Solution
Mail and collaboration tenant
A tenant grows by accretion: one more administrator, a forgotten external share, licences nobody reviews. I compare the operator, the contract, the processing locations and the support access before choosing, then design or take over the tenant with separated roles, a protected domain, a tested migration and licences reconciled to people.
The claims you can finally make
A written answer on operator and contract
A client or an auditor asking where the data sits and who can reach it gets a documented answer, not a guess about where a datacentre happens to be.
Direct domain spoofing is reduced
Aligned SPF, DKIM and DMARC let receiving servers reject more mail sent fraudulently in your exact domain's name. They stop neither lookalike domains nor a false display name.
Licences follow people
Every licence is reconciled to a person, a use and a renewal date. You approve each removal before it is applied, and the saving shows on the next invoice.
A migration that doesn’t break the week
A pilot, a coexistence period, a reconciliation and a rollback limit the risk. The window is stated rather than denied.
In practice
- A decision matrix that also tests keeping the current service: operator, contract, processing locations, support access, subprocessors, retention, export and deletion
- Tenant design: separated admin roles, conditional access, external sharing rules, retention and logs
- SPF, DKIM and DMARC introduced in stages and monitored, for Exchange, Google Workspace, kSuite, Infomaniak or Proton mail
- A piloted migration with coexistence; history, calendars, contacts, aliases and shared mailboxes reconciled before the old service closes
- Licence reconciliation: assignment, use, contract, renewal and owner, with every removal approved before application
- A decision record for the applicable processing: operator, contracts, access, locations, subprocessors, retention and exit, with legal review where interpretation is required
Systems involved
- Microsoft 365 and Exchange Online, Google Workspace, Infomaniak kSuite
- Proton Mail and Proton Drive where the extra confidentiality justifies its constraints
- The domain registrar and the DNS records
- The directory of record and the secrets manager
- Vendor and reseller portals for licences
Service lineServers and hosting →
The tenants to keep in order
The same work, against each sector’s own constraints. Every card opens the full sector.
Healthcare and life sciences
Mail whose operator and contract are documented
The clinic's or laboratory's tenant carries separated admin roles, controlled external sharing and a written answer on the operator, the processing locations and the subprocessors, the one a patient or a partner may ask for.
Logistics and supply chain
One tenant per group, not one per site
The sites share one Microsoft 365 or Google Workspace environment with separated admin roles, reviewed external sharing and licences reconciled to people before every renewal date.
Retail and e-commerce
One collaboration tenant kept in order for every shop
The shops' Microsoft 365 or Google Workspace tenant gets separated admin roles, a protected mail domain and licences reconciled to people: the right tier for each person rather than the highest for everyone.
How it runs
Scoping
Confidentiality, contract, access, location, retention and exit each get named first. The service comes after that decision.
Design
Admin roles, sharing and retention rules and the domain records are drawn, then the tenant is prepared while the current service keeps running.
Migration
History imported, then the MX records switched inside an announced window. The old mailbox stays readable until the final reconciliation.
Verification
Inbound and outbound mail, delegation, sharing and a mailbox restore are tested. DMARC reports show the real senders; I reconcile them before tightening the policy, and hand over the reconciled licence list.
To go deeper
Reducing the IT bill: the levers that work, AI included
Caching, batch processing, model tiering, virtualisation, per-seat licences: what actually lowers an IT bill, the July 2026 figures, and the cases where free costs more.
Leaving US cloud services: Swiss and European alternatives
Email, office suite, storage, CRM, accounting, signature, analytics, AI: for every common US tool, a serious Swiss or European alternative, and an honest view of what you gain and what you lose.
Test the fit: Mail and collaboration tenant
Describe the context, constraints and decision you need to make. The first conversation qualifies scope, boundaries and the next useful step.
Describe the situation