The server nobody wants to touch is the outage you haven't had yet.
Out-of-support systems and loose sign-in security don't fail politely. They fail on a deadline day, or turn up as an audit finding nobody can explain. Get one server or identity job off your list before that happens. We build and modernize Windows and Linux systems on VMware, and rehearse migrations before the real move. Paying for Microsoft 365 Business Premium? We can set up the sign-in security it already includes, or bring a small set of laptops under Intune. The scope and rollback plan go in writing before anything changes. We also build, host and maintain business websites.
Scope and rollback in writing before anything changes. Written reply within one business day.
Know what breaks before anything moves
Understand workloads, access needs, recovery requirements, and the people who will operate the system. Then agree the scope, change sequence, and acceptance checks.
Identity and workplace setup
Accounts, groups and access for a small team, set up so that joining and leaving are procedures instead of memories. Our own work here is Active Directory, where our access review system compares access month to month, and single sign-on through Authentik in our homelab. For Microsoft 365 tenants, the same job happens in Entra ID. On any other identity platform, you'll hear what we'd be learning before we agree scope. The owner keeps the top-level admin account and the recovery path. We take delegated access for the job and hand it back at the end. For recurring HR-to-IT onboarding or offboarding beyond a one-time setup, see Automation & Integrations.
- Account and permission cleanup, with every change written down
- One joiner and leaver procedure, tested on a test user
- Single sign-on and TLS for internal services
- Ownership documented, temporary admin access removed
Microsoft 365 security and device setup
Microsoft 365 Business Premium already charges you for Conditional Access and Intune. Left unconfigured, they protect nothing, and a stolen password can still get someone in. We take one defined change and finish it: sign-in security tightened across the tenant, or a small, listed set of laptops brought under Intune, with the policies agreed before work starts. Each is its own Infrastructure Fix, quoted in writing once we've checked your licenses. One catch: risk-based sign-in policies need Entra ID P2, which Business Premium doesn't include, and you'll hear that cost before the quote.
The tenant stays yours the whole way through, global admin and recovery path included. We work under access scoped to the job and remove it at handover.
The written reply to your first message is free and comes within one business day. When that reply can't settle whether your tenant will support the job, it'll suggest the $350 discovery first: a paid walkthrough of the tenant with you, credited to the project if you go ahead. Compliance certification and round-the-clock monitoring aren't part of this work.
- Conditional Access in report-only mode first, then enforced in stages
- Emergency access accounts tested before any policy is enforced
- Laptops enrolled in Intune from an agreed list, pilot devices first
- A runbook for adding and removing users, and for getting back in after a lockout
Servers and virtualization
Windows and Linux servers, built or rebuilt on VMware and sized for the work they do. Old systems get an inventory before anybody touches them: what runs where, what depends on what, and what nobody wants to admit is still in use. Migrations get rehearsed in a test environment first, with the rollback path written down before the real move. Running Hyper-V, Proxmox or something else? Tell us, and you'll hear exactly how much of it we've worked with before anyone talks scope.
- Windows and Linux server builds and rebuilds
- VMware setup, cleanup and modernization
- Migration planning, with a rehearsal before cutover
- Network isolation, DNS and TLS for the systems involved
Infrastructure automation
The routine somebody runs by hand from a checklist every month is the one that gets skipped the month they're out. It's usually a script waiting to be written. Patching in the right order. Certificates renewed before they expire. Accounts reconciled against a list. We write it in PowerShell or PowerCLI with a dry-run mode and logs a person can read, then leave a runbook for whoever inherits it.
Automated CI/CD. One bad update takes your site or app down, with no quick way back. We set up your website or internal app so every update is tested automatically before it goes live, with a backup first, a staged switch and an automatic rollback when a check fails. Our own website deploys with that same backup, staged switch and rollback.
- Patch and reboot sequencing that respects dependencies
- Certificate expiry caught before users notice
- Scheduled jobs that replace a manual monthly routine
- Restore testing as a specialty (how we built ours)
Website Hosting
We host and maintain websites for clients. It's a real service with a real boundary, and we'd rather draw that boundary now than argue about it in month seven.
What's included
Hosting and the server configuration behind it. TLS certificates and their renewal. DNS records pointed and maintained, on a registrar account you control. Platform and plugin updates, applied on a schedule rather than whenever something breaks. Scheduled backups. Small content and copy edits when you send them over. Monitoring, so that when a site goes down we find out from a monitor and not from you.
Who owns what
You own the domain. You own the registrar account, in your name, with your billing and your credentials. This is not negotiable and it's not a technicality. It's the thing that means you can walk away from us at any point and take your site with you. We'll help you set up the registrar account and point the records, and we'll take delegated access so we can do the job. But the account is yours.
If you'd rather we hold the registrar account, we'll say no. That arrangement ends badly for clients often enough that we won't take part in it.
Backups and restores
Backups run on a schedule. We test restores periodically, because a backup nobody has restored is a hypothesis rather than a backup. That's a practice we follow, not a guarantee we're selling. There's no promised RPO or RTO here, and no promise that any specific restore will succeed on any specific day. What you can count on is that restoring from backup is something we actually do and verify, rather than something we assume works.
Support scope
Support covers the site staying up and staying current: hosting problems, TLS, DNS, platform and plugin updates, breakage after an update, and small content edits. If something goes wrong with a site we host, that's ours to fix.
