Cedar Row Studio
Your first full month on Microsoft 365. Everyone signs in with MFA, backups finished every night, and we found three licenses nobody was using. Two items need your decision, listed below.
We move your email, files and sign-ins to Microsoft 365 or Google Workspace, clean up who can see what on the way, and run it for you afterwards. When a business app belongs in Azure or AWS, we set that up too. When it doesn't, we tell you.
A 15-minute call with an engineer.
"The cloud" means your email, files and apps run on servers that Microsoft, Google or Amazon own and look after, and your team reaches them over the internet. You stop buying, patching and replacing your own server. You still decide who gets in and what they can see.
Here is how an office server compares with a cloud setup done properly, and the part that stays with you either way.
| Area | Your stuff on an office server | In the cloud, set up right | What you still own |
|---|---|---|---|
| Runs on a mail server in the closet, or on a hosting plan nobody remembers signing up for. | Microsoft 365 or Google Workspace, with spam filtering and the records that prove your mail really comes from you. | Deciding who gets a mailbox and who shares one. | |
| Files | A shared drive on the server. Reachable at the office, awkward from anywhere else. | SharePoint and OneDrive, or Google Drive, with folders that match how your team works and permissions set per group. | Saying which folders are private, like payroll or HR. |
| Signing in | One password for the computer, another for email, and a few more written on a sticky note. | One account per person for email, files and most apps, with MFA (a second check at sign-in, like a code on your phone). | Using MFA every time, and approving who gets admin rights. |
| Hardware and updates | You buy the server, patch it, and replace it when it ages out. | Microsoft, Google or Amazon run the servers, the power and the updates behind the service. | Keeping laptops and phones updated, because they are how people get in. |
| Licenses | Bought once, then forgotten until something stops working. | A monthly subscription per person. We match the plan to what each person actually uses and remove seats nobody needs. | Approving renewals and keeping payment details current. |
| Backups | A USB drive or a backup job someone set up years ago. | A separate backup of your cloud mail and files that you control, with restores we test. | Telling us about new shared drives or mailboxes, so they are included. |
| When someone leaves | Their password is changed, maybe. Their files sit on their old computer. | One account to turn off. Their mail and files are handed to the right person and the license is freed. | Telling us end dates as early as you can. |
Microsoft runs the service. Under Microsoft's shared responsibility model, protecting your accounts, the devices that reach them and your data stays with you. That is the part we help you run.
A cloud setup works like a stack: each layer depends on the one above it being right. Pick a layer to see what tends to go wrong there, what we set up, and how we check it is still working.
Work email on a personal phone with no passcode, company files synced to a shared family computer, and old laptops nobody updates.
Company laptops tied to your work account, with encrypted disks and updates. On phones, work apps stay separate from personal ones, so you can wipe company data without touching someone's photos.
A list of every device that signs in to your work account, with the ones that are out of date or unknown flagged in your monthly report.
Shared logins like front@ that five people use, accounts without MFA, too many people with admin rights (the power to change settings for everyone), and former staff who can still sign in.
One named account per person, MFA on every account, shared mailboxes in place of shared passwords, and admin rights kept to a few separate admin accounts. We add sign-in rules where they help, like blocking old sign-in methods that skip MFA.
A monthly review of every account: who has MFA, who has admin rights, which accounts nobody has used, and any risky sign-ins.
Fake emails that look like they come from your own domain, mailbox rules an attacker sets up to hide replies, and outside guests left in Teams channels long after a project ends.
Spam and phishing filtering, the records that prove mail from your domain is really from you (SPF, DKIM and DMARC), shared mailboxes and calendars, and Teams or Meet set up with clear rules for outside guests.
We watch those email records and alert when one changes. We look for mailbox rules that forward mail outside the company, and review guest access.
Everyone can open everything, important files live in one person's OneDrive, and "anyone with the link" shares that were never turned off.
Shared team sites or shared drives for each part of the business, permissions by group instead of by person, and sensible limits on sharing outside the company.
A regular review of who can open each shared folder, and a list of files shared with people outside the company.
An old app that only runs on the office server, a cloud app with its own separate password, or a move to Azure or AWS that ends up costing more than the server it replaced.
Where the vendor offers a hosted version, we help you move to it. Where an app has to run on a server, we set it up in Azure or AWS if that makes sense, or keep it on site if it doesn't. Where we can, apps sign in with the same work account. We work with the tools you already use.
A list of your apps: where each one runs, who supports it, how people sign in, and what it costs each month in the cloud.
A deleted mailbox or a wiped shared drive with no way back, because everyone assumed Microsoft or Google already had it covered.
A separate backup of mail, files, calendars and Teams or shared drives, kept outside your Microsoft or Google account, with its own admin login protected by MFA.
We check that backups finish, and we restore real files on a schedule to prove they come back. The date and result go in your report.
Here is how we move a small office off its old server, from the first list to switching the server off. The company is made up. The steps are the ones we follow every time.
Cedar Row Studio has a server in the back room that everyone calls "the S drive". It also runs the accounting app, receives scans from the copier and holds an old backup. Most of that is undocumented.
We list every job the server does, every shared folder and who uses it, every mailbox, and every device that depends on the server. Nothing moves until the list is complete and you have seen it.
On the old server, the Finance folder is open to everyone, and two people who left last year can still reach it. Copying that as-is would carry the same problem into the cloud.
We agree with you who should see each folder, set it up by group (Owners, Design, Admin) instead of by person, and remove former staff. The new setup starts clean.
