IT Support in Calgary: Managed IT, Microsoft 365 and Security

Most of what a managed IT provider does never needed a truck. Patching laptops, enforcing multi-factor authentication, administering Microsoft 365 and Entra ID, managing devices through Intune, triaging endpoint alerts and checking backups all happen over the network, the same way for a tower downtown as for an industrial bay in the northeast.

What distance changes is the visit. A failed switch, a floor being recabled or a server that will not boot needs hands in the room. We settle that before an agreement, not during an outage: which tasks stay remote, which are handled by shipping a pre-configured replacement, and which need someone on site and how that will be arranged for your address. If your business depends on frequent same-day visits, we will tell you that a provider with a Calgary depot may suit you better.

Remote-first also fits how many Calgary companies are already built: a head office downtown, a field office or yard elsewhere, people on rotation, partners in other provinces or the United States. One support team, one Microsoft 365 tenant and one set of controls covers all of it, including a sister office in the capital (IT support in Edmonton). See managed IT across Canada.

Calgary carries more corporate weight than its size suggests. Calgary Economic Development describes it as having the highest per-capita concentration of head offices in Canada, and Statistics Canada's Annual Head Office Survey counted 198 head offices in the Calgary area in 2022, with 25,312 head office employees, behind only Toronto and Montréal.

That shape creates a particular IT problem: the people with the widest access often work furthest from the office. An engineer at a wellsite and a superintendent in a site trailer sign in to the same tenant as the executive team. What matters is conditional access that treats an unmanaged device differently from a company laptop, Intune enrolment so a lost tablet can be wiped remotely as soon as it is reported, and shared field devices with their own limited accounts rather than one login taped to the case.

Rotational and contract staff need the same discipline in reverse: a crew's accounts should be switched off when the turnaround ends, not months later. We build joiner and leaver steps into the service and review the guest accounts that partners and joint-venture contractors leave behind in Teams and SharePoint. If you suspect someone still has access, see what to do when a former employee still has access.

On November 1, 2026, Alberta stopped turning its clocks back and moved to permanent Alberta Time, which the Government of Alberta defines as UTC-6. For a Calgary office, Ontario is now one hour ahead from November to March and two hours ahead from March to November, and in winter Calgary shares a clock with Houston.

Not all software kept up. In September, CBC News reported on a Calgary salon whose online booking system had pushed every pre-booked appointment from November to March back by an hour. Microsoft's own guidance (KB 5134344) confirms the risk inside Microsoft 365: users have to move to a new time zone, (UTC-06:00) Mountain Time (Alberta), existing calendar events do not migrate on their own, and recurring meetings need review.

The trap is in the detail. Changing the time zone on a recurring series resets its exceptions, so a weekly operations call that was moved for a holiday quietly returns to its old slot (Microsoft Support). We confirm every Windows device has the update, move calendars to the new zone, rebuild the recurring series that matter and test scheduled Power Automate flows, which Microsoft also lists as affected.

Calgary's law, accounting and advisory firms hold exactly the information Alberta's privacy law was written for: identity documents, financial records, employee files and transaction documents. The Law Society of Alberta's breach guidance is direct. It tells firms to report breaches of personal information to the Information and Privacy Commissioner without unreasonable delay, reminds them of the ethical duty to tell affected clients, and points to Rule 7.7-2 of the Code of Conduct, which requires prompt notice to the insurer of anything that may give rise to a claim.

The same guidance tells firms to preserve evidence and keep a chain of custody, and that is where the order of operations matters. A well-meaning reset of every password and a reimaged laptop can wipe out the sign-in records that show whether a mailbox was actually read. Our incident response contains the incident without destroying that evidence, and our digital forensics practice writes findings for insurers, counsel and, when needed, the court, including expert-witness work. See IT support for law firms.

Section 34.1 of PIPA requires an organization to notify the Commissioner, without unreasonable delay, of any loss of or unauthorized access to or disclosure of personal information where a reasonable person would consider that there is a real risk of significant harm to an individual. The OIPC takes these reports through its PIPA breach notification form, and the Commissioner can then require you to notify the people affected (section 37.1). Most organizations do not wait to be told: the OIPC reports that since 2012-2013 at least 80% had already notified affected individuals by the time they reported.

Whether a breach meets the test is a decision for you and your counsel. What we bring is the evidence that decision rests on, gathered while it still exists. Our Alberta PIPA guide explains the law in more depth.

1. 01

   Call before you clean up

   Ring the 24/7 incident line, (289) 582-9930, before resetting accounts or wiping machines. The first hour decides what evidence survives.

2. 02

   Contain without erasing

   Revoke the attacker's sessions and tokens and isolate affected machines, while keeping mailbox audit logs, sign-in history and disk images.

3. 03

   Establish what was exposed

   Which records, how many people, how sensitive, and whether the logs show the data was opened or copied rather than merely reachable.

4. 04

   Settle notice with counsel

   Apply the real-risk-of-significant-harm test, file with the OIPC if it is met, and check whether PIPEDA or another province's law also applies.

5. 05

   Fix the cause and keep the file

   Close the gap that let it happen and record what you knew, when you knew it and why you decided as you did. See breach notification support.

Much of Calgary's commercial traffic is large invoices between companies that already trust each other: operators, service contractors, engineering firms and joint-venture partners. Business email compromise feeds on exactly that. An attacker inside one mailbox learns who pays whom, then asks for a change of banking details just before a large payment is due.

Three controls do most of the work: an enforced DMARC policy so nobody can send email as your domain, phishing-resistant multi-factor authentication for finance staff and executives, and a standing rule that any change to bank details is confirmed by phone on a number you already had. Test your own domain with the email spoof check. If a request has already arrived, follow what to do when a vendor asks to change bank details, and for ongoing protection see managed security.

Calgary has lived through it. During the June 2013 flood, the City of Calgary says, the downtown was inaccessible for days. A firm whose files live only on a server in a downtown comms room loses them along with the building; a firm working from Microsoft 365, with backups held somewhere else, keeps working from wherever its people are.

Downtown is also changing shape. The City's Downtown Office Conversion Program is supporting 21 projects converting 2.68 million square feet of office space into homes and other uses, and the tenants in those buildings are moving. An office move is a continuity event too: circuits ordered well ahead, numbers ported, and the old comms room emptied without leaving a forgotten server behind.

We plan for both the same way: know where your data lives, test a restore and date it, and agree who does what if the office is unavailable for a week. See backup and disaster recovery.

Property managers in the Beltline and the suburbs hold rental applications, identity documents and banking details, which is squarely PIPA territory: see IT for property management. Logistics firms east of the city, around the CN Calgary Logistics Park in Rocky View County, run scanners, shared terminals and carrier portals that need the same identity controls as the front office: see logistics and warehousing. Engineering firms serving the energy sector juggle large drawings, client portals and partner access: see architecture and engineering.

The first month puts the basics in place, roughly in this order. If you would rather have an outside view before committing, start with an IT health check or the security assessment.

• An inventory of every account, device, licence and admin login, including the ones a previous provider set up and nobody remembers.
• Multi-factor authentication enforced for everyone, with conditional access for administrator roles and unmanaged devices.
• Mailboxes and recurring meetings moved to the (UTC-06:00) Mountain Time (Alberta) zone, and scheduled automations checked for drift.
• A restore from backup that has actually been tested and dated, and SPF, DKIM and DMARC on your domain moving towards enforcement.
• A one-page breach plan naming who calls the incident line, who calls counsel and the insurer, and who files with the OIPC.