Cloud foundations · Microsoft 365, Azure, AWS, Google Cloud
A cloud setup designed on purpose, not by accident.
For Indianapolis and central Indiana businesses whose accounts, admin rights and licences were added as needed and never designed. I put identity, access, networking and logging right, write down how it works, and only then build anything on top of it.
Why it comes first
Identity, licensing, networking and logging get decided once, early, and every later decision inherits them. Getting them wrong is expensive to undo, and it quietly widens what a bad day would reach: a phished password, a former employee who still has access, an AI assistant that can read the payroll folder.
That is why every automation and AI project here starts by checking the foundation under it.
What is included
- Account and tenant setup, custom domains, and mail authentication with SPF, DKIM and DMARC
- Identity and access mapped to actual roles, with MFA on every account and separate admin accounts
- Offboarding that removes access the same day, as a checklist or an automated step
- Private networking: private endpoints, DNS zones, and controlled egress
- Secrets and key material in a managed vault, never in configuration files
- Centralised logging, with retention set to what your obligations actually require
- Where regulated data is involved, a written data map and a signed BAA with the provider
- A runbook, so the next person can run it without me
Microsoft 365 security for small businesses
Most small businesses run on Microsoft 365, and most have paid for security features they never switched on. The usual gaps, in the order I fix them:
- MFA that is not enforced everywhere. Admin accounts and shared mailboxes are the usual exceptions, and the usual way in.
- Admins reading email as admins. One phishing link then reaches the whole tenant.
- Sharing that grew without design. “Anyone with the link” files and sites open to the whole company, which matters twice over once Copilot can search them.
- No SPF, DKIM or DMARC. Anyone can send mail that looks like yours, and your real mail lands in spam more often.
- Logs kept for the default period. Incidents are often found later than that.
In Indianapolis
BB Cloud Developments is based in Indianapolis. I meet clients in person across central Indiana, including Carmel, Fishers, Noblesville, Westfield, Zionsville, Greenwood, Lawrence, Avon and Plainfield, and work remotely with businesses anywhere in the United States. You work directly with the person building it.
Questions
Which cloud should a small business use?
Usually the one you are already in. If email and files live in Microsoft 365, Azure is the natural next step; if you run on Google Workspace, Google Cloud is. AWS fits when your software or developers are already there. Mixing is normal, and the identity design is what keeps a mix manageable.
Do we need Microsoft 365 Business Premium?
If you handle sensitive data, often yes. Business Premium adds Conditional Access, device management and stronger threat protection over Business Standard, and for most small businesses it is the cheapest meaningful security upgrade Microsoft sells. Discovery tells you whether your situation needs it.
Can you take over a setup someone else built?
Yes. That is the most common starting point. The first step is an inventory of what exists: accounts, admin rights, licences, sharing and logs. Then the fixes are made in order of how far a bad day would reach.
Do you work with Google Workspace?
Yes. The principles are the same: named accounts, MFA everywhere, separate admin accounts, least privilege, logs kept long enough. My deepest production experience is on the Microsoft stack, and I will say so if a piece of work is better handed to a specialist.
What about HIPAA?
A HIPAA-aligned setup needs a signed BAA with each provider that touches protected health information, configuration that matches it, a written data map, and log and record retention set to what the rules require. Those are built in from the start, not added at the end.
Next step
If the foundation check turned up a No you did not expect, that is usually where discovery starts.