Inside Microsoft’s Information Technology Group

AS CORPORATE VICE president and CIO of Microsoft’s Information Technology Group, Rick Devenuti is responsible for Microsoft’s worldwide internal technologies infrastructure. Devenuti met with InfoWorld Test Center Director Steve Gillmor and News Editor Mark Jones to talk about his group’s relationship with the product development group, the acceptance of the Tablet PC, and his reaction to IBM’s on-demand initiative.

InfoWorld: How has your role as CIO of the Information Technology Group evolved?

InfoWorld: Does your group use the applications that Microsoft acquires or builds internally?

Devenuti: The [products from] Business Solutions groups, specifically the Great Plains and Navision acquisitions, are targeted to the middle and small/medium business markets. As an enterprise of 50,000 people, we don’t use those tools within our core enterprise business processes or systems. The Great Plains and Navision operations are still using their products, [but] in terms of the Microsoft core IT infrastructure, we consider ourselves an enterprise so we use enterprise products: SAP for the ERP system, Siebel for customer relationship, Firefly for support.

InfoWorld: We have a CTO at InfoWorld, and the Test Center tries to work with him to “eat our own dog food,” so the Test Center’s representations of technology reflect InfoWorld’s decisions about what technologies we use. Is that similar to your role?

Devenuti: Absolutely. It’s the job of my organization to ensure that not only are specific IT decisions appropriate but also that they fit within the overall environment of where we’re going as a company. One of our primary functions is to be Microsoft’s first and best customer, as you [say], “eating our own dog food.” We think we provide great value to our company and, more importantly, to our customers, by making sure the products work inside before we roll them out. We look at the product, we look at the features, we say, “Which of those features make sense to us from a business perspective?” and we implement. The islands of data which have plagued the industry, and certainly us as a company, are something that we’re working very hard to avoid going forward. More importantly, as we put in new things, [we] ensure that we’ve got interoperability.

InfoWorld: What interplay is there between the Product Development Group and your group, given that you’re potentially running beta clients most of the time?

Devenuti: We need to balance putting beta software in and running the enterprise. The process we use and the ability to get feedback to the product group [are key]. That relationship has evolved over the three years I’ve been in the [CIO] role [to] where today we’ve got a very structured process. From the product group side, I’m looking for a certain level of availability and reliability [in] deployment. If I don’t get the availability, productivity, [and] features that I was expecting, we stop deployment and the product group has to step up. We give them access to all of our availability [and] reliability issues. We often will leave a server down to have it debugged by a product group member if we can’t figure out what the problem is. It’s personal interaction, because it’s not just the bug [that’s important], it’s [also]: What was the pointer like? How easy was it to deploy? What kind of management issues are we running into? That [process] is much more interactive than it is automated. We’ve got a large database that pulls all our stats on every one of the servers we support, and we work with the product group to do reporting, etc. We do a lot of annotation. In fact, every time we drop a server, it has to be annotated so we can look at what happened there.

InfoWorld: Can you give an example of a product feature that was driven by your organization?

Devenuti: We like to think we have a part in every .Net product. I’ll give you a couple of examples that we’re very passionate about. XP on the desktop: You cannot log in remotely to an XP desktop; it has a blank password. That’s a feature we realized we needed in the product two and a half years ago when we were trying to tighten down the security. .Net Server 2003: [Version] 2.1X is in the box, and we’re currently piloting what we call “secure remote user” requiring smart cards and, with Connection Manager, a series of passes to make sure you’ve got the keys enabled for the current version before you come in. That’s been a combined effort between us, the .Net Server team, and our hardware provider.

InfoWorld: What about the 802 support? Did that come from your feedback?

Devenuti: When AirSnort got introduced on the Web, we realized our wireless WAN was not as secure as we thought it would be, and so we worked very quickly with the product group on our implementation. It was already in the client, [but] it wasn’t in the OS, and so we worked closely with them on what we needed on the OS, on the server side, in order to make that implementation seamless [and] to make it work with our wireless WAN vendor. Prior to that, we had planned on the physical security of our campus to be able to protect us. With AirSnort, at least in our engineering organization, one of the risks of being able to get that Web key moved from [a matter of] hours to minutes. We realized physical security was no longer a way to stop that. We went to 802.1x, and then we got rid of the universal Web key that was on every wireless device we had handed out in the company. And we’re using our PKI; we’ve got an internal PKI issuing [certificates] to do authentication.

InfoWorld: Don’t you have a rather ivory tower perspective, considering you’re dealing with a purely Microsoft environment and don’t have the heterogeneous issues other companies have?

