Microsoft 365 is usually bought in an afternoon and never revisited. Someone signs up, adds users as the team grows, and three years later nobody can say which licences are in use, whether multi-factor authentication is on, or where the company’s files actually live.
That is not negligence. It is what happens when a platform designed for enterprise IT departments is handed to a business that does not have one. Below is what a setup should cover, so you can check yours against it.
Licensing: the part most businesses overpay for
Microsoft sells several business tiers, and the difference between them is mostly security and device management rather than the apps themselves. Companies routinely sit on a tier that is more than they need, or — more often — one that is missing the protection they assume they already have.
A setup should start by counting actual users, identifying dormant accounts still being billed, and matching the tier to what the business genuinely uses.
- Ex-employee accounts still consuming a paid licence
- Shared mailboxes licensed as full users when they do not need to be
- Security features you are paying for and have never switched on
Email security, which is where the real risk is
Almost every breach a small business suffers arrives by email. The defaults in a fresh tenant are not enough on their own, and the gap is rarely visible until something goes wrong.
The baseline is multi-factor authentication on every account without exception, anti-phishing and impersonation protection tuned to your actual domain, SPF, DKIM and DMARC records published correctly so your mail is trusted and cannot be spoofed, and legacy authentication protocols switched off.
Where your files live, and who can reach them
The most common structural problem is not technical. It is that company documents are scattered across individual OneDrive accounts, which means they belong to individuals rather than the business. When someone leaves, the files leave with them.
A correct structure puts shared work in SharePoint or Teams with permissions set by role, keeps OneDrive for genuinely personal working files, and makes sure leaving the company is a five-minute offboarding rather than a scavenger hunt.
Devices, and what happens when one goes missing
If a staff laptop or phone were stolen this afternoon, could you wipe the company data off it remotely? For most small businesses the honest answer is no, and they find that out at the worst moment.
Device policy is the least exciting part of a setup and the one that matters most on the day you need it.
What we do
We audit what you have, tell you what is exposed and what you are overpaying for, and fix it in priority order. Ongoing support afterwards runs month-to-month with no lock-in, which means we have to keep earning it.
We are based in Sandton and work remote-first across South Africa, with onsite visits in the greater Johannesburg metro when a job genuinely needs someone in the room.