You already own the pieces. Now put them to work.
Bent Ear Solutions (BES) turns the ArcGIS and Microsoft 365 your agency already licenses into one operating picture, the Connected Framework. Your operations center gets live feeds, maps and Teams alerts in one view, built inside the systems your team already runs.
- Severe weather, field reports and power outages come in through a locked connection.
- Your data and the Connected Framework (ArcGIS and Microsoft 365) sit inside your environment.
- The picture goes out through sign-in to the operations center, command staff and field teams.
Select a part of the picture to read how it works.
- New software to buy
- Usually none
- Live feeds can need a real-time engine. BES assesses which licenses you need before any work starts.
- See who does what
- What your operations center gets
- Coordinated situational awareness
- Decision support tools that pull your systems together, so each person gets what they need when they need it.
- Follow one alert through the system
- Where it runs
- Your ArcGIS and Microsoft 365
- On your servers, in ArcGIS Online, or both.
- See the three deployment models
- How people sign in
- Your identity provider
- BES links sign-in to your directory with single sign-on (SSO) and MFA, and works with your security team so staff aren't signing in again and again.
- See the security controls
Every new platform is one more contract and one more system to run
Buying a common operating picture often means signing for another platform on top of the ones you already pay for. Your staff learn one more tool, and your IT team takes on one more system to support and defend.
The Connected Framework goes the other way. BES configures the platforms your agency already runs so they work as one system. The picture is built where your data lives today.
| A separate platform adds | The Connected Framework uses | |
|---|---|---|
| Cost | A new subscription on top of what you already pay for | The ArcGIS and Microsoft 365 licenses you have, plus BES's configuration work |
| Sign-in | Another set of accounts to create and review | Your identity provider, with your MFA and access rules |
| Your data | A copy in the vendor's cloud | Your data, where it lives now and in whatever form it takes For data you don't have yet, BES Data Services offers live feeds, such as power outages. See BES Data Services |
| Upkeep | One more system on your patch and monitoring list | BES reads the update notes so you don't have to, and checks item dependencies before patches go in |
| Ownership | Rented for as long as you pay, with an export project if you leave | Owned by your agency, for your team to change and build on, with nothing to export if you leave |
Everything BES builds stays yours
Every map, app, dashboard, alert rule and Teams workflow lives in your ArcGIS organization or your Microsoft 365 tenant as a standard item, owned by an account your agency controls. Your team can open it, change it or switch it off, and it keeps running without BES.
You decide how involved BES is. BES can do the work hands-on, or guide your team through each build so your staff can run and extend it on their own.
BES builds from components it has configured and tested at other agencies, so the parts your team maintains have run in other operations centers first.
BES also tracks what Esri retires and plans each move before it turns into an emergency. Two are on the calendar now. Web AppBuilder apps in ArcGIS Online stop working in 2027, and ArcGIS GeoEvent Server leaves ArcGIS Enterprise after release 12.3, with ArcGIS Velocity as its replacement.
Web AppBuilder is retiring. Your hazmat response tool might be, too.Read the postFollow one alert from the feed to a responder's phone
A severe thunderstorm warning crosses your county at 2 a.m. This is the path it takes through the Connected Framework, and the control that governs each step.
The warning arrives
The National Weather Service issues the warning. A connector your agency controls picks it up: ArcGIS Velocity, in your ArcGIS Online organization or on your own ArcGIS Enterprise, polls the feed over HTTPS and writes the warning to a live layer.
Your control: the connection runs outward from your side, so the feed provider gets no path into your network.
It meets your data
ArcGIS lays the warning over your own layers: shelters, hospitals, nursing homes and schools. The analysis runs inside your ArcGIS, against services published from your geodatabase.
Your control: published services stand between the apps and your database.
The warning crosses your alert threshold
Your operations center decides what counts. When a warning touches a hospital, ArcGIS posts an alert to the duty channel in Teams, through a Teams workflow or bot that your Microsoft 365 administrator allows.
Your control: a workflow or app your administrator allows, posting only to the channel you choose.
The watch officer opens the map
One tap on the alert opens the live dashboard. Microsoft Entra ID checks who is signing in, under the MFA and conditional access policies you apply to ArcGIS, and ArcGIS sharing decides which layers that person sees.