In about 68% of breaches, a person played a part without meaning to: someone clicked, was tricked, or made a mistake.
Before the whole office moves, three people use the new setup for their real work: email on laptop and phone, shared files, the shared calendar and the copier.
We fix what the pilot finds, write short how-to notes for the rest of the team, and only then set a date for everyone else.
Old email, calendars, contacts and the shared folders are copied to Microsoft 365 in the background. The team keeps using the old system, so nothing stops.
We compare what was copied with what is on the old system, mailbox by mailbox and folder by folder, and chase down anything that didn't come across. Files with names or paths the cloud won't accept are fixed first.
The cut-over is the moment new email starts arriving in Microsoft 365 instead of the old system. We plan it for after close, so nobody is in the middle of something.
We change the setting that tells the internet where to deliver your email, run a last copy of anything that changed, and set the old file shares to read-only so nobody saves to the wrong place. We send test mail in and out before we call it done.
On the first morning, people set up MFA, open Outlook and find their files in the new place. A move is a good moment for fake emails, because people expect messages about their mailbox.
An engineer is on hand to help each person through the first sign-in. Before the move, we tell everyone we will never email a link asking for their password, so a message like this one stands out. We come on site when the job needs it.
The FBI received 21,489 business email compromise complaints in 2023, with about $2.9 billion in reported losses.
Your mailbox move is incomplete. Sign in again within 24 hours or older messages will be lost.
Finish migrationOnce you confirm nothing is missing, the old server still holds years of company data. Left in the back room, it is one more thing to patch, or to lose.
We keep a final copy for as long as you decide, wipe the drives before the hardware leaves, remove the server from your network and update your documentation. Your monthly cloud reporting starts from here.
Every item below is set up, watched and reported on by ThinkOpen engineers. Some happen once, during the move. The rest happen every month after it.
Your company's account with Microsoft or Google (called a tenant) set up from a security baseline: users, groups, shared mailboxes, Teams or Meet, and sensible sharing settings.
Old mail, calendars and contacts copied from your current system, checked mailbox by mailbox, with the cut-over at a quiet time you choose.
Shared folders moved to SharePoint and OneDrive or Google Drive, organized the way your team works, with permissions by group and former staff removed.
One account per person, MFA on every account, admin rights kept to a few separate admin accounts, and sign-in rules where they help.
We match each person's plan to what they actually use, remove seats nobody needs, and watch renewals so a lapsed subscription doesn't stop your email.
Kovah onboards a business onto Microsoft 365 or Google Workspace, then keeps watching it. It checks the tenant against a security baseline every week, watches email authentication every night, and flags a lapsing subscription days before the email goes dark.
A separate backup of Microsoft 365 or Google Workspace mail, files and calendars, kept outside your account, with restores we test on a schedule.
For a business app that has to run on a server, we compare keeping it on site, the vendor's hosted version, and Azure or AWS, then set up the one that fits, with its monthly cost written down.
People joining and leaving, mailbox and sharing requests, and a watch on sign-ins, email records and backups. Detection tools run around the clock; our engineers respond Mon–Fri 8–5 PT.
Once a month you get a short report in plain English: licenses you pay for against licenses in use, who has MFA, any risky sign-ins, whether backups finished, and the few decisions only you can make.
Your first full month on Microsoft 365. Everyone signs in with MFA, backups finished every night, and we found three licenses nobody was using. Two items need your decision, listed below.
Tell an engineer where your email and files live today and what bothers you about it. You leave with at least one thing worth fixing.
We review your server, your email, your accounts and your licenses, without changing anything, and write down what you have and what is at risk.
Before anything moves, you get a plan in plain English: what goes where, who is in the pilot, when the cut-over happens and how we would roll back.
It can be. Microsoft and Google handle the buildings, the servers and their updates, so those no longer depend on someone at your office remembering. Most problems we see in the cloud come from how it was set up: no MFA, too many admins, files shared with anyone who has the link.
Under Microsoft's shared responsibility model, your accounts, your devices and your data stay your responsibility. A cloud setup is as safe as those parts are.
We plan the move so nothing gets left behind. We list everything first, copy while you keep working, compare what was copied against the original, and keep the old system read-only until you sign off. If something turns up missing later, it is still there to recover.
Microsoft keeps the service running, and it lets you recover deleted items for a limited time. That is different from a backup you control. Under Microsoft's shared responsibility model, protecting your data stays with you.
That is why many businesses add a separate backup of Microsoft 365 or Google Workspace. If a mailbox is deleted, a shared drive is wiped or an attacker deletes files, a separate backup is how you get them back.
Yes. Some apps only run on a local server, some files are too large to work with over the internet, and some equipment, like a machine on the shop floor, has to stay where it is. A mix is common. We will tell you what is worth moving and what is better left where it is.
Both work well for a small business. Microsoft 365 often fits teams that live in Word, Excel and Outlook, or whose clients and vendors send those files. Google Workspace often fits teams that already work in Gmail and Google Docs in the browser.
The apps your business depends on matter too, since some only connect to one. We set up and run both, so we can recommend the one that fits how your team works.
Sometimes. If the vendor offers a hosted version, that is often the simplest route. If the app has to run on a server and your team works from several places, Azure or AWS can make sense. If only a few people use it from the office, a server in the cloud can cost more each month than the one you have. We compare the options and put the monthly cost in writing before you decide.
Fifteen minutes with an engineer. Bring your questions about the server in the back room, your email or your licenses.