Cloud Administration deep dive

The three cloud giants — and the team that makes them work for your business.

Microsoft, Google, and Amazon ship cloud platforms that work great for somebody — but rarely out-of-the-box for your business. The defaults are designed for the median customer; your business is not the median. Identity policy, license tier, retention rules, data residency, security baseline, conditional access, audit trail, cost controls — every one of these needs deliberate configuration. AMTech runs all three platforms on behalf of our clients, every day. We pick the right SKU, build the tenant to your industry's compliance baseline, and keep it tuned as the vendors push two-hundred-plus updates per year.

Microsoft 365 + Azure

Microsoft CSP

Exchange Online · SharePoint · OneDrive · Teams · Defender · Intune · Purview · Entra ID · Power Platform · Azure

Microsoft is the deepest stack of the three. The Microsoft 365 productivity suite alone spans Exchange Online, SharePoint, OneDrive, Teams, Defender, Intune, Purview, Entra ID, and Power Platform — twelve-plus services that interconnect through identity, conditional access, and shared compliance plumbing. Layer Azure on top for cloud infrastructure (virtual machines, App Service, SQL Database, Key Vault, Sentinel SIEM) and you are managing thirty distinct surfaces that all roll up into one tenant.

The complexity is real. The license SKU matrix alone — Business Basic / Standard / Premium for SMB, E1 / E3 / E5 for enterprise, plus a-la-carte add-ons like Defender for Endpoint Plan 2, Microsoft Sentinel, and Microsoft 365 Copilot — has forced many in-house teams to overpay just to avoid getting it wrong. Conditional access policies, retention labels, DLP rules, mailbox archive policy, MFA enforcement, Intune device compliance baselines, Defender ATP tuning, and audit-log retention each have their own configuration model.

What AMTech delivers

• Tenant build to a known-good baseline, hardened on day one

• Vertical-tuned policy libraries (HIPAA-aligned for healthcare, audit-grade for financial firms)

• Quarterly license right-sizing — we reclaim and downgrade unused seats

• Copilot rollout planning and Azure subscription governance with mandatory tagging and budget alerts

Google Workspace

Workspace Partner

Gmail · Drive · Docs · Sheets · Slides · Meet · Calendar · Vault · Voice · Admin Console

Google Workspace competes head-to-head with Microsoft 365 and wins on simplicity, real-time collaboration in Docs / Sheets / Slides, and the cleanest mobile experience. The trade-off is that the Workspace admin surface is shallower than Microsoft’s — which sounds easier, but means every configuration decision matters more because there are fewer levers to compensate.

The complexity hides in the policy details. SKU choice (Business Starter / Standard / Plus, Enterprise Standard / Plus) sets your retention, eDiscovery, and security feature ceiling for the entire org. Vault retention rules drive your records-retention compliance. Drive sharing controls determine whether "Anyone with the link" can leak data outside the company. Context-aware access, advanced phishing protection, third-party app whitelisting, and mobile device policy all need active tuning — Google’s defaults assume a different threat model than yours.

What AMTech delivers

• Workspace tenant built with vertical-tuned defaults

• Vault retention matched to your industry’s records-retention obligation

• Drive-sharing controls that close the "Anyone with the link" gap by default

• DMARC, DKIM, and SPF enforcement on outbound mail; quarterly security investigation review

Amazon Web Services

AWS Partner Network

EC2 · S3 · RDS · IAM · CloudWatch · CloudTrail · Backup · VPC · Route 53 · WAF · Cost Explorer

AWS has the largest service catalog in cloud — over two hundred services across compute, storage, networking, database, AI / ML, and developer tooling. Most SMB engagements use roughly twelve of them: EC2 (servers), S3 (storage), RDS (managed databases), IAM (identity), CloudWatch and CloudTrail (monitoring and audit), AWS Backup, VPC (networking), Route 53 (DNS), WAF (web filtering), and Cost Explorer.

The complexity is in the trapdoors. IAM policy design — the difference between "least privilege" and "the intern accidentally has admin" — is one mistake away. S3 bucket exposure is the single most common cause of public data leaks in the cloud industry; the wrong checkbox publishes your data to the internet. Reserved Instance and Savings Plan economics can cut compute spend by 30 to 70 percent if you commit correctly, or burn money if you don’t. CloudTrail audit retention, VPC peering versus Transit Gateway, security-group sprawl across accounts — every one is a trapdoor you only learn about by stepping into it.

What AMTech delivers

• Multi-account architecture (root → organization → workload accounts)

• IAM least-privilege baselines and S3 public-access scans every month

• Security-group reviews and CloudTrail audit-log retention configured to your compliance window

• Reserved Instance and Savings Plan analysis that often pays for the entire engagement

Volume discounts through channel partnerships

One reason the AMTech engagement pencils out for SMB clients comes down to math.

We license across our entire client base, so we hit higher-tier breakpoints than any single 25-to-250-user business would ever qualify for going direct — and we pass that discount through. On a 50-user Microsoft 365 E3 deployment, partner-tier pricing is typically 8 to 15 percent off list. That is two-hundred to five-hundred-plus dollars back to the client, every month, for the life of the contract. Combined with quarterly license right-sizing audits (we reclaim and downgrade unused seats), hardware procurement at near-cost through Insight, and consolidated billing through one vendor instead of seven, the channel-partner discount typically offsets thirty to sixty percent of the AMTech management fee. The math frequently means the AMTech engagement costs less than running the IT spend yourself with no help.

Microsoft CSP

M365 + Azure

Google

Workspace partner

Amazon

AWS Partner Network

Adobe

Solution Partner

Insight

Hardware channel

One invoice

Consolidated billing

8–15% off Microsoft list
10–20% off Adobe direct
Reserved Instance / Savings Plan analysis
Quarterly license audits
Hardware at near-cost