When the Job Site Moves, the File Server Cannot Follow

The problem was not the file server, it was where the work happens

Construction is not an office business that occasionally visits a site. The work happens at the site, and the office exists to support it. The client’s infrastructure was built the other way around. Everything of value lived on a server in a closet, and every person who needed it had to reach back to that closet to get it.

• Project documentation lived on legacy server shares that were only fully usable from inside the office network
• Field teams worked around the constraint instead of through it, which meant local copies, emailed attachments, and no single source of truth
• Folder permissions had accumulated over years of projects, so access was inherited and inconsistent rather than deliberate
• On-premises Active Directory sat underneath everything, quietly tying identity, devices, and file access to one physical location
• A hardware failure or a site outage would have taken project documentation offline for everyone at once

None of this was the result of neglect. It is what a working environment looks like after a decade of growth, and it is exactly the point at which a cloud-first strategy stops being optional.

Why construction firms hit this wall harder than most

A distributed workforce is not a policy choice in construction. It is the operating model. That creates pressures other industries do not face in the same combination.

• Field and office teams need the same documents, but almost never from the same place or on the same network
• Project documentation is large, versioned, and legally consequential, so the wrong revision is not a minor inconvenience
• Crews and subcontractors change from project to project, so access needs to be granted and revoked constantly
• Job site connectivity is unpredictable, which punishes any system that assumes a stable path back to a central server
• Operational technology and material tracking systems are increasingly expected to feed reporting, which the network has to be ready to carry

The answer is not simply moving files somewhere else. It is rebuilding how identity, access, and documentation work so location stops being a dependency. That is the same sequencing we bring to IT services for construction companies generally.

How we built the cloud-first foundation

The engagement covered the foundational stages of the strategy, delivered as four connected workstreams.

1. Full assessment of the on-premises environment

We started by mapping what was actually there, which meant the server environment, every file share in use, and the identity dependencies underneath them. Identity is the part most assessments skip and the part that determines whether a cloud migration is a project or a multi-year entanglement. Knowing exactly what authenticated against on-premises Active Directory, and what would break if it went away, is what made a phased plan possible instead of a leap of faith.

2. Legacy file shares rearchitected into SharePoint

We began transitioning legacy server shares into SharePoint, and deliberately did not lift and shift the existing folder tree. Copying a decade of inherited permissions into the cloud reproduces the original problem with a better logo on it. Instead we rearchitected the site and permissions structure around how project documentation is actually used, so field and office teams get secure access to what they need from anywhere, and access reflects the current project rather than the history of every project before it. Document management sits inside the broader Microsoft 365 environment the client already owns, and Microsoft documents the same restructure-before-you-move principle in its own SharePoint migration guidance.

3. A phased path off on-premises Active Directory

With file access moving to the cloud, the remaining dependency was the domain itself. We established a phased path toward decommissioning on-premises Active Directory in favor of Entra-joined devices managed through Intune, where device compliance policies and security posturing are applied to the device rather than to the network it happens to be sitting on. Phased matters here. Each dependency comes off deliberately, in an order that keeps the business working throughout, which is the same discipline behind our cloud services and cybersecurity work.

4. A comprehensive network assessment for what comes next

The last workstream looked forward rather than back. A comprehensive network assessment confirmed the environment is positioned to support SCADA-style material metrics and reporting as those initiatives come online. Operational data has a habit of arriving before anyone has checked whether the network can carry it, and retrofitting capacity under a live production system is expensive. It is also where the network stops being purely an IT concern, since CISA’s industrial control systems guidance treats the segmentation and monitoring of operational technology as a security requirement rather than a performance one. Confirming readiness in advance turns a future initiative into a scheduled step.

The biggest win: the environment stopped depending on a location

The outcome of the foundational stages is a streamlined, more flexible environment with materially less reliance on locally hosted infrastructure.

• Field and office teams reach project documentation securely from anywhere, at any time, without reaching back to an office server
• Permissions are structured intentionally, so access is granted by role and project rather than inherited from an old folder
• Device compliance and security posture are enforced through Intune, independent of which network the device is on
• The path to retiring on-premises Active Directory is defined and phased rather than open-ended
• The network is confirmed ready for SCADA-style material metrics and reporting when the client chooses to move on them

What other construction firms can learn

Three lessons from this engagement transfer directly to any construction business considering the same move.

• Assess identity first, not storage. The hard part of leaving on-premises infrastructure is almost never the files. It is everything quietly authenticating against the domain.
• Do not migrate your folder structure. A cloud migration is the one clean opportunity to fix permissions. Lifting the existing tree wastes it and carries the mess forward.
• Phase the decommission. Turning off a domain controller is the last step of a sequence, not the first. Each dependency comes off on purpose, with the business running the whole time.

Why cloud-first is a sequence, not a switch

Cloud-first fails when it is treated as a single cutover event. The environments that end up genuinely flexible are the ones where each layer moves in a deliberate order. Assess the dependencies, restructure how documentation and access work, move identity and device management, then confirm the network can carry what the business wants to do next.

That sequencing is also what keeps the work reversible at every stage. Nothing is stranded, no team is locked out mid-project, and the business is never asked to stop working so the infrastructure can catch up. We deliver this alongside managed IT services so the team that plans the migration is the same team supporting the environment afterward.

Explore the full transformation

The complete case study covers the work in more depth, including the following.

• The full assessment findings across the server environment, file shares, and identity dependencies
• The rearchitected SharePoint site and permissions model, and how it maps to project workflow
• The phased plan for decommissioning on-premises Active Directory
• The Entra join and Intune compliance approach for field and office devices
• The network assessment findings and what they mean for SCADA-style material metrics and reporting

Download the complete case study to see the full cloud-first transformation, or contact Uprite to discuss what a phased path off on-premises infrastructure looks like for your construction business.