/CLOUD, MODERN WORK & SECURITY
Make the workplace secure, resilient and AI-ready.
A secure floor has to exist before AI is worth attempting. INFOC settles identity, devices, information protection and threat defence across Azure and Microsoft 365, then treats Copilot readiness as a data and permissions problem rather than a licence assignment.
MODERN FOUNDATION
Five connected control planes
Designed separately, these five planes leave gaps.
PLATFORM
Azure & hybrid cloud
Landing zones, networks, compute, storage, backup, recovery, integration, observability and cost management.
TRUST
Identity & access
Microsoft Entra, conditional access, privileged access, lifecycle, external identity and workload identity.
WORK
Microsoft 365 & Copilot
Exchange, Teams, SharePoint, OneDrive, endpoint productivity, collaboration governance and AI adoption.
PROTECT
Security & compliance
Microsoft Defender, Sentinel where appropriate, Purview, information protection, DLP, retention and investigation.
Hybrid workplace
AZURE & HYBRID CLOUD
Govern the platform before workloads move onto it
Architecture, security, cost and ownership decided on day one, not after the bill arrives.
Strategy & plan
Business justification, application portfolio, dependency, risk and cost: the Cloud Adoption Framework strategy and plan stages, done properly before anything moves.
Ready · landing zone
Tenant, subscription, management groups, policy, network, identity, logging, naming and tagging, built to the Azure landing zone reference.
Adopt · migrate & modernise
Rehost, replatform, refactor, replace or retire, decided per workload on value and constraint rather than on a blanket policy.
Govern & manage
Reliability, security, cost, operational excellence and performance: the five Well-Architected pillars, reviewed per workload with recovery responsibility named.
Cost governance
Budgets, allocation, reservations, right-sizing, lifecycle and showback or chargeback.
Cloud operations
Health, incidents, changes, security posture, patching, capacity and continual optimisation.
MICROSOFT 365 & COPILOT
Prepare information and work practices before scaling AI
Copilot surfaces the permissions you already have, good or bad.
Modern work scope
- Tenant and licence strategy
- Exchange, Teams, SharePoint and OneDrive architecture
- Endpoint and application management
- External sharing and guest governance
- Content lifecycle, retention and records
- Copilot use cases, adoption, responsible-use guidance and measurement
- Agents and knowledge experiences in Microsoft 365 and Teams
SECURITY & COMPLIANCE
Identity and information are the control centre
AI raises the cost of every permission you never cleaned up.
Identity architecture, MFA, conditional access, privileged roles, access review and lifecycle.
Endpoint, identity, email, cloud-app and cloud-workload protection based on licensed scope.
Data discovery, classification, information protection, DLP, retention, records and compliance workflows.
Can the organisation explain who can access sensitive content, why they have access, how the content is classified, and how inappropriate access or agent action would be detected?
COPILOT READINESS
Six steps between buying licences and trusting the answers
Copilot inherits every permission mistake already in the tenant.
Find what is shared with the whole organisation, with anonymous links, or with people who changed role years ago. This is the finding that surprises most tenants.
Close the links, tighten the sites, retire the abandoned Teams. Done before the pilot, because Copilot will surface anything a user could already have found.
Sensitivity labels applied where they change behaviour: payroll, board papers, contracts, customer data. Labels that block Copilot are a feature, not an obstacle.
One or two roles with real work, not a cross-section of volunteers. Named use cases so there is something specific to judge at the end.
Adoption against the use cases, not against seat count. A licence that is assigned and unopened is a cost, not a rollout.
Extend by role, with the labelling and access review running continuously rather than as a one-off project artefact.
SECURITY CONTROL MAP
Six services, one posture, licensed once, configured properly
Most tenants already own more of this than they have turned on.
Conditional access, MFA, privileged identity, access review and lifecycle. The control plane everything else assumes is correct.
Device compliance, configuration, application protection and update rings across corporate and personal devices.
Classification, sensitivity labels, data loss prevention, retention and eDiscovery. The prerequisite for AI on company content.
Endpoint, identity, email and cloud application protection, correlated rather than watched as four separate consoles.
Signal collection, detection rules, automation and incident workflow, sized to what your team can actually respond to.
Control mapping, evidence collection and reporting against the obligations you are actually held to, including PDPA in Singapore.
READINESS
Readiness, existing tenants and measurable posture
Is Copilot readiness just a licence?
No, and treating it as one is the most common way a rollout stalls. Copilot answers from what the signed-in user already has access to. If a payroll file was shared with the whole company in 2021, nobody found it because nobody searched for it. Copilot will. The permission audit comes before the licence order.
Can you work with our existing tenant?
Yes, and that is the usual case. We assess identity, devices, information protection and posture in the tenant you have, then sequence improvements by risk. A rebuild is occasionally the right answer after an acquisition or a long-abandoned configuration, but it is a finding, not a starting assumption.
How is security kept measurable?
Posture score, alert volume and time to close, access review completion, device compliance percentage and label coverage, reported monthly against named owners. The point of the numbers is to make an unowned risk visible, not to produce a dashboard.
We are a small team. Is this too much to operate?
The configuration effort is one-off; the operating load is not, and that is the part small teams underestimate. Conditional access exceptions, joiner and leaver processing, alert triage and update rings all need someone every week. If there is no one, that is an argument for managed services rather than an argument for turning the controls off.
What does this cost in licensing?
It depends heavily on what you already hold. Many organisations on a Microsoft 365 E3 or Business Premium plan already own a large part of this and have configured a fraction of it. The first output of the assessment is what you are paying for and not using, which sometimes funds the rest of the work.
How does this connect to PDPA obligations?
Purview classification and retention, Entra access review and Defender incident handling produce most of the evidence a PDPA response needs: what personal data you hold, who can reach it, how long it is kept, and what happened during an incident. We map controls to the obligation rather than claim compliance, since compliance is a legal determination and not ours to certify.
NEXT STEP
Find out what your tenant would fail on
Describe the environment and the concern. The first reply names what to check, not what to buy.