Twelve representative case studies in AI, data, and Microsoft 365

What was wrong

Staff had adopted three different AI assistants on their own, and two of them could reach client financial data. Partner reporting lived in a dozen spreadsheets that one person rebuilt by hand every quarter.

What we did

• The partners adopted an AI Use Policy with separate rules for each kind of client financial data
• We reviewed the two tools that could reach client data, approved one, and retired the other
• We listed the practice-management, tax, and billing systems and confirmed each could be connected
• We set up the reporting dashboard in the firm's own Microsoft cloud account

What changed

Partner reporting now comes from the dashboard instead of the spreadsheet chain, and IT spend is reviewed every month. The next automation on the plan replaces the manual client onboarding checklist.

Read the full profile

What was wrong

Production, inventory, and finance each ran their own system, and leadership saw a combined picture once a month, assembled by hand from spreadsheet exports. AI tools were banned on paper, but staff were using them across the company.

What we did

• We replaced the AI ban with an AI Use Policy that sets rules by role and by kind of data
• We listed the AI tools staff had signed up for on their own while the ban was in place
• We confirmed the ERP, warehouse, and accounting systems could be connected directly
• We set up a dashboard with production, inventory, and spend in one place

What changed

The controller no longer builds the monthly report by hand, and leadership reads the same dashboard the floor managers use. The first automation on the plan is an alert when inventory and production numbers disagree.

Read the full profile

What was wrong

The firm came asking for AI automation, but it had no written AI rules, no list of its systems, and no single view of its own numbers. Automation built on systems that did not share data would have repeated the same errors faster.

What we did

• We started with the advisory review: the AI Use Policy adopted, AI use assessed, and the request for an AI assistant tested against the firm's systems
• We confirmed the CRM and time-tracking systems could feed one reporting platform
• We set up the dashboard, including the standard report on what technology costs
• We planned the automation last, from the firm's own data

What changed

The automation the firm first asked for is being built into the platform it now owns, under its own policy, using data from its own systems and the subscription it already pays for.

Read the full profile

What was wrong

Front-desk staff across three sites were using an unapproved AI tool to draft patient letters. The practice administrator suspected it but could not prove it, and had no rule to point to. Reporting came from practice-management exports that no one checked against each other.

What we did

• The practice adopted an AI Use Policy with one firm rule: no patient-identifiable data outside its own Microsoft account, with a named owner for exceptions
• The assessment confirmed the unapproved AI tool at all three sites and found a transcription tool the clinical lead had bought on a company card
• We mapped practice management, scheduling, and billing, and the transcription tool passed an access review and stayed
• We set up the dashboard in the practice's own Microsoft cloud account and switched on AI security features to enforce the patient-data rule

What changed

Patient letters are now drafted in an approved tool inside the practice's own account. The monthly AI report shows blocked and approved activity by site, and reporting on visits, billing, and no-shows comes from one dashboard.

Read the full profile

What was wrong

The nonprofit had no IT staff and an outside IT firm on a basic contract. Every quarter, the development director built grant reports by hand from the donor database and the accounting system, and volunteers were using free AI tools on donor lists.

What we did

• The board adopted an AI Use Policy that treats donor data as protected and covers volunteers in writing
• The assessment found donor exports in two personal AI accounts, and both were closed
• We connected the donor database and the accounting system and marked the grant-tracking spreadsheet for replacement
• We set up the dashboard in a new Microsoft cloud account owned by the nonprofit, and the board added the vCIO Advisory tier

What changed

Grant reports now come from the dashboard in an afternoon, and the board receives a quarterly technology brief from the vCIO. IT spend is visible for the first time, and one duplicate subscription was canceled.

Read the full profile

What was wrong

An acquisition arrived with its own Microsoft account, 18 mailboxes, three years of files whose permissions no one had checked, and a renewal nine weeks away. Sales wanted Copilot, the license list did not match the staff list, and running two accounts doubled the admin work.

What we did

• We reviewed licensing across both accounts and found 68 licenses paid for against 51 active users, with the renewal nine weeks away
• The Microsoft 365 tenant review ranked the risks: five top-level admin accounts, old password-only sign-in still on, 14 anyone-with-the-link sharing links, and nine apps awaiting approval
• We worked with the IT firm on the fixes, cutting admin accounts to two, blocking password-only sign-in, and closing the sharing links and app approvals one by one
• We planned the move into one Microsoft account, then ran it for sign-ins, mail, files, and Teams, reviewing permissions along the way
• Once permissions were settled, we labeled sensitive files and ran a 12-person Copilot pilot for sales, measuring use against cost per active user
• Monthly Microsoft 365 reporting now covers licenses and usage, Microsoft's security score, the renewal calendar, sharing changes, and apps awaiting approval

What changed

The agency now has one Microsoft account, one renewal, and a license bill that matches active use. The monthly report covers the account alongside the AI dashboard, so the next renewal decision is prepared before the date arrives.

