I’m with you on that I prefer not to use MS tech. That said, you might be creating an unhealthy dynamic for yourself by expecting it all crash and burn down. Objectively, MS tech still gets the job done.

Doesn't matter if they get the job done if one big mistake can hurt millions of people it a bad idea.

Mono culture is always a bad idea and thinks like MS cloud services are the basis for creating a technical pandemic.

Ah yes, I long for the halcyon days of IT stability… oh wait, business has always been fraught with risk and trade-offs. You get insurance, put mitigations in place, and hope when it does go bad, you can blame Microsoft anyway.

Ever heard of single point of failure.

Yes, you can hack every company but he have to target them one by one.

Now you only need to take down MS

I understand your point, but the probability math works against you as the number of platforms grows, unless you have excellent data segregation and access controls. What happens in most cases, each new platform serves as an attack vector to be exploited to gain access to all of the data.

And now you data segregation and access controls are worthless because you need Azure AD for SSO.

The expected value rises.

I, too, long for Halcyon days.

> Objectively, MS tech still gets the job done

Mostly, if you don't have too high expectations.

My employer has had to invest I don't even want to know how much in an EDR (or whatever it's called nowadays) and a slew of services around this circus just to pretend their Windows systems are secure. Didn't catch a home-grown cryptolocker, though, and happily allowed it to encrypt its own files.

They mostly use web-bases SAAS applications anyway, so could trivially replace windows with an OS with a better security track record.

Plus, AzureAD always seemed kludgy. Until recently, they insisted on having SMS or phone as a second factor for password recovery. Which allowed you to reset the stronger 2nd factor used for auth. They only started supporting Fido tokens like a year or so ago for regular 2fa. Their authenticator is a joke: until recently, you had no idea what you were approving. It still doesn't support group inheritance, so if you base it on your local AD as the source of truth, you have to jump through more hoops and add more ad-hoc groups and maintain them. Good times.

Microsoft: Pay us for Windows Microsoft: Pay us for online services Also Microsoft: Pay us more if you want those 2 things to be secure

If you're talking about Linux, and not BSD or something, then I have a bridge you just may be interested in purchasing.

Make sure they have long enough expiry.

> One thing I know is they won't blame themselves.

Which is precisely why they went all in on Microsoft Cloud. Using an in-house stack (no matter if it's Jira, Confluence, Exchange, AD, Postfix, Exim, OpenLDAP, Samba, ...) will always lead to people blaming the C level for any outage, hack, whatever. Miss one tiny little patch and insurance won't pay.

Go for Atlassian Cloud/Microsoft/AWS/GCP? You can now deflect any blame onto the cloud provider. No personal liability, nothing. You followed industry best practices, so insurance pays out.

From the point of view of the employer it's stupid not to put all your eggs in one basket. For $10 a month per account, you get email (unless you have thousands of accounts, this is already worth it), instant messages and a softphone solution, office tools that you needed to buy anyway, and centralized user management for it all. All alternatives involve either still contracting it out to a probably les competent team, or hosting it in house at significant cost. On top of that, the day it all crashes down and burns their business to the ground, insurance pays out because it was cretified and wasn't an in-house solution that the insurer can point at and drag you to court with.