Microsoft’s technology stack is easiest to understand as a set of connected control planes. Identity influences access to almost everything. Microsoft 365 carries collaboration and communication. Azure provides infrastructure and platform services. Defender spans several security domains. Windows Server and Hyper-V remain relevant to hybrid estates, while Azure Virtual Desktop combines cloud infrastructure with identity, profile and endpoint decisions.

This pillar is a practical map of that ecosystem. It is not intended to catalogue every Microsoft product. The focus is on the parts that change architecture and operations: identity, cloud, workplace, security, server infrastructure and hybrid management.

Last reviewed: 4 September 2026. Supporting guides are refreshed as the Microsoft technology landscape evolves.

The Microsoft stack in five layers

Identity is the foundation

For many organisations, Entra ID is now more critical than any individual server. If users cannot authenticate, devices cannot obtain tokens or administrators cannot recover privileged access, multiple otherwise healthy services become unavailable at once. That makes identity an infrastructure dependency, not merely an account directory.

The important design questions are therefore broader than whether MFA is enabled. Authentication methods, phishing resistance, Conditional Access, emergency access, privileged roles, device trust, guest identities, service principals and recovery procedures all need to work together. A secure tenant that cannot be recovered is not resilient; a recoverable tenant with weak identity controls is not secure.

Azure: infrastructure plus control plane

Azure is often introduced as somewhere to put virtual machines. That is only one part of its value. It can provide networking, security controls, monitoring, policy, secrets, analytics, automation and disaster-recovery capabilities to workloads that are partly or entirely outside Azure.

The architectural question is therefore not simply “should this server move to Azure?” It is “which Azure capabilities improve the service, and what new dependencies do they create?” A workload may remain local while Azure Monitor, Defender, Entra ID or recovery services become part of its operating model. Equally, a workload may move into Azure but still depend on local identity, DNS, legacy applications or network paths.

Good Azure design starts with boring fundamentals: subscriptions and management groups that can be governed, networks that can be understood, access that is constrained, logging that is retained, cost ownership that is visible and recovery that is designed before production data arrives.

Microsoft 365 is an operational platform, not just Office

Microsoft 365 can look deceptively simple because the user experience is familiar. Behind Outlook, Teams, SharePoint and OneDrive sits a substantial identity, security, compliance and data-governance platform. Configuration decisions can affect external sharing, retention, discovery, device access, application permissions and the ability to investigate an incident.

That makes tenant governance important even for smaller organisations. The goal is not to enable every security feature. It is to establish a known baseline, understand exceptions, reduce standing privilege, control risky sharing and make sure administrators know where critical data and settings live.

Windows Server and Hyper-V still have a role

The arrival of public cloud did not make Windows Server disappear. File services, line-of-business applications, Active Directory dependencies, specialist software and local infrastructure requirements still create a substantial Windows Server estate in many organisations.

Hyper-V therefore remains relevant too. Its strongest case is usually where Windows Server licensing, Microsoft tooling and operational familiarity already exist. That does not make it the automatic answer to every virtualisation requirement; Proxmox, VMware alternatives, HCI platforms and cloud-native services may fit other estates better. The useful comparison is operating model and total architecture, not a hypervisor feature checklist.

Azure Virtual Desktop: more than a VM

AVD combines Azure compute, networking, Entra identity, session-host design, profile management, application delivery and endpoint access. Most of its difficult decisions therefore happen around the virtual machine rather than inside it.

Capacity, profile behaviour, FSLogix storage, image management, application packaging, user locality, monitoring and failure domains determine whether AVD feels like a responsive service or an expensive collection of desktops. I treat it as a service architecture rather than a desktop replacement project.

More relevant guides will appear here as this part of the site grows.

Defender and the Microsoft security ecosystem

Microsoft’s security products can gain useful context precisely because they sit close to identity, endpoints, email and cloud resources. That integration can be powerful, but it also creates configuration sprawl. Licensing alone does not create a security operating model.

The important questions are whether alerts are triaged, whether identity and endpoint signals are correlated, whether administrators know which product owns which control, whether exclusions are governed and whether incidents can be investigated without discovering that the necessary telemetry was never enabled or retained.

Where I would avoid becoming Microsoft-only

Platform integration is valuable, but architectural independence still matters. Backups should survive compromise of the primary identity plane. Monitoring should make critical dependencies visible rather than assuming the Microsoft control plane is always available. Exportability matters for business data. Network and storage design should remain understandable outside a single portal.

The objective is not to avoid Microsoft lock-in at all costs; that can create more complexity than it removes. It is to be deliberate about where the organisation accepts platform dependency and where an independent recovery, security or data path is worth maintaining.

Microsoft architecture checklist

• Can privileged access be recovered if normal Entra authentication is unavailable?
• Are Conditional Access and authentication methods documented rather than accumulated?
• Does Azure have a clear subscription, network, logging and cost-governance model?
• Can Microsoft 365 data and configuration be recovered to the level the business expects?
• Are Windows Server and Hyper-V workloads there because they still fit, not simply because they have always been there?
• Does AVD have explicit capacity, profile and image-management ownership?
• Are Defender alerts part of an operational response process rather than just another dashboard?

Explore the wider architecture

Microsoft intersects heavily with both cloud & hybrid architecture and enterprise infrastructure. The broader Technology pillar connects these Microsoft decisions to the rest of the site.