Read the full profile

What was wrong

The company had ninety staff and an outside IT firm that did good work, but leadership met the firm once a quarter, and every meeting started with whatever had broken. Three AI tools had been bought by different departments, and the ERP renewal was eighteen months away with no plan for it.

What we did

• The company adopted the AI Use Policy, and the assessment listed the AI tools already bought
• We set up the dashboard with the standard technology cost report, so license, vendor, and subscription spend appeared in one view
• The vCIO Program started with monthly plan reviews, vendor renewals, and written priorities for the IT firm
• We agreed a scorecard with the IT firm and review it monthly, and problems now come to the vCIO instead of the owner
• Dashboard maintenance and the AI security subscription run monthly, and the maintenance note opens each leadership meeting
• We built the annual IT budget from the dashboard's cost report and agreed an automation plan with leadership, one feature per quarter

What changed

The IT firm has written priorities and a scorecard, and renewals are negotiated from a calendar instead of a reminder email. Two automations from the plan are live, and the third was scoped from what the dashboard showed.

Read the full profile

What was wrong

Two companies were merging, a new ERP had already been signed for, and the IT director had left. The board was being asked to approve technology spend against a plan no one in the room could explain, and no one had compared the two companies' AI tools.

What we did

• We wrote one AI Use Policy for the combined company before the two companies' systems were joined
• The assessment covered both companies, and duplicate AI tools were priced before their renewals came due
• The applications assessment for the merged business set out what replaces what, in what order, and what waits a year
• We took a weekly place in leadership and operations meetings, and every ERP and migration decision came with a written assessment
• We prepared the board briefing pack before the approval vote and supported due diligence on a second acquisition
• We covered IT leadership while the search ran, then handed over to the incoming director

What changed

The ERP went live within the agreed window, with the AI policy already in force across both companies. The new director inherited a technology plan, a license inventory, a renewal calendar, and a list of open decisions in place of a stack of vendor email.

Read the full profile

What was wrong

The company already ran Microsoft 365. Calls still lived on a separate cloud phone system, and new people were still being added there. Leadership wanted calls in Teams without a weekend where the published numbers went quiet.

What we did

• We listed the numbers, extensions, and sites that still depend on the old system
• Each person moves onto Teams with a temporary number, so they can work before the port
• The old system forwards each published number, so callers still reach the person
• We prepare the port paperwork and hold it until the forwards are confirmed
• The old system stays in place until the published numbers have moved

What changed

The move is running in production, and people answer calls in Teams. Published numbers still arrive through the old system, which can close once the port is complete.

Read the full profile

What was wrong

The firm had Microsoft 365 but no sensitivity labels, so a file that was downloaded or emailed left every protection behind. An older encryption rule had already been turned off.

What we did

• We started with a licensing review to see which protections the current plan can enforce
• We took a read-only export of the account and used AI to draft a set of labels
• A person reviewed the draft and applied four labels in Microsoft Purview
• A labeled file stays encrypted when it is downloaded, copied, or attached
• Email encryption is available when someone chooses it and is not forced on every message
• Daily administration stays with the firm's own team

What changed

The labels are in place, and a confidential file keeps its protection after it leaves SharePoint. Email is encrypted only when someone chooses it, and the setup project is complete.

Read the full profile

What was wrong

Servers, circuits, and contracts had built up across the company's sites. No single report showed the monthly cost or which services did the same job twice, and a line that looked easy to cancel often sat inside a contract with months left to run.

What we did

• We took a read-only inventory of servers, sites, circuits, and contracts
• AI calculated current spend from that inventory and the bills
• Overlapping services and unused lines were marked as waste
• We projected savings over several years, timed to each contract's end date
• A person checked the projection before it went to leadership

What changed

Leadership has a priced picture of the network and a projection of what consolidation and less waste would save over the coming years. The savings are projected and have not yet been collected.

Read the full profile

What was wrong

A half-finished WordPress rebuild sat on a hosting company's staging server. Its robots file blocked every search engine, the forms did not send, and the closings banner was fixed text that always read open.

What we did

• We reviewed the WordPress build to see what worked, what was placeholder, and what needed a server at all
• We rebuilt the site as static pages in the organization's own Microsoft cloud account, keeping the approved copy unchanged
• We set up search and AI answers with a sitemap, robots rules, structured data, share images, and an llms.txt guide
• We added a staff editor and a form inbox, with sign-in through the staff's Microsoft work accounts
• The client approved the brand redesign two weeks after work began, and the public launch is set for November

What changed

Every public page loads, every form reaches a staff inbox, and search engines are invited in rather than turned away. On the home page, the Lighthouse search score went from 92 to 100 and performance from 58 to 87.

Read the full profile