Devenuti: Absolutely true. As I talk to customers, they occasionally bring that up. But on the other hand, when we did have a heterogeneous environment we were told it was because we weren’t enterprise ready, and that our products needed to support the enterprise. So I’m not sure what’s the best way to make that tradeoff. But it’s very true we don’t have to deal in our environment with the issues of interoperability between OS or database systems, because we’re a completely Microsoft shop. [However,] our test labs [and] our development organizations do support all types of operating systems and configurations [and] try and get at these issues. [As do] our customers, through either the joint development program or early adopter program, where we really do focus on the issues that [we] can’t focus on within our own IT environment. Through the early adopter program, we put resources to work with our customers to make sure we’re aware of what those issues are and solve them.

InfoWorld: What do you see as the “disruptive technologies” on the horizon that are going to change what CIOs have to deal with?

Devenuti: We [tend to] use the term “disruptive” as a bad thing. People think of wireless as a destructive technology, [but] we’ve been on the wireless WAN for [nearly] three years now. We’re using wireless WAN, using our current version of Exchange and the next version of Exchange, and as availability becomes higher and prices stabilize or go down, that will not be [seen as] a disruptive technology for the enabler of technology and productivity. SharePoint was a disruptive technology for us. We didn’t see that people wanted [it], so as a CIO I could say that was disruptive. I didn’t plan on figuring out how to monitor it and measure it and support it. [But] if the user community wants it, we better figure out how to get it in there and make it work. In the environment I live in, keeping people from being productive or creative or trying things is going to be impossible.

InfoWorld: Have you been incorporating Tablet PCs into your environment?

Devenuti: Not fast enough; based on availability. I have had to restrict my own access to one to make sure that everybody in the field who needs one gets them. I used one for a few weeks [and] I’m very excited about it. At Microsoft, it’s become part of the culture and you bring your [Tablet] PC to a meeting and certainly since we did the wireless LAN, [there’s] an increase. The ability to take notes in a much more natural way — that in and of itself, before the ability to annotate on memos or the PowerPoint presentation — I’m excited by it just by my two weeks of limited usage. As availability kicks in, I think in our environment you’ll see it replacing the notebook as a standard portable.

InfoWorld: Do you see it evolving the use of traditional notebooks? Because from what we’ve tested, you can still take notes faster on a keyboard than you can by writing.

Devenuti: There’s the pure-slate edition [of the Tablet PC] and then there’s what I think of as a convertible. I find I am a much better typist than I am a writer today — I don’t know if that’s true for everybody. I do know that when I go to a presentation, I get a PowerPoint handout and I take my notes on it. Then I’ve got the problem of how do I get those notes to the person I want to give them to? So for me, I look at [the Tablet PC] as a huge productivity gain. I’m not going to do e-mail on a plane in handwriting, which is why the slate edition is not where I personally would go. Other people might find that they want to go to handwriting, but I think the convertible is going to win. And I’ll use handwriting when I want to use handwriting and when the forum is appropriate for that.

InfoWorld: What is your reaction to IBM’s on-demand strategy, and what is Microsoft’s approach to this notion of software as a service?

Devenuti: If you went back three years you’d say everything’s moving to ASPs. For a large enterprise, for the specific business processes we run and the specific challenges of the business, I think it’s much harder to do [that]. If you say, “I think we can host a vanilla SAP environment,” how many CIOs would tell you they have a vanilla CRM or a vanilla ERP solution? Not many. In an environment as complex as mine, I don’t know that that makes sense. Are there services we can offer small/medium business end-users? Yes, I obviously think that software services have a future. In terms of on-demand to a large enterprise, I struggle with understanding what it is that we have that is straightforward enough that on-demand services can be there. Frankly, [I value] the ability to control my destiny, knowing that I can make changes when I need to.

InfoWorld: Do you see any technologies coming from Microsoft that will make it easier to customize applications done by business analysts, as opposed to Java developers?

Devenuti: The .Net frame allows us to do [that]. Internally [we] continue to use what our developers know, in terms of language, instead of [having to] teach them yet another language. Do I think you need to outsource the infrastructure because it’s so complex to run? No. The manageability tools we’re shipping today [and] the tools that are coming with a feature set for SMS [Systems Management Server] make [it] easier to keep your machine secure. The MOM [Microsoft Operations Manager] work we’ve done internally [is] coming out with applications that make management easier [and make] event flow more similar between applications. Are there advantages of outsourcing? I’ve talked to a lot of customers who have outsourced, and I understand why they do it and what good experience they’ve had and what bad experience they’ve had. Each company needs to look at that, based on how fluid they want their infrastructure and application base to be; how nimble they want to be able to make it work.

InfoWorld: Is project Jupiter going to have an effect on this?

Devenuti: Customers have made it clear that they want us to be a simpler partner to work with, to have a better view of our product road maps, and to have a better view and insight into our licensing as well as our product combination strategy. Jupiter is one of those areas where I do think bringing a series of value propositions at one time to the customer is going to be viewed as not only beneficial from a technology perspective, but also from a simplicity [standpoint] and understanding the business scenario that gets deployed with a single series of products, instead of having to buy the OS and then the content server, and then IIS on top of that.