Some of the caution not only makes sense but applies to Microsoft historically, not just under E5 licensing. One of the issues with the Microsoft ecosystem is not that it is too hard or impossible to do things the right way; it's just that it is much easier to do things the wrong way. The author's point about separation of duties for example - how often do we find an email administrator is some assistant/secretary in a business unit.
But I'm not sure the author offers a full solution. Suggesting that companies need to incorporate the "security team" in decision making, assumes you have such a team and they carry enough weight to undo the proposal with originated with a member of senior management of even the board. It's not a matter of getting the "security people" in the room. It's a matter of getting the people in the room to think of these things as part of the process. These are not complex concepts (separation of duties, compatibility, scalability, training). Security isn't being integrated into decision making because it is not being integrated into culture and leadership of companies. That's not happening because it isn't showing up in education. Someone can go from kindergarten through business school without ever being taught good computing habits. So when they get into decision making roles, they go with what they know or their gut - and that's usually some Microsoft solution that has a lot of gaps at the operational level - do you even have the right people and jobs to run this ecosystem?
