AIG Group: Building a Cloud-First IT Foundation
When it moved its managed IT services to us, we helped it reduce its reliance on legacy servers, consolidate separate security products and make fuller use of its existing Microsoft 365 Business Premium licences.
From connectivity to a wider IT partnership
AIG Group had worked with Global 4 for several years on telephony and internet connectivity. When the group began considering a move of its managed IT services to us, it saw a chance to simplify the technology behind the business and establish a more consistent, cloud-first approach across the group.
The challenge
AIG had already made progress towards the cloud. It had begun adopting cloud-based technology for its principal line-of-business application and had started modernising its Microsoft environment and IT management services.
Legacy servers still formed part of a hybrid infrastructure, handling functions including identity and security management. Some significant, complex projects needed to remove those dependencies had not yet been tackled. Local and network file stores, along with separate security products, added further points of administration.
The next step was to build on that progress while reducing the infrastructure and management complexity that remained.
Our approach
Central to this was making fuller use of the Microsoft 365 suite. Alongside the familiar productivity apps, the suite includes:
• Microsoft Intune for device and application management
• Microsoft Entra for identity and access controls
• Microsoft Defender for Business for endpoint protection
• Microsoft Defender for Office 365 for email and collaboration protection
Holding the licences was the starting point. The value came from configuring and managing these services as one joined-up operating model.
Modern device management with Intune
We made Microsoft Intune the core of AIG’s endpoint management. Enrolling devices into Intune brought their administration into a central cloud service and helped remove dependencies on legacy servers. Policies and administration can now follow supported devices wherever they connect to the internet, rather than relying on infrastructure in a particular location.
Intune can distribute device configuration, deploy applications, manage supported operating system updates and apply endpoint security settings. It can also check devices against compliance requirements, such as minimum operating system versions or encryption, and highlight devices that need attention. The result is a repeatable management framework rather than a collection of individually configured computers.
The most tangible change for AIG was simpler, significantly faster device enrolment for new starters and when reallocating existing equipment. Central management gives a more consistent basis for preparing devices and maintaining their settings after deployment, with less repeated manual configuration. Intune also supports lifecycle actions such as retiring devices or removing organisational data where appropriate.
Identity and access with Conditional Access
As services move to the cloud, protection can’t depend solely on whether someone is connected to an office network. We used Microsoft Entra Conditional Access to strengthen how AIG’s people access business information.
Conditional Access ta
As services move to the cloud, protection can’t depend solely on whether someone is connected to an office network. We used Microsoft Entra Conditional Access to strengthen how AIG’s people access business information.
Conditional Access takes account of the user, the application being accessed, device information and location before granting access to protected resources, applying the requirements the organisation has defined. This extends security beyond the traditional network boundary.
With the Entra ID P1 capabilities in Business Premium, policies can require multifactor authentication, block legacy authentication methods or require a device to be marked compliant before it reaches selected resources. Intune and Conditional Access work together here: Intune assesses whether a device meets the configured standards, and Conditional Access uses that status to enforce access requirements.
kes account of the user, the application being accessed, device information and location before granting access to protected resources, applying the requirements the organisation has defined. This extends security beyond the traditional network boundary.
With the Entra ID P1 capabilities in Business Premium, policies can require multifactor authentication, block legacy authentication methods or require a device to be marked compliant before it reaches selected resources. Intune and Conditional Access work together here: Intune assesses whether a device meets the configured standards, and Conditional Access uses that status to enforce access requirements.
Files, print and applications in the cloud
Global 4 helped progress AIG’s migration to Microsoft SharePoint, moving files away from local and network stores towards a consistent approach to cloud storage. SharePoint provides shared document libraries, permissions-based access, version history and collaboration tools without relying on traditional file servers.
We also moved print management to the cloud and migrated selected remaining line-of-business applications to Microsoft Azure. This addressed services that still depended on server infrastructure, rather than assuming every application could simply be replaced by Microsoft 365. Together, these changes enabled server decommissioning and brought more of AIG’s environment into a centrally managed cloud model.
Consolidated endpoint and email security
We replaced AIG’s separate third-party antivirus with Microsoft Defender endpoint protection, bringing endpoint security into one centrally controlled cloud service. Business Premium includes Microsoft Defender for Business, built on Microsoft Defender for Endpoint technology. Its capabilities go beyond traditional antivirus to include endpoint detection and response, attack surface reduction, vulnerability management and automated investigation and remediation.
For email, we used Microsoft Defender for Office 365 to strengthen protection against harmful content, impersonation and spoofing, removing the need for a separate third-party email security product. The Plan 1 service in Business Premium includes Safe Links, which checks links for malicious destinations, including at the moment they’re clicked, and Safe Attachments, which analyses attachments in an isolated environment for harmful behaviour. These sit alongside anti-phishing and underlying mail-filtering controls.
Phishing simulation and cyber awareness training
Global 4’s managed service also includes phishing simulation and cyber awareness training. It sits alongside the technical controls as part of AIG’s overall cyber management strategy, rather than as a separate, one-off exercise.
Controlled phishing simulations give people a safe way to practise recognising suspicious messages. Awareness training helps them understand why it matters to check unexpected requests, protect account credentials and report concerns through the right channels.
No technical control can stop every deceptive message, and training doesn’t remove the need for those controls. Together with the email, endpoint and identity protections Global 4 manages, they form a layered approach to reducing cyber risk.
We made Microsoft Intune the core of AIG’s endpoint management. Enrolling devices into Intune brought their administration into a central cloud service and helped remove dependencies on legacy servers. Policies and administration can now follow supported devices wherever they connect to the internet, rather than relying on infrastructure in a particular location.
Intune can distribute device configuration, deploy applications, manage supported operating system updates and apply endpoint security settings. It can also check devices against compliance requirements, such as minimum operating system versions or encryption, and highlight devices that need attention. The result is a repeatable management framework rather than a collection of individually configured computers.
The most tangible change for AIG was simpler, significantly faster device enrolment for new starters and when reallocating existing equipment. Central management gives a more consistent basis for preparing devices and maintaining their settings after deployment, with less repeated manual configuration. Intune also supports lifecycle actions such as retiring devices or removing organisational data where appropriate.
The outcome
The project brought together changes that might otherwise have stayed as separate initiatives: device management, identity and access, file storage, application hosting, endpoint and email protection, and user awareness. For AIG, the combined result is:
- A cloud-first approach to IT across the group
- Less reliance on legacy servers
- Fewer separate products to administer, with reduced costs from replacing standalone antivirus and email security
- Faster device enrolment for new starters and reallocated equipment
- Better use of its existing Microsoft investment
- An added layer of protection for business information through Conditional Access
- Training and simulation that support the people using these systems every day
An ongoing partnership
Global 4 now takes responsibility for the day-to-day management of AIG’s IT services, covering service desk support, security and cyber operations management, and phishing simulation and awareness training. AIG has a partner supporting both its environment and the people who use it, rather than a project team whose involvement ends at migration.
We also continue to advise on AIG’s IT direction, using our experience of supporting the environment to inform future technology decisions. What started as telephony and connectivity has grown into a broader partnership covering IT operations, cloud modernisation and cyber management.
"We'd worked with Global 4 on our phones and connectivity for years, so moving our IT over felt like a natural next step. They took the time to understand what we already had and built on it rather than starting again. Setting up laptops for new starters is much quicker now, and we're finally getting proper value from the Microsoft licences we were already paying for. What I value most is that they didn't disappear once the project was done. They look after our IT day to day and give us straight advice on where to take our technology next. Highly recommend."
Greg Young, CEO & Founder, AIG Group