Your control: your identity provider at the door, and ArcGIS sharing inside.
Role-based access control gives each role its own view
A field supervisor and the public information officer can open the same app and see different layers. Layers are shared to ArcGIS groups, and your administrators decide who belongs to each group.
Your control: group membership, decided by your administrators.
Each alert is archived for historical analysis
The warning layer and the alert are archived in your systems, so your team can look back for after-action reviews and historical analysis. What gets kept, and for how long, is set up with your team. Sign-ins land in your Microsoft Entra sign-in logs, which you can export to keep past Entra's 7- or 30-day retention. In ArcGIS, the ArcGIS Online activity report or the ArcGIS Enterprise portal logs record sign-ins, role changes and sharing. ArcGIS Enterprise skips sign-ins at its default log level, so BES raises the level until they are kept.
Your control: archives and logs in systems your team monitors.
Six controls in that path: your connector, your published services, your Teams policy, your identity provider, your ArcGIS groups and your archives and logs. BES configured each one, and none of them runs on BES infrastructure.
These six flows match the picture at the top of the page. BES connects the other systems your agency runs too, and picks up new tools on every project.
See each connection in the picture
| Flow | Starts at | Arrives at | How it connects |
|---|---|---|---|
| Severe weather and hazard feeds | The feed provider | A live layer in ArcGIS | A connector your agency controls polls the feed over HTTPS: ArcGIS Velocity in ArcGIS Online or on ArcGIS Enterprise 12.1 and later, or GeoEvent Server on earlier releases |
| Power outage feeds | The outage data provider | A live layer in ArcGIS | The same connector pattern as weather feeds |
| Field reports | ArcGIS Field Maps or Survey123 on a responder's device | Feature layers in your ArcGIS | Submitted over HTTPS after the responder signs in, through your Web Adaptor entry point or mobile VPN when ArcGIS runs on your servers |
| Your records and GIS layers | Your enterprise geodatabase or hosted layers | Services in the Framework | Published as map and feature services |
| Alerts in Teams | Alert rules in ArcGIS | A channel in your Microsoft 365 tenant | A Teams workflow or bot your Microsoft 365 administrator allows |
| Maps and dashboards | ArcGIS | People who have signed in | ArcGIS sharing, roles and groups |
Your security stack, piece by piece
The Connected Framework does add a few things: connections to outside feeds, a Teams workflow or bot, and project accounts for BES. Each one sits under a control your team already owns, and each one is on the list your team approves before work starts.
| Area | The control you own | What BES configures |
|---|---|---|
| Identity | Microsoft Entra ID over SAML, or another SAML or OpenID Connect provider, with your MFA and conditional access | ArcGIS sign-in that trusts your provider, with one built-in administrator kept as a break-glass account |
| Access | ArcGIS roles, groups and sharing, plus Teams membership | Groups that match the jobs in your operations center |
| Network entry | ArcGIS Web Adaptor as the single entry point behind your web server, plus your VPN for anyone working remotely | Administrative access left off at the Web Adaptor, and a written list of the connections for your network team to approve |
| Data | Your enterprise geodatabase or ArcGIS Online organization | Services published from it, with the database credentials held by your administrators |
| Teams alerts | The Teams workflows and apps your Microsoft 365 administrator allows | Only the posting each alert needs, with webhook addresses stored like passwords |
| Offboarding | Disabling the account in your directory, plus your device management for offline maps on phones | Nothing extra: a disabled account can't start a new session, and open sessions end when their sign-in token expires |
| BES access | Accounts you create for the project, scoped the way you choose | All BES work runs through those accounts, and you can remove them at any time |
What BES doesn't ask for
- A copy of your data on BES servers. BES works on your data where it lives.
- Permanent administrator rights. Setup tasks such as single sign-on need admin rights for a while, so BES uses accounts you create for the task, and you remove them when it's done.
- Inbound firewall rules for the feeds BES polls. Your connector reaches out to them.
- Separate passwords for your staff. They sign in with the agency accounts they have.
See the path a new layer takes onto your servers
On ArcGIS Enterprise, a new layer takes four steps to publish, and the request enters through one controlled point.
