show you what is actually available at the building. A 100 Mbps circuit for around $500 may be normal if the price includes a business SLA, static addressing, support, and guaranteed repair terms. Ask about diverse carriers and physical paths rather than focusing only on advertised bandwidth. Keeping Starlink as a backup is reasonable, and a dual-WAN firewall can fail over automatically.
For remote support, ScreenConnect or Splashtop are common alternatives to TeamViewer. Whatever you choose, restrict unattended access, require MFA, log sessions, and keep a secondary break-glass method available. If you replace the network, choose something you can confidently operate and troubleshoot alone; lower cost is not useful if it creates an outage you cannot quickly resolve.
We already have AT&T as the primary connection and Starlink for failover, so I’ll concentrate on getting better SLA and diverse-circuit information before changing the design. Teams Phone is also the likely choice for our small number of business lines.
Prioritize backups and recovery before polishing the rest of the environment. Keep multiple copies, include an off-site copy, make at least one copy immutable or otherwise protected from administrators and ransomware, and perform an actual restore test. A backup job showing green does not prove that the data can be recovered.
Because you’ll be the only IT person, create a password manager and a basic runbook from day one. Store administrator credentials, network diagrams, ISP details, vendor contacts, renewal dates, recovery procedures, and equipment configurations somewhere secure and accessible to an authorized backup person. Also arrange co-managed or after-hours support so illness or vacation does not leave the company without coverage. Build the environment in stages, document as you go, and avoid introducing servers or complex products unless a real business requirement justifies them.
For a solo administrator, Intune and Autopilot are usually worth serious consideration. Standardized enrollment, policies, encryption, application deployment, compliance reporting, and remote wipe can save a lot of time over the life of the devices. The value is less about the number of employees and more about reducing repetitive work and making replacement laptops predictable.
Build the tenant carefully: use strong MFA and separate admin accounts, establish emergency access accounts, apply least privilege, configure conditional access, enroll devices consistently, secure email, document licensing, and set retention and sharing rules for SharePoint and OneDrive. Start with a small pilot and document every decision before rolling it out broadly.
That makes sense. We used Azure-only for years before the acquisition, so I’ll start by identifying anything that truly depends on local AD or server infrastructure instead of building a domain controller by default.