Work

Owned · CLOUD ADMINISTRATION

Self-Hosted Multi-Tenant Administration

Multi-tenant administration tooling is the highest-value system in any managed environment. Where it runs, who can reach it, and who holds its audit trail are architecture decisions rather than deployment details.

Administrative platform and its audit trail held in-house

  • Microsoft Azure
  • Linux
  • Entra app registrations
  • Microsoft Graph
  • Backup & restore

The decision

Running this class of tooling on a hosted instance means a third party operates the system that administers your environments. Self-hosting is more work and it is the correct trade here, because owning the host means owning the credentials, the audit trail, and the upgrade schedule.

Migration

  • Deployed the platform to Linux on Azure and migrated the existing configuration without re-consenting every organization.
  • Application registration scoped to the permissions actually used rather than the permissive default set.
  • Administrative access placed behind identity controls, with the audit trail retained on infrastructure I control.
  • Backup and restore path defined and tested, so a bad upgrade is a recovery rather than a rebuild.

Ongoing

Upstream releases are staged and validated before they reach the live instance. Applying updates blind to a system with this reach is not a maintenance policy.

Evidence

Screenshots are from running systems. Client names, user identities, addresses, and financial values are redacted.

Administration console covering the Microsoft 365 portion of the environment: 25 tenants, 522 users, 401 mailboxes, and 87 Intune-enrolled devices. These are Microsoft 365 figures and do not represent total client count or total endpoint inventory.
Administration console covering the Microsoft 365 portion of the environment: 25 tenants, 522 users, 401 mailboxes, and 87 Intune-enrolled devices. These are Microsoft 365 figures and do not represent total client count or total endpoint inventory.