- An analyst prepares the data and the map in ArcGIS Pro.
- The analyst shares it as a web layer. The request enters through ArcGIS Web Adaptor, the single entry point your web server exposes for ArcGIS.
- ArcGIS Server registers the service. It either reads data already in your enterprise geodatabase, for example in PostgreSQL, or copies it into ArcGIS Data Store, the database ArcGIS Enterprise keeps for hosted layers.
- ArcGIS Server returns a service endpoint, the address that apps, dashboards and alerts use from then on.
In ArcGIS Online, the same share creates a hosted layer, and there are no servers for your team to run.
How Kentucky Emergency Management put its pieces to work
Kentucky Emergency Management (KYEM) supports statewide emergency coordination across Kentucky's 120 counties. Its licensed incident management system slowed down once more than about 100 to 125 people were on it. During the COVID-19 response, with 150 to 200 people on it, requests for PPE and resources were lost, and the system's connector into ArcGIS overwrote and deleted records.
Instead of buying another standalone system, KYEM built on the ArcGIS and Microsoft 365 it already ran. Requests came in through Survey123 and were worked in ArcGIS. When one was approved, Power Automate told the public health warehouse. That approach became KERMIT, the redesign of KYEM's incident management system on ArcGIS, built to look and feel the same on quiet days and disaster days.
Working with Esri and CDR Maguire, BES turned KYEM's workflows into ArcGIS configurations, including dashboards and user onboarding, and gave surge support during several state disasters in 2025.
As Kentucky Emergency Management described it, Esri built the foundation, and BES helped remodel the house.
What KYEM has so far
- Request intake and approvals that hold up at scale during major activations, with each request traceable.
- One consistent experience across functions, so training takes less time.
- A scalable alternative to the legacy system, with more capacity and less reliance on costly crisis management licenses.
Deployable where your technology already lives
ArcGIS can run on your servers, in ArcGIS Online, or across both, and Microsoft 365 always runs in Microsoft's cloud. The Connected Framework works the same way on each. What changes is where the servers sit and how they connect.
Hybrid agencies usually have the hardest part done before BES arrives. Your on-premises directory already synchronizes to Microsoft Entra ID, so the Framework uses that existing link instead of adding a second one.
| On-premises | Hybrid | Cloud-only | |
|---|---|---|---|
| Pick this column if | ArcGIS Enterprise runs on your servers and signs people in through your own Active Directory | ArcGIS Enterprise runs on your servers and signs people in with Microsoft Entra ID | You use ArcGIS Online and run no ArcGIS servers of your own |
| Where GIS data lives | Your enterprise geodatabase, for example in PostgreSQL | Your enterprise geodatabase | Your ArcGIS Online organization |
| Live feeds | ArcGIS Velocity on ArcGIS Enterprise 12.1 and later, or GeoEvent Server on earlier releases | The same as on-premises | ArcGIS Velocity |
| Sign-in | On-premises Active Directory for ArcGIS, synchronized to Microsoft Entra ID for Microsoft 365 | Microsoft Entra ID with single sign-on (SSO), synchronized from your Active Directory | Microsoft Entra ID with single sign-on (SSO), on its own or synchronized from Active Directory |
| Entry point to ArcGIS | Your ArcGIS portal | Your ArcGIS portal | The ArcGIS Online sign-in page |
| How BES reaches your servers | Your VPN, with accounts you issue | Your VPN, with accounts you issue | No servers to reach: BES works in your ArcGIS Online organization with accounts you issue |
Whichever model you run, BES connects what you already have into one framework, so your data does more without a move or a major disruption to operations.
Scalable when everything happens at once
The system you approve has to hold on the worst night of the year, with the whole county logged in and every phone in the operations center ringing.
When everyone logs in at once
Capacity grows by adding servers or cloud capacity, and cached basemaps keep heavy maps fast for everyone who opens them.
When a feed goes quiet
Each feed has its own connection, so a feed that stops only stops updating its own layer. BES can set an alert for a quiet feed, so the operations center knows that layer has gone stale.
