IT Support & Microsoft Consulting in Sheffield

Companies working with the AMRC and Nuclear AMRC operate in a collaborative environment: joint projects with universities, shared research data, consortium partners and prime contractors all exchanging technical material. That collaboration is the point, but it makes uncontrolled data sharing the default risk.

We build external collaboration properly — Entra ID External Identities for named partners, project-scoped Teams and SharePoint sites with expiry dates, and sensitivity labels applied to drawings and test data so encryption follows the file out of the tenant. Where a prime contractor imposes handling requirements on their technical data, we translate those requirements into Microsoft Purview labels and policies rather than a document nobody reads. Project archives are retained on a defined schedule, which matters when a component design has a thirty-year service life behind it.

Aerospace and defence work brings AS9100 quality management, export control considerations, and customer-driven cyber requirements that increasingly extend beyond Cyber Essentials Plus into ISO 27001 and, for some MOD-linked work, the Defence Cyber Protection Partnership assessment. Sheffield suppliers regularly tell us the certificate itself is not the hard part; producing the evidence, repeatedly, for each customer audit is.

Our approach is to make the platform generate the evidence. Intune compliance policies report encryption, patch level and antivirus state per device. Conditional access shows who can reach what, from where, and on which device. Microsoft Defender and Sentinel provide the incident detection and log retention auditors ask about. Access reviews document that privileged accounts are checked. When the audit arrives, the answer is a report exported from the tenant rather than a fortnight of preparation.

A precision engineering business runs heavy CAD and CAM workstations, large file sets, licence servers that cannot go offline, and machine programmers who need predictable performance. Standard cloud-first advice fails here if it ignores the data gravity of a 4GB assembly file.

We usually land on a hybrid design: OneDrive and SharePoint for documents, collaboration and quality records, with engineering data kept on fast local storage that is synchronised and backed up into Azure. Where remote or multi-site access to CAD is needed, Azure Virtual Desktop with GPU-backed session hosts avoids dragging model files across a VPN. Licence servers and legacy quality systems get either an Azure home or a properly monitored, backed-up on-premises host — not a tower PC under a desk in the drawing office, which is what we find more often than not.

The shop floor is where most manufacturing IT security programmes quietly fail. Shared terminals next to machining centres, quality inspection PCs, panel PCs embedded in production equipment and rugged tablets used for job cards are all shared between operators across shifts. They are frequently running an old Windows build because the machine vendor validated it, and they frequently have a generic logon everyone knows.

We treat that estate separately from the office fleet. Shared devices are enrolled in Intune with shared-device configuration and kiosk profiles so an operator gets only the applications the role needs. Where a machine controller genuinely cannot be updated, it is isolated on its own network segment with tightly restricted flows rather than left on the flat factory network — segmenting OT from IT is the single most effective control we deploy in Sheffield plants. Removable media is controlled, because USB sticks carrying CNC programmes between offices and machines remain a real infection route. Wi-Fi in a steel-framed building gets surveyed properly instead of assumed.

When a Sheffield manufacturer loses its ERP, MRP or quality system, production stops and delivery schedules slip immediately — with penalty clauses attached in aerospace and automotive supply chains. Yet the recovery plan is often a backup appliance in the same building as the servers it protects.

We use Azure as the second site: Site Recovery replication for critical virtual machines, immutable backup copies that ransomware cannot delete, and documented recovery objectives agreed per system with production management. Recovery is then actually tested — failing a replica over in a controlled window and confirming the shop floor can log in and book work — because an untested plan is an assumption. For firms wanting to reduce on-premises footprint entirely, a staged Azure migration moves the systems that are ready and leaves genuinely machine-bound workloads where they belong.

Our engineers are based in the region, so when a problem needs someone standing in front of a panel PC on the shop floor, that is a short drive rather than a next-business-day promise.