Infrastructure Controlled by MSP with Limited Visibility

Every day, the 80 employees of a nonprofit human services agency in Central New York started work by asking someone else’s infrastructure for permission.

With limited visibility, growing delays, and no real control over their own systems, leadership reached a breaking point and reached out to ProArch to find a better way forward.

• MSP-controlled infrastructure: Email, files, Active Directory, and the LOB application lived in a private datacenter owned and controlled by the MSP limiting transparency.
• On-prem dependency for day-to-day IT: ~100 Windows endpoints were domain-joined, so policies, patching, provisioning, and support relied on connectivity to the MSP network.
• Slow operations driven by onsite device imaging, MSP managed patching, network dependent security policies, and VPN based remote support.
• Remote work constraints: Access and manageability were bound to the corporate network limiting secure productivity from any location.

A Phased Cloud-First Migration for Non-Profits

ProArch started with an environmental assessment and laid out a clear architectural goal: eliminate every dependency on the MSP's datacenter and rebuild the organization's IT foundation in the cloud.

The migration happened in three structured phases, designed so that staff never felt the transition.

Phase 1: Taking Back Control of the IT Infrastructure

ProArch migrated all servers in a single 10–12-hour window, applying DNS and network changes, running system acceptance tests, and bringing services back online.

Phase 2: Migrating to Microsoft 365

Over eight weeks, each on-premises server workload was removed and replaced with a cloud equivalent

• On-premises Exchange → Exchange Online. Mailboxes migrated with no disruption to daily operations.
• Windows File Servers → SharePoint Online and OneDrive for Business, preserving the familiar mapped-drive experience staff relied on.
• Active Directory → Microsoft Entra ID via Entra Connect sync, then full cloud identity. On-prem domain controllers fully decommissioned.
• Primary LOB application → migrated from a Citrix session in the MSP’s facility to a cloud-based SaaS solution accessible from any browser.

Phase 3: Modernizing Endpoint Management with Microsoft Intune

ProArch moved all device management to Microsoft Intune, eliminating their last on-premises infrastructure

• New Windows devices enrolled directly into Intune via Entra join no imaging, no on-site setup required.
• Security baselines, software deployments, Wi-Fi profiles, and application policies were delivered via Intune configuration profiles. Policies applied to the device regardless of network location.
• BitLocker encryption, screen lock, and OS version compliance enforced automatically. Non-compliant devices blocked from organizational resources via Conditional Access.
• ProArch’s team gained full Intune remote management: push apps, push patches, wipe or reset devices, and read device logs entirely over the internet from anywhere, to any enrolled device.

With Microsoft 365, Microsoft Entra ID, and Microsoft Intune as the foundation, the organization now has an IT model designed for mobility secure by default, cloud-managed, and scalable as the organization grows.

• Replaced Citrix with a cloud SaaS LOB application removing infrastructure complexity, licensing costs, and vendor lock-in.
• Microsoft Intune Endpoint Management enabled end-point management including remote provisioning, patching, and proactive support without onsite visits cutting response times and operational overhead.
• Identity modernized with Microsoft Entra join and Conditional Access, removing domain controllers and VPNs while enforcing compliance-based access from any location.
• All server-based workloads eliminated through Exchange Online, SharePoint Online, and OneDrive improving reliability, scalability, and end-user access to collaboration tools.
• Direct internet connectivity at every site improved application performance and removed dependency on an MSP-managed network.
• IT operating model transformed from reactive and onsite to fully remote and proactive, with a scalable security foundation including MFA, Intune compliance baselines, and ProArch’s 24/7 managed SOC services.