Standardising Technology Across an Existing Franchise Network

Locations opened at different times

Each site was set up with whatever devices, licences and suppliers were current at the time. A network of ten locations may span three or four generations of hardware, software and security practice, none of them wrong when chosen but none of them aligned.

Local decisions made sensibly in isolation

A manager at one site found a problem and solved it locally. The solution worked, so it stayed. Across the network, dozens of those sensible local decisions add up to a patchwork that nobody designed and nobody can see in full.

Acquisitions arriving with their own systems

When a group acquires an existing business, it inherits a technology environment that was built by someone else for different reasons. That environment runs until someone has the time and authority to change it, which is often never.

No single owner of the whole

Nobody at head office holds responsibility for the technology standard across every site. Each location reports through operations, not IT, so technology drift is invisible until something breaks or a question cannot be answered.

Security is only as strong as the least managed site

A single site with outdated security settings, no multi-factor authentication or unmanaged devices gives an attacker a way into the broader network. Head office cannot guarantee a standard it cannot see.

Support is slower because every site is different

When a staff member calls for help, the first question is not what the problem is but what system they are on. Every site is a new investigation, and simple issues take longer than they should.

Reporting has to be assembled by hand

Because each site uses different tools and configurations, head office cannot pull a single report across the network. Someone compiles it manually, which means it is always out of date and always incomplete.

Licences are paid for and unused

Different sites hold different numbers of licences for different products. Some are over-licensed, some are under-licensed, and nobody has a consolidated view of what the network actually pays for.

Basic questions about the network cannot be answered

How many devices do we have across all sites? How many have current security patches? Who has access to what? Without a standard, these questions require a site-by-site audit rather than a query.

Hardware, software and network standards

A defined hardware specification for each site format, a standard set of approved software, and a network configuration covering firewalls, Wi-Fi and switching. A new site or a refreshed site orders from the same list, so the network is not assembled from whatever was available on the day.

Identity management

Every staff member across every site authenticates through a single identity provider, with accounts created and removed centrally. A person who leaves one location is removed from the network, not just from a local machine.

Conditional access

Access to business systems is governed by policy, not by whoever happens to know the password. Conditional access rules determine what can be reached from which devices, locations and risk levels, applied identically at every site.

Device enrolment and management

Every device is enrolled into central management before it reaches a site. Configuration, security settings and software are pushed to the device, not left to whoever sets it up. A device that is lost or retired can be wiped remotely.

Security policies

A single set of security baselines — multi-factor authentication, endpoint protection, patching, backup and email filtering — applied to every site so that head office can state with confidence what the security posture is, rather than discovering site by site what it is not.

Business continuity

Backup and recovery are configured to the same standard at every site, tested on the same schedule. If a site experiences a hardware failure, a security incident or a data loss event, the recovery path is already known and does not depend on a local manager remembering what they did last time.

Centralised reporting

Because every site runs the same systems and the same configurations, head office can pull a single report across the network — device count, security status, licence usage, support activity — without asking each manager to compile it by hand.

Operational governance with named owners

The standard is owned, maintained and reviewed. Someone at head office is accountable for keeping it current, for approving exceptions, and for ensuring that the next site acquired or opened arrives at the standard rather than being dragged up to it later.

Defining the standard

LOOKUP works with head office to define the technology blueprint — hardware, identity, security baseline, Microsoft 365 configuration and support model — so every site has a single, documented standard to move to rather than a set of aspirations.

Microsoft 365 environment design

LOOKUP designs the Microsoft 365 tenant configuration — tenants, licences, security policies and user accounts — so every site authenticates, collaborates and stores information through the same governed environment.

Identity and device management

LOOKUP configures centralised identity, conditional access and device enrolment so that accounts are created and removed centrally, and every device is managed from the moment it is provisioned to the moment it is retired.

Establishing the security baseline

LOOKUP applies the security baseline — multi-factor authentication, endpoint protection, conditional access and email filtering — across every site, with ongoing monitoring to ensure a site that drifts is detected and corrected. When an incident does occur, the containing a security incident across the network limits the blast radius across the network.

Staged migration site by site

LOOKUP moves each site onto the standard one at a time, proving the process at the first location before replicating it. Managed IT services provide the ongoing support model so the standard holds after migration, not just on the day of cutover. LOOKUP coordinates with point of sale and line-of-business platforms rather than replacing them.

A single technology standard means every site uses the same identity platform, security baseline, device configuration, Microsoft 365 tenant and support path. It does not mean every site is identical in every respect — store size and layout differ — but the core technology layer is consistent, governed and visible to head office.

No. Standardising means defining what the target looks like and moving each site toward it, keeping what already fits and replacing what does not. Hardware that meets the standard stays; hardware that creates risk or cannot be managed centrally is replaced when it reaches its natural end of life.

Where sites are independently owned, the standard has to be adoptable rather than merely mandated. That means head office designs it so coming onto the standard is easier, safer or cheaper than staying off it, and the benefit to the operator is visible — not only the benefit to head office.

Refusal usually signals the standard looks like cost or disruption from the operator's side. The response is to make the case in operational terms — what the operator gains — and to ensure the migration path is genuinely low-friction. Where a network agreement exists, the standard may also be a contractual expectation, but adoption works better when it is understood as a benefit.

Security can be enforced where the identity, devices and Microsoft 365 tenant are managed centrally, even on an independently owned site. Conditional access, multi-factor authentication and endpoint protection are applied through the platform, not through physical control of the premises. The constraint is contractual and political, not technical.

Identity and security come first, because every later stage depends on them and because one weak site exposes the whole network. Until accounts, access and device security are consistent, nothing else can be reliably standardised or reported on across the network.

The change is done site by site, sequenced around trading patterns, and proven at one location before it is replicated. Work is scheduled for low-traffic periods, devices are pre-configured before they arrive, and the cutover at each site is planned so the business opens the next day on the new standard.

It depends on the number of sites, how different they are, whether they are company-owned or independently owned, and how much needs to change at each location. A small network with similar sites moves faster than a large one with acquired locations carrying legacy systems. The process is sequenced, not simultaneous.

Acquired locations are assessed against the standard and brought onto it as part of the integration process. The assessment identifies what can stay, what must change immediately for security reasons, and what can be migrated over a longer period. The standard means the integration is repeatable rather than a fresh project each time.

No. The standard defines the minimum capability and the management requirements — such as a managed firewall, business-grade connectivity and enrolled devices — not a single brand or model. Sites of different sizes may use different hardware that meets the same standard and is managed through the same platform.

Drift is prevented by centralised management — devices enrolled and monitored, policies enforced through the platform rather than relying on local compliance, and ongoing support that holds the standard. A site that drifts is detected through monitoring, not discovered when something breaks.

The standard needs a named owner with authority across sites — typically a network operations lead or a virtual CIO — not a committee. Without a single owner, decisions default to whoever is loudest, and the standard erodes through exceptions that are never revisited.

The cost depends on how far the site is from the standard, what hardware or licences it already holds that can be retained, and whether the migration is phased or done in a single cutover. Where the standard is adoptable, the ongoing cost is often lower than what the site was paying for ad-hoc support and unused licences.

A common standard means head office can see devices, security status, licences and support activity across every site through a single pane rather than asking each site. Reporting becomes a query rather than a manual compilation, and it is current rather than out of date.

Start with discovery — an assessment of what is actually running at each site, who has access, and what the security posture is. You cannot define a standard without knowing the current state, and most networks are surprised by what the assessment finds.