Case study
Great British Energy – Nuclear: A Greenfield, Zero Trust Microsoft 365 Tenant and Device Rollout
Konsolute led the digital transformation that moved Great British Energy – Nuclear from a shared central government environment to its own greenfield Microsoft 365 tenant. Zero Trust identity, device management and security were built in from day one, and staff received newly managed devices as part of the move.
Overview
Building a new organisation's digital workplace from the ground up
Great British Energy – Nuclear (GBE-N), formerly Great British Nuclear, is the government-owned organisation driving the delivery of new nuclear power in the UK, including the small modular reactor programme.
In its early life, GBE-N relied on a shared central government Microsoft 365 environment. As it grew into an independent organisation with its own responsibilities, it needed a digital workplace that it controlled, configured to its own security requirements.
Konsolute designed and delivered a greenfield Microsoft 365 tenant for GBE-N, built on Zero Trust and security principles from the outset. We migrated users and content from the central government environment and rolled out managed devices across the organisation. The tenant was designed to be Copilot-ready by construction.
The challenge
Independence, without compromising security
Operating in a shared central government tenant had limited GBE-N's ability to set its own policies, manage its own identities and shape its environment around its needs. Becoming independent meant building a new environment, not adapting someone else's.
As a nuclear-sector organisation handling sensitive information, GBE-N's security expectations were high. The new tenant had to verify every user and device explicitly, grant only the access people needed, and assume that threats could come from anywhere.
The move also had to happen without interrupting the organisation's work. Staff needed their email, files and collaboration tools to be available on day one in the new environment, on devices that met the same security standards.
GBE-N needed to:
- Move from a shared central government environment to its own Microsoft 365 tenant
- Build identity, access and device management on Zero Trust principles
- Migrate users, mailboxes and content with minimal disruption
- Roll out secure, managed devices to staff
- Create a foundation ready for future capabilities such as Microsoft 365 Copilot
- Nuclear
- Energy
- Government
- Microsoft 365 Consultancy
- Cloud Security & Identity
- Zero Trust Security
- End User Compute
- Microsoft 365
- Microsoft Entra ID
- Microsoft Intune
- Microsoft Defender
- Microsoft Purview
Our approach
Secure by design, from the first configuration
A greenfield tenant meant there was no legacy configuration to work around. We used that opportunity to build security into every layer before any users arrived.
Tenant design. Konsolute designed the new Microsoft 365 tenant around GBE-N's organisational structure, security requirements and future plans. Decisions on identity, collaboration, information protection and administration were documented before build began.
Zero Trust identity and access. Microsoft Entra ID was configured with multifactor authentication, Conditional Access and least-privilege administration. Access decisions consider the user, the device and the context of each sign-in, rather than trusting a network location.
Device management. Microsoft Intune manages GBE-N's devices, with compliance policies, security baselines and application deployment applied centrally. Only compliant, managed devices can reach organisational data.
Information protection. Security and information protection controls were configured so that sensitive information is classified and protected appropriately from the start, supporting both day-to-day work and future Copilot adoption.
Migration from central government. Users, mailboxes and content were migrated from the central government environment to the new tenant in a planned cutover, so that staff could continue working with minimal disruption.
Device rollout. New managed devices were deployed to staff, configured to the tenant's security standards and ready to use, with support available as people moved across.
Result
An independent, secure and future-ready workplace
GBE-N now operates its own Microsoft 365 tenant, designed around its needs and governed by its own policies. Zero Trust identity, device management and information protection were in place from day one.
Staff moved across from the central government environment with their email, files and collaboration tools, working on managed devices that meet the organisation's security standards.
Because security and information governance were built in rather than retrofitted, GBE-N has a foundation that is ready for capabilities such as Microsoft 365 Copilot. Konsolute continues to support the environment through an ongoing managed service.
Your questions
Greenfield Microsoft 365 tenant FAQs
A dedicated tenant gives an organisation control over its own identities, policies and configuration. For GBE-N, moving out of a shared central government environment was part of becoming an independent organisation. The decision depends on governance, security and organisational requirements.
Zero Trust means verifying every user and device explicitly, granting least-privilege access and assuming breach. For GBE-N, this was implemented with Entra ID Conditional Access, multifactor authentication and Intune device compliance. Each organisation’s controls should reflect its risks and ways of working.
Copilot works with the content users can access, so well-controlled permissions and information protection matter. GBE-N’s tenant was built with these controls from the start, rather than needing oversharing to be remediated later.
Talk to Konsolute
Building or rebuilding your Microsoft 365 environment?
Tell us about your organisation and its security requirements. Our security-cleared consultants can help you design a tenant that is secure by design and ready for what comes next.