M365 / Intune / Windows 365 Cloud PC setup for small remote consultancy (EU-hosted)

Overview We are a small data & analytics consultancy setting up a proper, secure Microsoft 365 environment for a distributed team of 3. We have an existing Microsoft 365 tenant that was created years ago under an old name and is lightly used (OneDrive plus a couple of small functions; beyond that we're not sure what's provisioned). We are rebranding and want the environment to be clean and correctly branded. We want an experienced engineer to audit what we have, recommend whether to build fresh or remediate, recommend the right licensing, and build a clean, locked-down setup. Our team members connect from outside the EU and work with client systems that require Windows-only desktop software (Power BI Desktop). We want them working from EU-hosted, centrally-managed cloud desktops that are logged, device-compliant, and MFA-enforced. We care about a clean, professional, secure baseline — but we also care about the team being fast, so where there's a security-vs-workflow trade-off we want you to lay out options and let us choose rather than max out lockdown by default. We'd rather hire an expert who brings recommendations than one who just executes a fixed spec. Throughout, propose the approach you'd take and the trade-offs, and we'll decide. This is an ongoing engagement. We want the initial build, then a retainer for maintenance, occasional changes (adding/removing users, spec changes), and further development as we grow. Please indicate ongoing availability and rate alongside the build price. Scope of work Tenant audit + greenfield-vs-remediate recommendation. Review our existing tenant and tell us exactly what we have (licences, Entra ID config, any Intune/Conditional Access present). Then advise: given the tenant was created under an outdated name and is barely used, do we stand up a fresh tenant on our new domain and migrate the little we have (OneDrive contents, billing), or remediate the existing one? Note that the underlying *.onmicrosoft.com tenant name cannot be changed after creation. Deliver a short written findings + recommendation before building. We lean toward a clean greenfield tenant unless you make a strong case otherwise. Branding & domain. Add our custom domain (a .ai domain we own) as the primary domain, set the organization display name correctly, and ensure all human-facing surfaces (email, sign-in screens, SharePoint URLs, org name) reflect the new brand — not the legacy name. Licensing recommendation. Recommend the correct licences for 3 users with monthly cost. We expect Microsoft 365 Business Premium plus a Windows 365 Cloud PC SKU. Because we are in the EEA, specify the correct SKU so that Microsoft Teams is included (the "with Teams" Business Premium variant), and tell us whether Windows 365 Business or Enterprise fits a 3-person team and why. Separately, include one Microsoft 365 / Power BI Pro seat for the founder only, for internal and private dashboards (client project work runs in clients' own tenants and needs no capacity from us). Identity. Set up Entra ID properly: 3 named user accounts, MFA enforced, Conditional Access requiring compliant device + MFA. Cloud PCs. Provision one EU-hosted Windows 11 Cloud PC per user, specced for memory-heavy desktop analytics work (assume 4 vCPU / 16 GB unless you advise otherwise). We prefer the Germany region, but if you have a strong reason for another EU region, recommend it. Baseline hardening + lockdown options. Keep the essentials on: Microsoft Defender, device compliance, MFA, and disk encryption. For data-egress controls (clipboard, local-drive, USB redirection), we do not want maximum lockdown by default — we're prioritizing team speed for now. Present a short menu of options from light to strict (e.g. "clipboard allowed, local-drive/USB off" vs. "all redirection open" vs. "fully locked") with the trade-offs of each, and we'll pick. Default to a lighter-touch setup unless you flag a specific risk we should know about. Access method. Standard pattern is client-issued named accounts: each client provisions a named account per team member in their own tenant, and we sign into it from the Cloud PC. Set up and document how we manage these cleanly (credential storage, onboarding/offboarding a client, MFA). No B2B guest setup needed unless you flag a case where it's clearly better. Documentation & handover. Provide clear written documentation: what was built, how to add/remove a user, how to adjust a Cloud PC spec, and how to read the sign-in and device-compliance logs. A short screen-recorded walkthrough is a plus. Requirements Demonstrable experience with Windows 365 Cloud PC deployment and Intune device management. Strong Entra ID / Conditional Access experience. Able to explain trade-offs in plain English (we are not IT specialists). Available for a short handover call and a few follow-up questions after delivery. To apply Briefly describe a similar setup you've delivered. Tell us whether you'd recommend Windows 365 Business or Enterprise for a 3-person team and one sentence on why. One sentence on when you'd rebuild a tenant fresh vs. remediate an old one. Note any info you'd need from us to begin the audit.