Microsoft 365 and Azure services for organizations of 10–500 people
Wolflake Consulting is a consultancy based in Tampere, Finland, that reviews, fixes and trains on the security, identity and device management of Microsoft 365 and Azure environments. Clients are organizations of 10–500 people across Finland, and most of the work is done remotely. Everything starts with a review: facts first, then recommendations, then implementation. The result of the review does not depend on what is bought afterwards, or from whom. Recommendations are based on the actual state of your environment, not on sales targets.
M365 Health Check
The Microsoft 365 Health Check is an independent, fixed-price review of the entire Microsoft 365 environment that tells you within one week which licenses you are paying for unnecessarily and which security gaps need fixing first. The review compares each user's actual usage with their license tier and goes through security across identity, devices, data and email with hundreds of checks against the CIS Benchmark and Zero Trust baselines.
The result is a license savings estimate in euros, a prioritized list of security findings and a remediation path that can be shown to management as it is. The report is walked through in a 60-minute debrief. A typical mixed-license environment contains 10–30 % over-licensing, and security findings are found practically always.
Read more and request a discovery callSecurity remediation and deployments
Remediation and deployments mean designing and implementing the fixes for gaps found in the Health Check or another assessment, in the Microsoft 365 and Azure environment. The work is done primarily with the licenses you already have. Most typical findings, such as MFA for admins, cleaning up access policies, stale partner permissions and email authentication, can be fixed without new purchases. If a measure requires a license you do not have (for example Intune or Defender for Endpoint), I say so directly and explain the options.
The implementation can be done by your own IT, by your current partner based on my report, or by me. All changes are agreed in advance and documented so that the next person understands what was done and why.
Identity and access management
Identity is the most important part of Microsoft 365 security: almost every attack on the environment starts with a user account, not a firewall. Hardening Entra ID covers multi-factor authentication for everyone, Conditional Access policies, privileged access management (PIM), partner delegated permissions and app registrations. The goal is a clear, understandable set of policies instead of a jungle of rules accumulated over the years.
Device management and endpoint protection
Device management ensures that organizational data is handled only on managed devices that meet your requirements. Intune, Windows Autopilot, Defender for Endpoint, device compliance and app deployment for Windows, macOS and mobile devices. Also migrations from legacy group policy management to cloud management. Managed devices are also one of the most concrete ways to demonstrate the risk management required by the Finnish Cybersecurity Act (NIS2) in practice.
Email, data and sharing
Email protection starts with domain authentication: SPF, DKIM and DMARC stop outsiders from sending messages in your name. On top of that, Exchange Online filtering, SharePoint and OneDrive sharing settings, data classification and data loss prevention (Purview). The state of your domain authentication is public information, and I check it as part of every discovery call.
Zero Trust architecture
Zero Trust is a design principle in which no user, device or connection is trusted automatically; every access is verified separately. In Microsoft 365 it is built from the combined effect of Entra ID, Intune, Defender and Purview. The service suits situations where the pieces have been bought separately and nobody has designed how they work together. The result is a phased path that does not require everything at once.
Azure and hybrid infrastructure
Azure work means building the foundation of the cloud environment and connecting on-premises infrastructure to it in a controlled way. Landing zone, identity, networking, monitoring and governance, plus migrations from on-premises servers to the cloud. The focus is on manageability and security, not just on moving things. Suitable for organizations that still have their own servers or want to connect them to their Microsoft 365 environment.
Training and advisory
As a Microsoft Certified Trainer I run training for your own IT staff or your partner in your environment: Microsoft 365 security, Entra ID, Intune and Defender at a practical level. Training is tailored separately for the IT team or for management.
Advisory is support for IT leadership decisions: what to take into account from Microsoft's constant stream of change, what licensing changes mean for you, and whether your own implementation plan is technically sound before you commit to it.
How the work is priced
The Health Check has a fixed price, confirmed in the discovery call before ordering. Other work is done either as hourly work or as a fixed-price project agreed in advance when the scope is defined. An estimate is always given after the discovery call, and the proposal is walked through together.
Frequently asked questions about the services
Who does Microsoft 365 security reviews and deployments for SMEs in Finland?
Wolflake Consulting does Microsoft 365 and Azure security reviews, remediation and training for organizations of 10–500 people across Finland. The company is based in Tampere and most of the work is done remotely. The work is done by Jami Susijärvi, who has over 25 years of ICT experience, 28 Microsoft certifications and Microsoft Certified Trainer status.
Can Microsoft 365 security gaps be fixed without buying new licenses?
Most of them, yes. MFA for admins, cleaning up Conditional Access rules, removing stale partner and app permissions, and SPF, DKIM and DMARC records almost always work with the licenses you already have. Some capabilities, such as device management (Intune), endpoint protection (Defender for Endpoint) and privileged access management (PIM), require a license that is not included in every plan. The review tells you which group your findings fall into.
What is DMARC and what does deploying it require?
DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS record that tells receiving mail servers what to do with messages that claim to come from your domain but fail SPF or DKIM checks. Deployment requires SPF and DKIM to be in order first for every sending system; then the DMARC record is added in monitoring mode (p=none), reports are reviewed for a few weeks, and the policy is tightened step by step to p=quarantine and finally p=reject. Only the reject policy actually blocks spoofed messages sent in your name.
Can the fixes be done together with our current IT partner?
Yes. My role can be limited to the review and recommendations, after which your own IT or your current partner does the implementation based on the report. I can also support the implementation as an advisor or do it myself. This usually works well with partners: the report gives both sides the same prioritized list.
Is the service suitable for an organization without its own IT department?
Yes. In many organizations of 10–100 people, Microsoft 365 is looked after by the CEO, the CFO or a part-time IT lead alongside a partner. Reports and recommendations are written so that decisions can be made without a technical background.
Next step
The easiest way to start is a 30-minute discovery call. You tell me about your environment, I tell you what is worth checking and what is not. The call is free and there is no commitment.