Most firms don't need a full-time CIO. They need one occasionally.
North Rain Technologies builds and secures the Microsoft 365 environments professional firms run on — architecture, identity, migration and AI adoption for organizations that have outgrown improvised IT but have no reason to staff a department for it.
Where we're brought in
Five things account for nearly all of it. Open any one for the detail.
-
Most firms arrive here the same way: OneDrive folder sharing worked fine at four people and quietly stopped working at twelve. Nobody is sure who can see what, and finding last year's file takes three guesses.
The work is a proper site architecture, a permission model that reflects how the firm is actually structured, secure guest access for clients who need visibility, and a migration that preserves metadata rather than flattening everything into a new folder tree. Staff keep working out of Windows Explorer and mostly don't notice the change.
-
Conditional access policies, multi-factor rollout that staff will tolerate, device compliance, and governance over who outside the organization can reach what.
There is also usually money on the table. Firms routinely pay for standalone antivirus and backup tools that duplicate what their Microsoft 365 licensing already includes. Part of this work is finding that overlap and saying honestly whether consolidating is worth it, which sometimes it isn't.
-
AI rollouts rarely fail at the AI. They fail at the data layer, because an assistant inherits its user's permissions and will cheerfully surface the payroll spreadsheet somebody dropped in a shared folder in 2019.
Getting the permission model right before you point an assistant at your files isn't preparation for the project. It is most of the project. The rest is pilot scoping, rollout, and training people on what the thing is actually good at.
-
Vendor selection, roadmap, budget sanity checks, and reading the managed-services contract properly before anyone signs it.
This is the work most firms can't justify hiring for. You need an experienced technologist perhaps four times a year, at exactly the moments when a bad decision gets expensive, and a full-time salary makes no sense for that.
-
Performance auditing, rebuilds on modern edge infrastructure, analytics that answer a question somebody actually asked, and accessibility work that keeps you on the right side of it.
Security and infrastructure,
at whatever size you are
The same discipline applies to a ten-person office and a multi-site network. What changes is how much of it there is. Pick a scale.
Ten to thirty people, one office or none at all, everything riding on Microsoft 365 and a consumer-grade router nobody has logged into since it was installed.
- Business-grade firewall and segregated guest Wi-Fi
- MFA and conditional access across every account
- Managed endpoints with disk encryption and patching
- Backup that has actually been restored from, at least once
- A written record of what exists and who can reach it
Thirty to two hundred people, more than one location, a server or two that still matter, and a compliance obligation somebody has started asking about.
- VLAN segmentation and policy-driven routing between sites
- Site-to-site VPN or SD-WAN with real failover
- Entra ID hybrid join, SSO, and privileged access tiers
- Centralized logging with alerting somebody reads
- Documented incident response, tested rather than filed
- Vulnerability scanning on a schedule, with remediation tracked
Multi-site, multi-tenant, regulated, or all three. Change control matters more than speed and an outage has a dollar figure attached to it.
- Redundant core with no single point of failure
- Zero-trust access model and microsegmentation
- SIEM pipeline, retention policy, and defined escalation paths
- Conditional access tied to device posture and risk signals
- DR runbooks with tested recovery objectives, not aspirational ones
- Audit evidence produced as a by-product of operating, not a scramble
What we work in
Platforms and products in regular use. Not a list of everything we've touched once.
Microsoft 365 & Azure
- SharePoint Online
- Exchange Online
- Teams
- OneDrive
- Entra ID
- Intune
- Purview
- Defender
- Power Automate
- Copilot
- Azure AD Connect
- Azure Virtual Desktop
Security
- Conditional Access
- MFA
- Zero trust
- SIEM
- Endpoint detection
- Email security
- Vulnerability management
- Backup & DR
- Penetration test remediation
- Security awareness training
Networking
- Firewalls
- VLAN design
- SD-WAN
- Site-to-site VPN
- Enterprise Wi-Fi
- Layer 3 switching
- BGP & OSPF
- QoS
- Network monitoring
- Structured cabling
Infrastructure & cloud
- Virtualization
- Windows Server
- Linux
- Active Directory
- Storage & SAN
- Cloudflare
- Edge compute
- DNS architecture
Business systems
- Document management
- Identity governance
- Workflow automation
- Monday.com
- Planner
- Migration tooling
- Licensing optimization
Work that runs itself
Four jobs every professional firm does by hand. Here is what each looks like once it's wired across the SaaS layer — and the prompt that does the thinking part.
What a project actually looks like
A tenant migration for a thirty-person firm, mapped across fifteen working days. Hover a phase for what happens in it.
Phases overlap because migration prep starts while the architecture is still being built. Most of weeks two and three run in the background without touching your staff.
When hiring is cheaper, we'll tell you
An in-house hire beats us on hourly rate the moment you can keep them busy. The question is whether you can. Move the slider to your own number.
A firm of 10–30 people with no major project running typically lands between 100 and 300.
- Our rate
- $150/hr, billed in 30-minute increments, no retainer
- In-house base
- $102,000 — mid-career IT manager, Vancouver
- Employer burden
- +25% for CPP, EI, employer health tax, benefits, equipment and training
- Crossover
- 850 hours a year
Salary figure from PayScale, Vancouver BC. Statutory employer contributions in Canada run roughly 5.8% before benefits; the 25% here adds vacation, health coverage, hardware and training. Your numbers will differ — these are a starting point, not a quote.
A recent engagement
A fully remote accounting practice, multiple staff, a growing client base, and every file living in personal OneDrive shares.
- Files migrated
- 207,000
- Data moved
- 135 GB
- Start to handover
- Under 3 weeks
The firm had grown past what folder sharing can carry. Staff could reach things they shouldn't, clients had no clean way to exchange documents, and there was no structure that would hold another year of growth.
We built a SharePoint environment around how the practice actually works — a client library with per-client folders and inheritance broken where it needed to be, separate internal libraries for admin and AR/AP, and a permission model mapped to roles rather than individuals. Guest access was configured so clients authenticate with their own Microsoft accounts and see only their own material.
Then the migration: validating paths and naming conventions, mapping libraries into batches, identifying the files that were going to break before they broke, and moving everything with metadata intact. Conditional access and MFA went in behind it. Staff kept working through Explorer the entire time.
The firm finished with an architecture summary, a permissions map and a migration record, all of it theirs to keep and hand to whoever comes next.
How we work
No retainer
Billed hourly with a thirty-minute minimum per incident. You pay for work, not for availability. If you don't need us for two months, that costs nothing.
Senior lead, start to finish
The person who scopes your project runs it. Nothing gets scoped by one team and quietly handed to another once the contract is signed.
Specialists on demand
A deep bench of vetted specialists we bring in by name when a project needs one, so you get the right expertise without carrying it on a payroll between engagements.
Documentation at handover
Architecture summary, permission map, migration record. Written so your next person can read it. Being hard to replace is not a business model we're interested in.
Response that means something
Same business day for anything genuinely critical, next business day for everything else. Stated plainly so you can hold us to it.
Scoped before it starts
A written estimate with hours against each workstream before any work begins. Scope changes get re-quoted rather than absorbed quietly into the invoice.
Tell us what's broken,
or what you're planning.
Either is a good reason to get in touch. A short conversation is usually enough to tell whether we're the right fit, and we'll say so if we're not.
hello@northrain.ca