Multinational corporation: Office 365 for 1,500+ staff, Fortinet in every office and a 24/7 SOC

A multinational corporation with offices in four US states, in Moldova, in Romania and in India — over fifteen hundred employees in seven locations across three continents. Different time zones, different regulatory frameworks, different user roles: from frontline operators to executives and staff in critical departments with elevated data-protection requirements.

Microsoft 365 at this company is not just corporate email — it is a full working environment where employees spend most of their day: communication, documents, collaboration, business intelligence, process automation, mobile device management and compliance. Practically the entire ecosystem is deployed and actively used.

One important note up front: a significant portion of this project — particularly the architecture and operating procedures of the security monitoring centre — is covered by a non-disclosure agreement. We do not disclose those details even in anonymised form. At this level of project, client confidentiality is part of the engineering work, not a marketing concession. What is described below covers only the parts of the project that can be discussed publicly without risk to the client.

A corporate IT environment for a distributed international company with differentiated requirements per department:

• Unified corporate identity and email for all 1,500+ employees on Microsoft 365.
• Flexible licensing by role: different Microsoft 365 plans for different user groups, instead of "max licence for everyone".
• XDR endpoint protection in critical departments — elevated requirements for telemetry, incident investigation and early-stage response.
• A unified network perimeter on Fortinet across all seven locations, with centralised policy management and event analysis.
• Unified Wi-Fi on Ubiquiti UniFi in every office, from a single management console.
• DLP systems to control and prevent leakage of sensitive data.
• A 24/7 SOC, organised jointly with the client's own security team.

Microsoft 365 — the full ecosystem for 1,500+ employees

A single tenant was rolled out with unified corporate identity on Microsoft Entra ID, MFA and conditional access. Licences are distributed by role and department — where basic email and collaboration is enough, more economical plans are used; where advanced scenarios are required (extended compliance, advanced search, elevated endpoint protection), the corresponding higher plans are used. This delivers significant savings compared with applying the maximum licence across the board.

Staff actively use the entire Microsoft 365 stack:

• Exchange Online — corporate email and calendars with unified delivery and retention policies.
• Microsoft Teams — primary communication channel, meetings, video conferencing, voice calls, third-party integrations per department.
• SharePoint Online — portals and document libraries with role-based access by department and project.
• OneDrive for Business — personal file storage with automatic sync across devices.
• Office (Word, Excel, PowerPoint, Outlook, OneNote) — desktop and web versions, with unified corporate templates and styles.
• Microsoft Entra ID (formerly Azure AD) — single identity, MFA, conditional access, SSO to third-party applications.
• Microsoft Intune — management of corporate laptops and mobile devices, compliance policies, remote wipe on loss.
• Microsoft Defender for Office 365 — email protection against phishing, malicious attachments and dangerous links.
• Microsoft Defender for Endpoint — endpoint telemetry and response, paired with XDR in critical departments.
• Microsoft Purview — DLP, retention policies, eDiscovery and audit for compliance.
• Power Platform — Power BI for business intelligence, Power Automate for process automation, Power Apps for internal department apps.
• Microsoft Planner and Microsoft Lists — task and register management inside teams.
• Microsoft Forms — internal surveys and feedback collection.
• Microsoft Bookings — scheduling meetings with external participants.
• Microsoft Stream — corporate video recordings of meetings and training material.
• Microsoft Viva — corporate communications, learning and workload analytics.
• Loop and Whiteboard — real-time collaboration, especially in distributed teams across the US, EU and India.

Every service is included in a single identity and compliance model, policies are configured centrally, and audits and logs flow into a shared security perimeter.

Endpoint protection and XDR

Employees in critical departments with access to sensitive data are protected by an XDR solution: continuous telemetry from devices, event correlation, automatic node isolation on suspicious behaviour. The rest of the fleet has baseline protection appropriate to its risk profile. Policies and exceptions are managed centrally.

Network and perimeter on Fortinet

A FortiGate is deployed in each of the seven offices. Policy and update management is centralised through FortiManager, which lets us roll a single security ruleset to every site in one motion and keep configurations in sync. Events from every perimeter are collected into FortiAnalyzer, providing a unified correlation view of network activity across the whole company.

A cloud-hosted server is dedicated to that central layer — FortiManager and FortiAnalyzer run on it, removing dependency on hardware in any single office and keeping the management plane available even during local incidents.

Corporate Wi-Fi

Wi-Fi is rolled out on Ubiquiti UniFi equipment with a centralised controller in every office. This delivers a single working profile — the same SSID, the same policies, the same certificates — across all locations, so an employee moving between offices connects with no extra steps.

DLP

DLP mechanisms are deployed to prevent leakage of sensitive data through email, file shares and cloud. Policies are tuned by department and data category, and events escalate to the security team.

24/7 SOC — jointly with the client's security team

Together with the client's own security team, a security monitoring centre with round-the-clock observation has been built. The SOC uses data from every layer of the infrastructure — endpoint protection, Fortinet network events, DLP, Microsoft 365 identity — and operates in continuous detection and incident response mode.

The details of the SOC architecture, its tooling, response playbooks and metrics are covered by an NDA and are not published. This is a deliberate choice: client confidentiality is part of our service, especially for projects at the level of corporate security.

If you are curious about what a SOC is and why a business needs one, we plan to cover the topic in a dedicated post on our blog in general terms, without references to any specific client.