Microsoft 365, without the guesswork.
Practical field guides, decision frameworks and tenant hardening notes for Microsoft 365 administrators, architects and IT leads working with real production environments.
Microsoft 365 Backup vs Third-Party: 2026 Decision Framework
In 2026, "do I still need a third-party backup tool?" is a serious architectural question. The honest framework: what M365 Backup covers, what it doesn't, and when Veeam, AvePoint or Druva are still the right answer.
Read the framework →Latest field guides
Recent practical guides on tenant operations, security and architecture. New articles publish roughly weekly.
Secure Boot 2026 Certificate Transition: Field Guide for Windows IT Admins
Microsoft Secure Boot certificates from 2011 begin expiring in June 2026. Inventory, validation, and phased deployment of the 2023 family across endpoints and servers.
Group Policy to Intune Migration Guide 2026: Inventory, Mapping and Cutover
GPO to Intune migration is a tool swap on the slide and an architecture change in the room. Realistic readiness path with phasing, cutover and operating model.
Sensitivity Labels Decision Builder 2026: Classification Is Governance, Not Just Marking
Interactive guide to designing a sensitivity label strategy: taxonomy, file vs container labels, encryption, auto-labeling, DLP integration and Copilot readiness.
Exchange Online Mail Flow Decision Builder: Rules, Connectors and Sending Patterns for 2026
Interactive decision builder, recommended patterns for 16 real-world scenarios, SMTP AUTH / HVE / Graph / ACS comparison, and the dangerous bypass rules to fix.
Exchange Online Transport Rules: Real-World Patterns That Actually Work in Production
Baseline rules most tenants need, external sender tagging, disclaimers, security patterns, the AND/OR condition trap, priority logic, and a 14-point audit checklist.
Microsoft 365: May 2026 Recap and What to Watch in June
30 items across Intune, Exchange, Entra ID, Defender, Purview and Copilot — with impact badges, source links, and the June preview tracker.
Monthly Microsoft 365 tracker
One post per month. Thirty Microsoft 365 items across Intune, Exchange Online, Entra ID, Defender, Purview and Copilot, each scored with an impact badge and linked to its Microsoft Learn or Microsoft 365 Roadmap source.
About this site
I'm Tiago S. Carvalho, a Microsoft 365 architect and consultant. I work with organisations to audit, harden and modernise Microsoft 365 tenants — from Intune device management to Exchange Online mail flow, Entra ID Conditional Access, Defender, Purview and Copilot readiness. The field guides on this site are the realistic operational notes from those engagements.
If your tenant has an upcoming assessment, a security posture review, a phishing-resistant MFA rollout, or a Copilot readiness conversation on the calendar — that is the work I do.
Need a second pair of eyes on your Microsoft 365 tenant?
I help organisations review, harden and modernise Intune, Exchange Online, Entra ID, Defender, Purview and Copilot readiness.
Get in touch