IT operating-model standardization

When a national company grows by acquisition, every new office tends to arrive as its own little company: its own Microsoft 365 or Google Workspace tenant (or none), its own firewall and switches, its own phone system, its own printers, its own helpdesk or outside MSP, and its own way of doing things. Left alone, that becomes dozens of different environments to support. This is the multi-year program to collapse all of it onto one operating model, so a user at a location onboarded last quarter logs in, gets support, prints, and makes calls exactly like a user at headquarters.

The company grew from roughly 650 users across 40 offices in 2024 to more than 1,000 employees across 80+ locations by 2026, through a mix of acquisitions and absorbing IT that had previously been outsourced. Standardization is what kept that growth supportable by a small internal IT team: each new site converges to the same standard instead of adding one more set of consoles, contracts, and exceptions.

The problem

• Every acquisition arrives different A new business shows up with its own tenant, domain, network gear, phone and fax lines, printers, and support model, none of it matching the standard.
• Complexity compounds, headcount does not Without a standard, each new location multiplies the number of distinct things a small team has to know, license, and maintain.
• Inconsistent security posture Different MFA, patching, and endpoint-protection states across acquired environments are a real risk surface until everything is pulled to one baseline.

What every location converges to

• Identity and cloud A single Microsoft 365 / Entra ID tenant with one identity convention, a hybrid AD-to-Entra setup, consistent naming standards, and dynamic group membership.
• Security baseline Conditional Access, enforced MFA, privileged-role management, and Microsoft Defender applied uniformly so every location meets the same bar.
• Endpoints Intune for Windows and Apple Business Manager with Intune for Macs, using standard device profiles so a machine is configured the same way regardless of where it was bought.
• Endpoint security and patching One endpoint-protection platform (Bitdefender GravityZone) and one patch-management platform (Action1) across the whole estate, replacing whatever each acquired environment happened to run.
• Network stack A consistent Cisco Meraki standard (security appliances, switching, wireless) with site-to-site VPN, replacing the assortment of firewalls and switches that arrive with each office. See the multi-site network refresh.
• Telephony A single phone platform on Microsoft Teams Phone, with numbers ported and main lines moved to auto attendants and call queues, retiring the legacy per-site phone systems.
• Fax Legacy fax lines retired or moved to cloud fax where a fax requirement genuinely remains, so they are not anchoring an old phone circuit at every site.
• Print and MFP fleet A standardized multifunction fleet with central monitoring that auto-orders toner and flags faults before users call, plus standardized scan-to-email and SMTP relay configuration.
• Service desk One ITSM on Freshservice with a shared service catalog, consistent SLAs, categories, and workflows, so support works the same everywhere.
• DNS and domains Domains consolidated under one Cloudflare account (nameservers, MX, SPF, DKIM, DMARC), with registrars transferred in.
• Licensing Microsoft 365 licensing standardized and right-sized across the company rather than inheriting each acquisition's mix of plans and add-ons.
• Documentation A documentation framework spanning the core infrastructure domains, so operational knowledge is written down and standardized rather than living in one person's head. See the internal IT documentation library.

How an acquisition gets integrated

Each acquisition runs through a repeatable playbook rather than a from-scratch project. Source environments are usually Microsoft 365 or Google Workspace, each with its own quirks, so the playbook covers both paths:

• Discovery Audit the source tenant: users, mailboxes, shared mailboxes, room calendars, distribution groups, devices, network, phones, printers, domains, and any outside MSP relationship.
• Identity and email Provision accounts in the target tenant, then run cross-tenant mailbox moves (MoveBot for Microsoft 365, BitTitan / MigrationWiz for Google Workspace) through a coexistence-then-cutover sequence.
• Files Migrate OneDrive / Google Drive and SharePoint / Shared Drives, with the known gotchas handled (OneNote and Planner do not move cross-tenant, so they are exported and recreated).
• Phones and devices Port numbers to Teams Phone; unjoin devices from the source tenant and re-enroll them into Intune / Entra before the domain moves.
• Platform services Recreate Forms, Power Automate flows, Planner, and their Google equivalents in the correct dependency order.
• Domain and DNS cutover Remove the domain from the source tenant, add it to the target, transfer the registrar, and rebuild DNS (capturing the source SPF record before it is overwritten).
• Network and handoff Adopt or replace the site's network gear onto the Meraki standard, then take the outgoing MSP's credentials and documentation and cancel the contract.

The reusable PowerShell tooling and the operating playbook that drive this are a project in their own right. See the M&A IT Integration Toolkit.

What this demonstrates

• Operating-model thinking, not point fixes The win is one consistent way of working across the whole company, not a pile of unrelated migrations.
• Scaling support without scaling headcount Standardization and vendor consolidation are what let a small internal team keep up with growth from roughly 650 to more than 1,000 users.
• Cross-domain breadth Identity, security, endpoints, network, telephony, print, licensing, and service management all pulled to a single standard, end to end.
• Repeatable integration Acquisitions onboard against a playbook and a toolkit, so each one is faster, cheaper, and more consistent than the last.