Eight internal systems built around one access model

A group operating across Dubai and Vancouver with two legal entities, a distributed workforce across several time zones, and staff who needed sharply different slices of the operating system.

The estate had to carry real work: client and project identity, attendance and timesheets, contracts and signatures, finance and VAT, labour records, planning, marketing analysis, design delivery, client access and sales command centres. A pile of disconnected subscriptions could provide the features, but not the operating model.

Stated as a cost problem — per-seat licensing was scaling faster than headcount value, and half the seats were for people who needed one feature.

That framing was wrong, and treating it as a procurement exercise would have produced a cheaper version of the same mess.

The real constraint was that no single system owned identity. Every tool had its own user list, its own idea of what a project was, and its own audit trail — which meant access review was impossible and any cross-system question required a human to reconcile three exports.

Once identity is the question rather than cost, build-versus-buy resolves quickly: you can buy features, but you cannot buy a coherent identity and access model across systems you do not control.

One identity source — Microsoft Entra, which the group already paid for — with every platform reading the same directory and writing to a shared operations site.

Rejected: a single monolithic ERP, which would have taken eighteen months before anything shipped and locked the group into one vendor's model of its own business. Also rejected: no-code tooling, which would have moved the fragmentation rather than removing it.

Chosen instead: a common architecture applied eight times, so each platform ships independently but none of them invent their own idea of a person, a client or a project.

A repeated production pattern: a statically exported Next.js front end, an Azure Functions API authenticating through Managed Identity, and Microsoft Graph reading and writing namespaced SharePoint lists. Entra supplies identity; each application owns its domain without inventing a new person, client or project.

Group Workspace is the front door: a browser workspace with per-person application access, documents, chat, attendance, contracts, project identifiers, timesheets, activity monitoring and daily briefs. Finance carries multi-entity invoicing, purchasing, expenses, payroll evidence, document matching and filing-ready UAE VAT. It also joins project and time records to HR cost data for client profitability, while surfacing missing labour coverage instead of quietly treating it as zero.

HR handles workforce records and labour logic; Operations connects monthly plans to weekly commitments and blockers; Design carries requests through handoff, revision and delivery; Marketing connects operational records to analysis and planning modules; client and sales command centres expose only the slice each audience is authorised to see.

Each application was subsequently connected to AI agents at both the application and data layers. The agents can retrieve context across authorised records, surface exceptions and prepare next actions while the underlying identity and permission model continues to govern what can be seen or changed.

Eight systems in production across two entities, with a single identity model, a connected AI-assistance layer and an audit trail that answers access questions directly.