North Rain designs, builds and secures the systems professional firms run on — architecture, identity, networks, migration and AI adoption for organizations that have outgrown improvised IT but have no reason to staff a department for it.
What we do
Five things account for nearly all of it. Open any one for the detail — the work, what you end up holding, and roughly what it costs in hours.
Most firms arrive here the same way: OneDrive folder sharing worked fine at four people and quietly stopped working at twelve. Nobody is sure who can see what, and finding last year’s file takes three guesses.
The work is a proper site architecture, a permission model that reflects how the firm is actually structured, secure guest access for clients who need visibility, and a migration that preserves metadata rather than flattening everything into a new folder tree.
Conditional access policies, multi-factor rollout that staff will tolerate, device compliance, and governance over who outside the organization can reach what.
There is also usually money on the table. Firms routinely pay for standalone antivirus and backup tools that duplicate what their Microsoft 365 licensing already includes. Part of this work is finding that overlap and saying honestly whether consolidating is worth it, which sometimes it isn’t.
Most AI projects fail on scope, not capability. The useful version starts with the handful of tasks that happen every week, costs nothing to get wrong, and can be checked by the person who already does them.
We wire the model to your own data with boundaries that hold, build a prompt library the team actually reuses, and put a human in front of anything that leaves the building.
Firms between twenty and five hundred people usually need executive IT judgement about once a month and a full-time executive never. This is the arrangement for that.
A roadmap that survives a budget cycle, vendor contracts read before they renew, a risk register that someone actually maintains, and a quarterly pack written for a board rather than for engineers.
Performance auditing, rebuilds on modern edge infrastructure, analytics that answer a question somebody actually asked, and accessibility work that keeps you on the right side of it.
The brief is usually the same: the site is slow, nobody can edit it, and the analytics say something nobody believes.
The case
Fifteen hours on a single clock, scored. Scrub to any hour — or switch sides mid-scene. The time of day never changes, only whose day it is.
Oversight
Tenants, endpoints, identity, licences, backups and spend normally sit in six consoles and three inboxes, and nobody reads any of them. We consolidate the lot into something you can take in at a glance. Clear the weather and see for yourself.
Drag to clear
Security & infrastructure
The same discipline applies to a ten-person office and a multi-site network. What changes is how much of it there is. Pick a scale.
Ten to thirty people, one office or none at all, everything riding on Microsoft 365 and a consumer-grade router nobody has logged into since it was installed.
Thirty to two hundred people, more than one location, a server or two that still matter, and a compliance obligation somebody has started asking about.
Multi-site, multi-tenant, regulated, or all three. Change control matters more than speed and an outage has a dollar figure attached to it.
A thousand seats across a dozen sites, a real security function, and auditors who want evidence rather than assurances. At this size nothing is done by hand twice, and every change has a paper trail.
Ten thousand seats and up, across regions and regulatory regimes. The architecture question stops being what to build and becomes what to standardise, what to federate, and what to let each region own.
Flat networks are the reason one laptop becomes everybody’s problem. Segments drawn against how the business actually works, routed on purpose, with the rules written down somewhere other than the firewall.
Nobody holds privilege they aren’t using. Elevation is requested, time-boxed and recorded — so the account that eventually gets phished can’t do much with the afternoon.
Rings rather than a single Tuesday, a rollback that has been used at least once, and restores tested on a schedule instead of discovered during an incident.
What exists, who can reach it, and when it last changed — maintained as part of running the place. The audit pack falls out of that rather than taking a fortnight of archaeology.
The stack
Platforms and disciplines in regular use — not a list of everything anyone here has touched once. Where a product is interchangeable we’ll say so; where it isn’t, we’ll tell you why.
Tenant architecture, identity, data governance and the automation layer on top — cloud-native, hybrid, or mid-migration.
Hosted models, local ones, and the plumbing between them and your data — scoped so the useful part ships and the sensitive part stays where it is.
The estate underneath: domains, mailboxes, file services and the long tail of things that only break at month end.
Clusters sized for the load they actually carry, with failure domains somebody has drawn on a page.
Single office to routed multi-site, designed so a branch outage stays a branch outage.
Controls that hold under audit, and the investigation work for when something got through anyway.
The layer that keeps all of the above visible, licensed and paid for — and the systems the business runs on.
Held across the team, kept current, and renewed where the vendor requires it. Where a certification has lapsed because the product has, we say so rather than leaving it on a list.
Automation
Four jobs every professional firm does by hand. Here is what each looks like once it's wired across the SaaS layer — and the prompt that does the thinking part.
What it gives back
Onboarding, offboarding, licence true-ups, access reviews, patch verification, backup checks, the monthly report somebody rebuilds by hand. None of it is hard. All of it is constant. Here is what it costs, and what it costs once it runs itself.
How a project runs
A tenant migration for a thirty-person firm, mapped across fifteen working days. Hover a phase for what happens in it.
Phases overlap because migration prep starts while the architecture is still being built. Most of weeks two and three run in the background without touching your staff.
The money
An employee beats us on hourly rate the moment you can keep them busy. The question is whether you can — and which employee you’d actually need to do this work. Pick a scope, then pick who you’d otherwise be hiring.
Or set your own number below.
A firm of 10–30 people with no major project running typically lands between 100 and 300.
Base salaries: Salary.com benchmarks for Vancouver, BC, September 2026 — enterprise infrastructure manager median C$175,323, chief technology officer median C$360,056; IT manager from PayScale. Statutory employer contributions in Canada run roughly 5.8% before benefits; the 25% here adds vacation, health coverage, hardware and training. Your numbers will differ — these are a starting point, not a quote.
Recent work
A growing client base, staff spread across the country, and every working file living in somebody’s personal OneDrive share.
The firm had grown past what folder sharing can carry. Staff could reach things they shouldn't, clients had no clean way to exchange documents, and there was no structure that would hold another year of growth.
We built a SharePoint environment around how the practice actually works — a client library with per-client folders and inheritance broken where it needed to be, separate internal libraries for admin and AR/AP, and a permission model mapped to roles rather than individuals. Guest access was configured so clients authenticate with their own Microsoft accounts and see only their own material.
Then the migration: validating paths and naming conventions, mapping libraries into batches, identifying the files that were going to break before they broke, and moving everything with metadata intact. Conditional access and MFA went in behind it. Staff kept working through Explorer the entire time.
The firm finished with an architecture summary, a permissions map and a migration record, all of it theirs to keep and hand to whoever comes next.
Terms
Billed hourly with a thirty-minute minimum per incident. You pay for work, not for availability. If you don't need us for two months, that costs nothing.
The person who scopes your project runs it. Nothing gets scoped by one team and quietly handed to another once the contract is signed.
A deep bench of vetted specialists we bring in by name when a project needs one, so you get the right expertise without carrying it on a payroll between engagements.
Architecture summary, permission map, migration record. Written so your next person can read it. Being hard to replace is not a business model we're interested in.
Same business day for anything genuinely critical, next business day for everything else. Stated plainly so you can hold us to it.
A written estimate with hours against each workstream before any work begins. Scope changes get re-quoted rather than absorbed quietly into the invoice.
A second office, a merger to absorb, a certification you can’t fail, a year where support costs stop climbing — start with the business outcome and we’ll work backwards to the systems. If something is simply broken, that’s a good reason to call too. A short conversation is usually enough to tell whether we’re the right fit, and we’ll say so if we’re not.