Managed Microsoft 365 security and AI readiness for a private preparatory college

Situation

A private preparatory college for international students works with Microsoft 365, Entra ID and Intune, and personal devices (BYOD) are part of everyday use. The college wanted its tenant hardened, then operated securely on an ongoing basis, and its data prepared for AI assistants such as Microsoft 365 Copilot and Claude.

Approach

Phase 1, July to December 2025: hardening.

• Identity and tenant design in Microsoft Entra ID, Conditional Access and MFA, and endpoint management with Intune.
• Protection of identities, endpoints and email, data classification and data loss prevention (DLP).
• An IT operations manual, change management to ITIL and migration of the infrastructure-as-code repositories to Azure DevOps.

Phase 2, since June 2026: managed operation. WCS runs and continues to harden Entra ID, Microsoft 365, Intune, Conditional Access, Defender and Global Secure Access. Incident response is part of the service, and management receives a monthly security report.

AI readiness. Sensitivity labels in Microsoft Purview classify the college’s data and form the basis for using Microsoft 365 Copilot and Claude. Intune was set up for BYOD and fine-tuned in operation.

Result

The college has a hardened Microsoft 365 tenant that WCS operates with documented processes for changes and incidents. Management receives a written report on the security status every month. Labelled data gives the college a basis for deciding which content AI assistants may work with. Students and staff can use personal devices under defined Intune rules.

The services behind this mandate are described on the pages Managed Security and AI Foundation.