TriNet moves to Microsoft 365 E5, achieves major annual savings in security spend

With a threat landscape that only grows in size and complexity, every industry and business must prioritize security to defend reputation, profitability, and viability. Leading HR solutions provider TriNet is no exception. The company had accrued various security solutions, each addressing specific aspects of security, such as data protection, cloud security, endpoint management, and email. TriNet’s security team and leadership sensed a need to streamline its security framework to reduce complexity and mitigate risks.

TriNet’s cluster of security solutions brought with it operational overhead, vendor management challenges, and variable visibility across the environment. “A key challenge was just managing all the different tools, with their own uniqueness, and then the different vendors and different support system—and when it came to renewal, different negotiations,” explains Di Demetrius, Director of Security Engineering and Identity Access & Management at TriNet.

Addressing the complexity

IT and the C-suite became aware of the growing inefficiencies and attendant risks of the existing security infrastructure. In response, TriNet Chief Security Officer Timothy Torres and his team began to look at how they could build an integrated risk-based strategy for the business, with an eye toward effectively optimizing value.

“In my mind, there's an equilibrium of optimal value,” says Torres. “And you never want to go past the point where you’re spending more than you’re getting, in terms of value and risk reduction.”

As the team reworked TriNet’s technology strategy and roadmap, they saw an opportunity to do more than simply modernize security—they can help future-proof it. The team realized that consolidating their security tech stack could better align the company’s security with its overall digital strategy. That would also reduce complexity and better steward funds allocated to security.

TriNet began to rigorously evaluate providers that were capable of delivering a platform to consolidate security solutions and comprehensively support strong protection across key risk points. The provider would also have to enable identity and access management, automate complex workflows, and enable governance across TriNet’s data estate.

“We worked with an implementation partner who came in and did a fit/gap analysis, examining the overall infrastructure, what kind of risks we were facing, what our tool sets were, and their capabilities, and then gave us an overview of solutions we might consider,” says Jimmy Espinosa, Senior Security Analyst at TriNet.

The fast track to helping future-proof security

Ultimately, TriNet chose Microsoft to modernize its security operations with the end-to-end, AI-first security platform built into Microsoft 365 E5.

Microsoft 365 E5 is an advanced Microsoft 365 enterprise subscription plan, offering a comprehensive blend of productivity and collaboration tools. But most important for TriNet, the platform includes advanced security features such as threat protection, identity management, and endpoint security. It also provides robust compliance and governance tools for data protection, insider risk management, and regulatory compliance.

“An important goal in our security transformation was reducing complexity. Microsoft 365 E5 gave us the opportunity to consolidate on a single vendor and a single platform, which was really attractive,” Demetrius says.

TriNet phased in Microsoft 365 E5 and Microsoft Azure over multiple quarters, timed with vendor renewals and prioritized rollouts. Today, Microsoft 365 E5 serves as the backbone of TriNet’s security infrastructure. It provides comprehensive visibility across endpoints, applications, servers, and cloud resources, delivering a powerful and connected solution.

Advanced threats meet advanced protection

The Microsoft 365 E5 solution’s conditional access policies and phish-resistant multifactor authentication play a critical role in preventing account takeovers and spear phishing attacks—and not just theoretically. Shortly after implementation, key TriNet executives were targeted in a spear phishing attack.

“An adversary used a trusted third party that had been compromised to go after us,” Torres explains. “The email had zero look and feel of an adversary—just an email from someone you know, talking about something you deal with them about every day, with a link that appears legitimate. It was a classic adversary-in-the-middle situation, attempting an account takeover.”

With Microsoft 365 E5 enabling Zero Trust across endpoints, infrastructure, data, and identity, what could have been a costly attack became a nonevent. “We shared the threat with our executive leadership team to highlight the value of the investments they’d green-lighted,” says Torres. “It made a pretty big impression.”

With the Microsoft 365 E5 implementation, automation became a cornerstone of TriNet’s security operations. Azure Logic Apps orchestrates incident response playbooks, reducing manual intervention, and enabling faster, more consistent reactions to threats. “After migrating, all logs and alerts were aggregated into a single interface, significantly reducing the time spent on threat review,” Espinosa reports.

Importantly, Microsoft 365 E5 provides integrated tools like Microsoft Purview Compliance Manager to assess and enforce regulatory controls, better protect sensitive data, and monitor AI usage. These capabilities help support privacy, security, and compliance while enabling responsible, AI-driven innovation.

Driving meaningful efficiencies for the business

Beyond the immeasurable value of stopping phishing attacks in their tracks, TriNet’s security transformation is also contributing to a meaningful reduction in phishing attempts. In addition, the company has dramatically improved its Secure Score and achieved a positive ROI on its Microsoft 365 E5 investment.

“Our adoption of the integrated security platform within Microsoft 365 E5 led to a significant reduction in mean time to detect and security incidents response, along with cost saving from tool consolidation,” says Torres.

Overall, the consolidation of security applications into the Microsoft ecosystem resulted in meaningful savings. “When we ran the numbers, we realized significant savings through consolidation and a long-term relationship,” Demetrius says. “There’s a hard data point on savings from our upgrade to Microsoft 365 E5.”

Operational improvements included increased productivity, automation, and reduced incident response times, with the team consistently meeting and exceeding SLAs. With advanced threat hunting and custom detection rules, the team can quickly identify and remediate threats, while ongoing automation has further decreased unnecessary alerts.

TriNet engineers and analysts also benefit from reduced alert fatigue, streamlined workflows, and the ability to focus on strategic initiatives. They hold weekly training and knowledge-sharing sessions, where they spend time building and refining detection rules, exploring new features, and teaching each other advanced threat-hunting techniques.

Torres reflects on the personal investment that security professionals make in their work: “In the security world, when you prevent a threat with the potential to seriously hurt your customers and your organization, it creates a sense of pride and excitement that what you set out to do is now your reality.”

An optimistic view of the future

Torres’s team views TriNet’s future-proofing journey with Microsoft 365 E5 as one of continuous innovation and end-to-end protection. By expanding passwordless authentication, piloting new capabilities like Platform SSO for Mac, and preparing for broader AI interoperability across the Microsoft 365 E5 suite, TriNet is building a secure foundation for the future of work.

TriNet’s experience represents a reliable framework for organizations seeking to transform their security operations for the long run. ”Microsoft is helping us implement our vision to use security technologies, processes, and skilled teams at scale to ensure technology is used safely,” says Torres. “We’re using it to protect our environment, and meet customer needs, while fostering innovation.”

Discover more about TriNet on Facebook, Instagram, LinkedIn, and YouTube.