Not covered
A new build or rebuild, which is its own fixed-price project: The Website Build. Content writing and SEO strategy. Paid advertising, analytics consulting, and campaign work. Ecommerce operations, payment disputes, and fulfillment. Email deliverability beyond the DNS records themselves. Third-party services you own and buy directly, where we can advise but can't control the vendor. Custom feature development, which is real work we're glad to do, quoted separately.
Leaving
If you want to move the site somewhere else, we'll hand over the files, the database, and the configuration, and help your next host get it running. No hostage-taking. You already own the domain, so there's nothing for us to hold.
What it costs
The Infrastructure Fix is $5,500 fixed for one defined change, about 20 business days once access and a change window are approved. Sign-in security across a Microsoft 365 tenant and a listed set of laptops under Intune are separate Fixes, each quoted in writing after a license check. A failed acceptance test gets one free in-scope fix of up to 3 hours and a retest. After a second failure, you choose 10% of the fee back as a partial refund or credit, up to $550. Website hosting is $49 a month, month to month. Changes and out-of-scope work run $80 to $100 an hour, quoted first.
Asked and answered
How much does an infrastructure project cost for a small business, like retiring an old server or tightening Microsoft 365 sign-in security?
Chrysis Networks prices one defined change as an Infrastructure Fix: $5,500 fixed, about 20 business days once access and a change window are approved. Sign-in security across a Microsoft 365 tenant and a listed set of laptops brought under Intune are separate Fixes, each quoted in writing after a license check. When the first written reply can't settle whether your tenant supports the job, a $350 walkthrough of up to five hours, written findings included, comes first and is credited to the project if you go ahead.
Does Microsoft 365 Business Premium include Conditional Access and Intune, or do we need more licenses?
Business Premium includes Conditional Access and Intune, though neither does much until someone sets it up. Risk-based sign-in policies need Entra ID P2, which Business Premium doesn't include, so Chrysis checks your licenses first and names that cost before quoting.
Could Conditional Access lock our staff out of Microsoft 365, and who keeps admin control?
A badly staged Conditional Access policy can lock people out, so Chrysis tests the emergency access accounts before any policy is enforced, then runs new policies in report-only mode and enforces them in stages. Your firm keeps global admin and the recovery path the whole way through, and the scoped access Chrysis works under comes out at handover. The handover runbook covers adding and removing users and getting back in after a lockout.
What happens if a server migration or cutover goes wrong?
Chrysis rehearses each migration in a test environment first, and the rollback path is written down and tested for real before the cutover, ready to use if the agreed checks fail during the change window. Rehearsal and a tested rollback lower the risk of a cutover without removing it, which is why nothing moves until the dependencies are mapped and the checks are agreed in writing.
Can Chrysis replace our MSP or provide 24/7 IT support for a 60-person engineering firm?
The Infrastructure Fix is one defined change with an end date, handed over with notes your own team or IT provider can work from, and Chrysis works alongside an existing provider rather than replacing one. Round-the-clock monitoring and compliance certification aren't part of the work.
What if the infrastructure work doesn't pass the checks we agreed?
Any Chrysis Infrastructure Fix that fails its agreed acceptance test gets one free in-scope fix of up to 3 hours and a retest. After a second failure, you choose 10% of the fee back as a partial refund or credit, up to $550.
How does an architecture firm remove a former employee's file server access and stop it happening again?
An architecture firm closes a leaver's file server access by inventorying every account and share permission, disabling what belongs to people who have left and writing down each change, then turning leaving into a tested procedure instead of something somebody remembers. Chrysis does both as one Infrastructure Fix, quoted in writing: the account and permission cleanup, plus a joiner and leaver procedure tested on a test user, while the firm keeps the top-level admin account and the recovery path. Recurring onboarding and offboarding across several systems is a separate workflow job, built under Microsoft 365 workflows or custom automation.
How do we migrate an engineering firm's old file server without losing access to drawings, and what's the rollback?
An engineering firm's old file server moves safely when everything that depends on it, including drawing folders, mapped drives and links from the project system, is inventoried and the move is rehearsed in a test environment before the real cutover. Chrysis writes the rollback path down and tests it for real before the change window, and agrees in writing the checks that prove staff can still open their drawings afterward. Rehearsal and a tested rollback lower the risk of a cutover without removing it, and the firm keeps admin and the recovery path throughout.
What's the system nobody wants to touch?
The Infrastructure Fix is the usual way in: one defined change, like retiring a host that's out of support or rolling out Conditional Access across a Microsoft 365 tenant, for $5,500 fixed and about 20 business days once access and a change window are approved. A failed acceptance test gets one free fix of up to 3 hours and a retest, then up to $550 back as a refund or credit. Tell us what the system runs and what has to keep working while it changes, and the first reply will say whether it's a job for us and what the first safe step would be.
Microsoft Partner · Pax8 Partner · VMware VCP-DCV behind the work
Related reading
- Microsoft 365 Workflows for CPA, Law and Engineering Firms
- Website Build for Contractors, Architects and Small Firms
- Engineering and architecture firms
- Law firms
- Dental offices
- The fine print on IT and AI changes
- GitHub Actions Lockfiles: What They Fix and What They Don't
- ECS LiveTaskCount vs RunningTaskCount for Scale-In Alarms
- Office 2021 Support Ended Oct 13, 2026: What to Check Now
- EWS allow-lists start October 10: six Azure, Entra and Microsoft 365 changes to act on (Sept 9 to Oct 9, 2026)
- Deleting a leaver's Microsoft 365 account at a CPA or law firm