Lessons Learned: Supporting the Modernization of a Critical Messaging Ecosystem

Excerpt

MAKEHITEC supports sensitive organizations in modernizing their critical platforms: cybersecurity, architecture, protocols, governance, and the selection of sovereign solutions, through a rigorous, independent, and decision-oriented approach.

In public organizations, just as in large enterprises, email is never merely a tool for sending and receiving messages. It is an operational foundation and a convergence point between digital identity, security, collaboration, service continuity, mobility, document governance, and sovereignty.

At MAKEHITEC, we recently carried out an analysis and advisory mission around a highly critical messaging, calendar, and contacts ecosystem. Delivered in a demanding environment, this project enabled us to mobilize the full range of our expertise: application architecture, cybersecurity, messaging protocols, IAM, code analysis, governance, change management, and decision support.

Without disclosing any confidential technical or organizational details, this article shares the key lessons learned from this mission and highlights the value of a rigorous, independent, and structured approach when modernizing a critical collaboration platform.

A Critical Messaging Platform Is More Than a Webmail

The first lesson from this mission is simple: in a large information system, messaging is rarely an isolated component.

It usually relies on a combination of services: SMTP servers, IMAP services, LDAP directories, authentication mechanisms, SSO, PKI, desktop clients, mobile applications, webmail, calendars, contacts, administration tools, backups, monitoring, and delegation mechanisms.

Complexity does not come only from the number of users or mailboxes. It mainly comes from the diversity of use cases. A single platform often needs to support:

• personal mailboxes associated with users;
• shared mailboxes used by teams or units;
• temporary mailboxes created for events or missions;
• personal, shared, or delegated calendars;
• access through multiple frontends: webmail, desktop clients, mobile devices;
• strong requirements for authentication, confidentiality, traceability, and service continuity.

A serious assessment must therefore go beyond the question: “Which product should we choose?” The real question is rather: which architecture model can sustainably cover user needs, security constraints, operational requirements, and sovereignty expectations?

Detailed Functional Analysis Before Any Technical Recommendation

We began with an in-depth analysis of business use cases. This phase is essential, as it helps avoid two common mistakes: choosing a solution based solely on a marketing feature list, or comparing products without fully understanding actual user needs.

The study covered messaging, calendar, and contacts requirements, with particular attention to sensitive scenarios: shared mailboxes, delegations, folder-level permissions, private events, calendar sharing, mobility, calendar printing, multi-device synchronization, and user reassignment processes.

This approach enabled us to formalize functional coverage matrices across several domains:

• email;
• calendar;
• contacts;
• administration and back office;
• security and compliance;
• operations, monitoring, and disaster recovery;
• migration and coexistence;
• sovereignty and governance.

Each requirement was assessed according to its level of criticality, then compared with the actual capabilities of the solutions studied.

Architecture as a Decision-Making Tool

In this type of project, architecture is not merely a technical representation. It is a decision-making tool.

We mapped flows, components, dependencies, and areas of responsibility: authentication, directory services, clients, web services, mail protocols, calendar services, administration APIs, backups, monitoring, and external integrations.

This mapping made it possible to identify what should be retained, what could be replaced, what needed to be modernized, and what required particular attention.

For example, an LDAP directory used by multiple services cannot be treated as a simple messaging component. It becomes a cross-functional reference system that must be preserved and properly integrated. Similarly, an existing SSO based on OIDC/OAuth2, an internal PKI, or Kerberos mechanisms are not details: they are structuring constraints for the target architecture.

Our work therefore consisted in reasoning in terms of an architecture trajectory, rather than a brutal replacement.

A Strong Cybersecurity Dimension

The mission also included a detailed cybersecurity analysis.

We studied several dimensions:

• component obsolescence;
• risks linked to historical forks and divergence from upstream branches;
• application code quality;
• software dependencies;
• authentication mechanisms;
• network flows and exposed protocols;
• TLS/PKI management;
• patch management practices;
• test coverage;
• CI/CD pipelines;
• logging, audit, and traceability mechanisms.

In a critical messaging environment, technical debt can quickly become security debt. An outdated component, a custom integration developed without sufficient tests, an administration API too close to the database, or insufficiently controlled permissions can create both operational and cyber risks.

Our approach therefore consisted in constantly linking technical findings to their real-world impacts: vulnerability exposure, maintenance complexity, risk of administrative error, rollback difficulty, dependency on rare skills, and the challenge of ensuring a stable level of service.

Protocol Expertise Is Essential

Messaging and calendar systems rely on protocols that are old, powerful, and sometimes subtle.

A significant part of the mission consisted in analyzing the uses and limitations of protocols such as:

• SMTP / SMTPS;
• IMAP / IMAPS;
• LMTP;
• CalDAV;
• CardDAV;
• iTIP / iMIP;
• Sieve;
• LDAP / LDAPS;
• OIDC / OAuth2;
• Kerberos / GSSAPI;
• TLS / PKI;
• S/MIME.

