Keep your existing IT. Give controlled work its own workspace.
Castilix can sit alongside your commercial Microsoft 365 environment, business applications, and existing IT team.
Keep ordinary business moving
An enclave does not require moving every employee and every business application into a new environment. Define the project information and users that need a controlled workspace, then keep ordinary business activities in the systems appropriate to them.
Your commercial environment
Everyday business email, public marketing, and commercial workflows that do not handle the controlled project information.
Your Castilix workspace
Approved users access enclave email, documents, and applications through dedicated Windows 365 Government Cloud PCs and Microsoft 365 GCC High.
Approved transfers
Use the agreed sharing and transfer methods for information moving between environments. Keep controlled project content within its approved boundary.
Make the daily workflow clear
A user may keep their ordinary business mailbox and use the enclave for controlled project correspondence and documents. Plan the account names, sign-in steps, project addresses, and recipient instructions before rollout so people can tell the workspaces apart.
Automatic forwarding, synchronization, or copying between commercial and enclave systems can change the data boundary. Review those connections alongside file transfers, printing, downloads, and clipboard use. The chosen access method and application configuration determine the user experience.
For example, a project manager could handle general scheduling in the commercial environment and review controlled project deliverables inside the enclave. The data classification and agreed process determine which system holds each item.
Give each team a clear operating role
| Workstream | Typical ownership to agree |
|---|---|
| Commercial IT | Your internal team or existing provider continues the commercial tenant, business applications, networks, and other systems in its scope. |
| Enclave operations | Castilix manages the packaged cloud workspace and supports enclave users under the subscription terms. |
| Connecting devices | Assign endpoint configuration, updates, user support, and security ownership. Physical-device management is separately scoped with Castilix if needed. |
| Cross-environment changes | Identify who reviews new applications, file-transfer methods, recipient access, and connections that affect the boundary. |
| Business approvals | Your organization approves users, information access, project requirements, and the responsibilities recorded in the SSP. |
Start with a practical rollout
- Map the project workflow. Identify where controlled information arrives, the people who use it, and the recipients who receive deliverables.
- Review the existing environment. Include commercial tenants, physical devices, application dependencies, and your current IT provider.
- Agree the boundary and handoffs. Document account management, support contacts, approved transfers, and incident coordination.
- Scope onboarding and migration. Plan any data movement or application work separately from the packaged subscription.
When the requirement is to deploy in your own Microsoft 365 tenant, discuss Secure Enclave Enterprise. Workloads needing a custom desktop design in your Azure Government environment can be scoped as managed Azure Virtual Desktop.