When a server or a site fails
On ArcGIS Enterprise, BES can set up a second machine for each component, so one can fail without taking the map down. Agencies that also plan for losing a data center can keep key layers in their own ArcGIS Online organization.
When minutes matter
Each feed is polled on a schedule matched to how often its source changes, and live layers and dashboards refresh on their own, so nobody reloads a page mid-incident.
Your team keeps the authority over what goes out
Your agency keeps the licenses, the data and the accounts. BES does the configuration work inside them, and nothing goes live until your team approves it.
| Area | Your agency | BES |
|---|---|---|
| Licenses | Holds the ArcGIS and Microsoft 365 licenses | Advises which ArcGIS user type each role needs |
| Servers and cloud | Runs the servers or cloud subscriptions | Sizes and configures ArcGIS on them |
| Identity and network | Approves each connection and permission before setup | Configures them and documents each one |
| Apps, dashboards and alerts | Approves what goes live | Configures and tests them |
| Training | Names the administrators and users | Trains both groups |
Your team signs off on every connection, permission and credential before work starts, and access follows each role, so what goes out is authoritative data.
Questions from your security review
How do we deploy secure, practical AI?
Start with the AI built into the platforms you already run. In Microsoft 365, Copilot and Copilot Studio let your team build its own agents or call in others, and they work under your tenant's identity, data protection and admin controls. Some Copilot features need added licenses. ArcGIS Online has AI assistants your administrators choose to turn on. BES can help you match the options to your security rules.
Does BES need access to our production database?
Not for day-to-day running. Apps read services published through ArcGIS, never the database. Connecting ArcGIS to your geodatabase needs one database account, which your administrators create and hold. During setup, BES works only through the accounts your administrators grant, and you can remove them when the work is done.
Does any of our data leave our environment?
Your records and GIS layers stay in your ArcGIS and Microsoft 365 systems, and in ArcGIS Online that means your own organization in Esri's cloud. What travels is the picture people need, such as a map or an alert, and only to people who have signed in. An alert posted in Teams is a copy, kept under your Microsoft 365 retention rules.
Do outside feed providers get any access to our network?
No. For a polled feed, a connector your agency controls reaches out over HTTPS and reads the data, so the provider never receives credentials or a way into your systems. If a provider can only push data, that is the one case that needs an inbound path: BES points it at an endpoint your network team approves, or at ArcGIS Online, where Esri hosts the receiving end.
What permissions does the Teams connection need?
Very few. ArcGIS for Teams is a ready-made app from Esri that your administrator adds to your Teams environment. Alerts need a single Power Automate Premium license. They post only to the channel you choose, through a workflow your administrators own.
Can our staff sign in with their Microsoft Entra ID accounts?
Yes. ArcGIS Enterprise and ArcGIS Online both accept Microsoft Entra ID sign-in through SAML 2.0, so people use the agency accounts they already have, and your MFA and conditional access policies apply when they sign in. BES also keeps one built-in ArcGIS administrator account, locked down, for the day sign-in itself has a problem.
How do field teams reach an on-premises ArcGIS Enterprise from their phones?
Through the single entry point your network team already controls. Single sign-on (SSO) through SAML and your Active Directory, together with your VPN, lets staff sign in securely from their phones. ArcGIS Field Maps can also work offline and sync when a device reconnects. BES puts the path your agency picks on the connection list for approval.
Do we need to buy new software?
Usually not. The Connected Framework is configured from ArcGIS and Microsoft 365, which most agencies already license. Some features need a specific ArcGIS user type or an add-on such as ArcGIS Velocity, and BES identifies those during the discovery call, before any work starts.
Bring your IT team to the first call
Every IT review I sit in circles back to one thing: what this opens up on your network. This page is my answer, one connection at a time. I taught wilderness medicine for years, and in the backcountry anything you carry has to do more than one job or it stays home. I hold every piece of the Framework to that rule. If you find a connection here your team can't account for, bring it to the call.
A Technology Discovery Call starts with the systems you run today. BES maps the Connected Framework onto them and walks your team through each connection and permission it would need.
Or email TechnicalServices@Bent-Ear.com
BES is an Esri Gold Partner and Service-Disabled Veteran-Owned Small Business (SDVOSB).