These protocols are not interchangeable. Each carries its own logic.

An alias is not a sending identity. A shared mailbox is not merely a functional email address. An IMAP folder-level permission is not equivalent to an application-level delegation. A calendar share does not have the same implications depending on whether it is handled through CalDAV, a web interface, or a proprietary mechanism.

This detailed understanding is essential to avoid poor architecture decisions. It also helps explain clearly to stakeholders why some solutions are better suited than others to a given context.

An Independent Comparison of Alternative Solutions

We then conducted a comparative study of several alternative solutions, distinguishing between different approaches:

• integrated open-source groupware solutions;
• sovereign collaborative suites;
• assemblies of open-source components;
• vendor-backed solutions with professional support;
• platforms designed for service providers or operators.

The objective was not to produce a theoretical ranking, but to measure real alignment with the need.

The evaluation criteria included:

• functional coverage for mail, calendar, and contacts;
• shared mailbox management;
• calendar sharing and delegation;
• private event management;
• compatibility with existing frontends;
• SSO, LDAP, and PKI integration;
• multi-domain capability;
• administration and back office;
• backup and restore;
• observability;
• migration and coexistence;
• support model;
• sovereignty and reversibility.

This analysis showed that a good solution is not simply the one with the largest number of features. It is the one whose architecture, administration, and operating model truly match the target context.

The Central Role of Governance

A messaging modernization project cannot succeed through technology alone. It requires clear governance.

We therefore worked on the associated governance principles:

• definition of administration roles;
• separation between technical administration and functional administration;
• processes for creating, modifying, and deleting mailboxes;
• lifecycle management of shared mailboxes;
• delegations;
• naming rules;
• sending identity management;
• access control;
• change traceability;
• migration policy;
• decision criteria and scoring.

Governance is particularly important for shared mailboxes and delegated calendars. These objects are not merely technical; they reflect business responsibilities. Poor governance can lead to excessive access rights, loss of traceability, usage conflicts, or operational difficulties.

A Structured Transformation Approach

To frame the transformation trajectory, we applied a structured architecture approach inspired by TOGAF best practices: current state, business needs, requirements, risks, target options, trajectories, dependencies, decision criteria, and macro migration planning.

The objective was not only to identify a target, but to propose a realistic transformation path.

A successful modernization must take into account:

• operational constraints;
• service continuity;
• existing data;
• permissions and delegations;
• deployed clients;
• user training;
• support;
• cybersecurity requirements;
• migration windows;
• rollback scenarios.

This approach makes it possible to move from a product-centric view to a true transformation program.

The Importance of Communication and Pedagogy

Another key lesson from this mission is the importance of pedagogy.

The topics addressed were complex: legacy protocols, hybrid architectures, sovereignty, software debt, security, calendar sharing, multi-domain management, delegation, desktop clients, and mobility.

To enable informed decision-making, these topics had to be made understandable to a wide range of profiles: business stakeholders, architects, security experts, operations teams, decision-makers, and project teams.

We therefore produced matrices, diagrams, compliance tables, scoring grids, and executive summaries to compare solutions without hiding the complexity.

Our conviction is that good consulting does not consist in artificially simplifying a complex problem, but in making it understandable, manageable, and decidable.

A High-Value Mission for MAKEHITEC

This project perfectly illustrates MAKEHITEC’s positioning: supporting demanding organizations in areas where architecture, cybersecurity, and business understanding must move forward together.

We mobilized advanced expertise in:

• application and technical architecture;
• analysis of existing information systems;
• cybersecurity;
• messaging and collaboration protocols;
• IAM and identity federation;
• code analysis and technical debt;
• IT governance;
• solution comparison;
• transformation management;
• technical and executive communication.

This combination of expertise is essential when assessing a critical platform and helping an organization choose a robust, sovereign, and realistic trajectory.

Acknowledgements

We would like to sincerely thank ANFSI for its trust, the quality of the discussions, and the excellent collaboration throughout this mission.

The success of such a study relies as much on technical expertise as on transparency, listening, and the ability to challenge assumptions. The teams we worked with demonstrated great availability, strong command of their context, and remarkable commitment to identifying the best possible trajectory.

We also thank all the stakeholders involved for the richness of the discussions, the precision of the information shared, and the constructive spirit that guided the work.

Conclusion

Modernizing a highly critical messaging, calendar, and contacts platform is not about replacing one tool with another. It is an exercise in architecture, cybersecurity, governance, and transformation.

It requires understanding the existing environment, qualifying user needs, assessing risks, comparing solutions rigorously, anticipating migration, and building a trajectory compatible with business and operational constraints.

This mission confirms a strong belief at MAKEHITEC: the most sensitive modernization projects require an independent, structured, and pedagogical approach capable of linking technical choices to strategic challenges.

This is precisely where our expertise delivers its full value.