A two-part approach
Cerium Networks worked with the university’s IT team to identify stakeholders, understand the current environment, assess potential challenges, and ensure alignment with organizational priorities. The team opted for a two-phased approach, with special considerations for maintaining data integrity during the migration process to help prevent loss, corruption, and unauthorized access to critical email, calendar, and contact data.
Cerium also provided detailed project timelines for both phases, complete with milestones, deadlines, and downtime windows coordinated with other ongoing projects to minimize user disruptions.
Phase 1: Migrating to Exchange Online
Cerium began Phase 1 by thoroughly assessing the university's existing infrastructure, email system, and security protocols. They introduced Exchange Server 2019 to create an isolated environment in which to test configurations, validate settings, and troubleshoot without affecting the existing production environment. The new server acted as a bridge between Exchange 2013—the on-premises environment—and Exchange Online, ensuring a smooth transition without disrupting user access.
The mailbox migration began with a 50-user pilot to test the new system's performance, functionality, and security. Cerium then collected feedback from the participants and evaluated the results of the pilot deployment so they could fine-tune processes and configurations before proceeding with the full-scale launch.
After thorough testing and approval, the remaining mailboxes were migrated in batches to streamline the process. Then, the university’s legacy public folders were migrated to modern public folders. Once all mailboxes, services, and data were successfully migrated to Exchange Online, the legacy on-premises Exchange 2013 server was decommissioned.
Phase 2: Implementing Microsoft Entra MFA
Phase 2 began with a deep dive into the university’s MFA goals and expected impact. Cerium conducted an MFA-readiness assessment to identify gaps and potential risks to the deployment. Because their faculty, staff, and students are the first line of defense against cyberthreats, Heritage University knew it was critical to be proactive and transparent about the planned changes and MFA’s potential impacts on the user experience.
That’s why they developed an adoption plan with communication and resources to prepare people for the change and help them understand the benefits of MFA. Promoting the change made it clear what they needed to do and, more importantly, why they needed to do it.
“Having a well-defined adoption plan is essential for the successful deployment of multifactor authentication. It ensures that end users are informed, supported, and comprehend the benefits of the new security measures. This leads to a smoother transition, higher acceptance rates, and fosters engagement, thereby minimizing resistance,” said Brown.
The pilot deployment of Microsoft Entra MFA included people from across the university who required different security access levels, so the team could test different MFA scenarios to optimize the deployment process. Once the pilot phase ended, MFA was rolled out to the remaining users in batches to reduce the risk of system disruptions or technical issues.
With a batch deployment, Heritage University could adjust the pace of implementation based on their capacity and priorities. The deployment included implementing Azure Active Directory licenses, applying and testing Conditional Access policies, and configuring MFA access methods for the Microsoft Authenticator App, SMS, and phone calls.
Heritage University monitored the rollout to measure its impact on security and productivity and ensure that the conditional access policies they had defined were working. They tracked security metrics for failed login attempts, blocked credential phishing, and denied privilege escalations. They also gathered feedback and examined help desk tickets to determine whether people were having difficulties with the MFA enrollment processor or taking longer to log in to access critical resources.
“With support from Cerium's engineers, who have significant knowledge of Microsoft best practices, Cerium provided insights into using reporting and monitoring tools within Microsoft 365,” Brown said. “This support allowed Heritage University to effectively track security metrics and ensure their policies were functioning as intended.”