Secure Microsoft Cloud Workspace

Secure Microsoft Cloud Workspace + Assignment-Based Clinic Access System Overview DentaVate Solutions is a Canadian remote dental operations company. We provide non-clinical support to dental clinics, including recall and hygiene follow-up, treatment follow-up, and accounts receivable follow-up. We are looking for an experienced Microsoft cloud / Azure / endpoint security consultant or small MSP to help us design, implement, document, and hand off a secure remote workspace system for our Care Team Members. This is not a generic “set up a VM” project. We need a secure, practical, affordable workspace and access model that supports short-term clinic/service assignments. ## Business workflow DentaVate will have a pool of approved Care Team Members. Not every approved worker needs a Cloud PC or workspace all the time. The workflow is: 1. DentaVate has an approved worker pool. 2. DentaVate offers an opportunity. 3. Workers show interest. 4. DentaVate selects a worker. 5. A short SOW / service assignment is created. 6. A secure workspace is assigned, created, or reused. 7. Clinic access packages are attached to that workspace for the assignment period. 8. The worker performs the assigned work. 9. When the SOW / assignment ends, clinic access is removed. 10. The workspace is suspended, cleaned, reused, or retired. Some assignments may be short, even only a few days. The system must support fast assignment changes without requiring an IT ticket every time. Desired access model The intended access path is: Worker personal computer → DentaVate-controlled Windows workspace / Cloud PC → clinic-approved remote-access tool → clinic PMS, phone system, or workstation Clinic IT should be able to approve DentaVate’s controlled environment, not every worker’s personal home internet or personal computer. We therefore need a stable DentaVate outbound IP option so clinic IT can whitelist DentaVate’s controlled workspace environment where required. Current environment We already have: * Microsoft domain / Microsoft tenant direction * Wix website and DentaVate domain * a pilot Azure / Bastion environment that was previously tested * a custom DentaVate app being developed separately * an existing RFQ / vendor inquiry package with fuller details for shortlisted candidates We are open to alternatives, but Microsoft stack experience is strongly preferred. Possible technologies may include: * Microsoft Entra ID * Intune * Conditional Access * Windows 365 * Azure Virtual Desktop * Azure networking * static outbound IP / NAT Gateway / Azure Firewall or equivalent * Microsoft 365 Business Premium / appropriate licensing * TeamViewer / Splashtop / RDP / browser PMS / NetBird / VPN scenarios ## What we need built We need help with: 1. Architecture recommendation Recommend the most practical, affordable, secure approach for 1 active workspace to start, expandable to 3 active workspaces. 2. Workspace model Design a model where approved worker pool does not automatically equal active workspace. Workspaces should only be active when needed for selected workers / assignments. 3. Static outbound IP Provide a design or clearly priced option for one stable DentaVate outbound IP that clinics can whitelist where needed. 4. Clinic Access Packages Create a repeatable model for clinic-specific access packages, including remote-access tool, PMS access method, credentials/entitlements, phone method, static IP requirement, attach/detach steps, and verification evidence. 5. Assignment-based access DentaVate must be able to attach and detach existing clinic access packages from selected workers/workspaces in minutes, without opening an IT ticket for routine changes. 6. Secure access controls Configure MFA, identity controls, no local admin access for workers, restricted clipboard / downloads / local drive mapping / printing where possible, and appropriate audit logging. 7. Trusted endpoint recommendation Advise whether worker devices should be registered/approved before accessing the DentaVate workspace, and how that would be done practically without overcomplicating operations. 8. Remote access method review Explain how the design handles common clinic access methods such as TeamViewer, Splashtop, RDP, browser-based PMS, 3CX/softphone, NetBird, VPN, or similar tools. 9. NetBird / VPN / routed access isolation Explain how you would prevent cross-clinic network access if a worker serves multiple clinics over time or if a clinic requires network-layer access. 10. Emergency revocation Provide a process for immediately suspending a worker and cutting off workspace and clinic access if needed. 11. Clinic offboarding Provide a process and evidence trail to show clinic access has been removed when a clinic contract ends. 12. Documentation and handoff Provide clear runbooks so DentaVate can perform routine worker assignment, clinic attach/detach, suspension, offboarding, and verification steps internally. Important requirement We do not want an ongoing dependency where every routine SOW or assignment change requires an IT ticket. The IT partner should build and document the system. DentaVate should operate routine assignment changes after handoff. IT support should be needed for new/unusual clinic setups, new remote-access methods, NetBird/VPN/networking exceptions, platform issues, emergency support, and ongoing maintenance—not every normal assignment change. Initial scale Start with: * 1 active worker workspace * ability to expand to 3 active workspaces * approved worker pool may be larger than active workspace count * design must not require rebuilding later as we grow Deliverables We expect: * recommended architecture * implementation plan * Microsoft licensing recommendation * static IP / networking recommendation * workspace provisioning process * clinic access package template * worker assignment / attach / detach runbook * worker suspension / offboarding runbook * clinic offboarding runbook * security configuration summary * admin handoff documentation * acceptance test plan * optional monthly support proposal ## Proposal requirements Please include: 1. Recommended platform: Windows 365, Azure Virtual Desktop, hybrid, or alternative. 2. Why you recommend that platform for our use case. 3. Whether you can provide a stable outbound IP option. 4. How DentaVate can attach/detach clinic access without an IT ticket. 5. How you would handle short assignments, including 5-day SOWs. 6. How you would handle reuse, cleanup, or suspension of workspaces. 7. How you would handle NetBird / VPN / routed access safely. 8. What DentaVate can manage internally after handoff. 9. What still requires IT support. 10. Your fixed implementation cost. 11. Estimated monthly infrastructure / licensing cost. 12. Optional monthly support cost. 13. New clinic onboarding cost. 14. Emergency / after-hours support rate. 15. Earliest start date. 16. Relevant Microsoft / Azure / endpoint security experience. 17. Whether you are an individual consultant, agency, or MSP. 18. Where implementation and support will be performed from. 19. Whether any work is subcontracted. 20. Whether you can provide references or similar project examples. ## What this project is not This is not: * Wix website work * DentaVate app development * dental PMS integration * payroll software * marketing automation * generic helpdesk only * a simple one-time VM setup with no access model Ideal candidate The ideal candidate has experience with: * Microsoft Entra ID * Intune * Conditional Access * Windows 365 and/or Azure Virtual Desktop * Azure networking and static outbound IP * secure remote workspaces * endpoint management * small-business practical implementation * documentation and handoff * healthcare / privacy-sensitive environments preferred, but not required We are looking for someone practical, clear, and honest about tradeoffs. We do not need unnecessary enterprise complexity, but we do need the system to be secure, repeatable, and operationally usable. Shortlisted candidates will receive a more detailed vendor inquiry package.