A new starter joins your London office on Monday. By Thursday they have a mailbox, sit in three Teams channels, share files in SharePoint and have downloaded the whole company's contacts to a personal phone. Nobody set that up deliberately \ 365 quietly made it possible. That is the double edge of Microsoft 365 (M365): it removes friction for growing teams, but the defaults rarely match the way a business actually wants to operate. This guide explains, in plain terms, how to pick the right licences, close the security gaps most firms leave open, back up your data properly, and manage the full user lifecycle from onboarding to offboarding.
Choosing the right Microsoft 365 plan
Microsoft's plan names look similar and change often, which is exactly why so many businesses over-pay or under-provision. The core split for most London SMEs is between the Business tier (capped at 300 users) and the Enterprise E tier (no cap, richer security and compliance tooling). Growing firms usually start on Business Premium because it bundles the Office apps, Exchange, SharePoint, Teams and \u2014 crucially \u2014 the security and device-management features found in Microsoft Intune and Entra ID.
The mistake we see most is buying the cheapest plan that includes email, then bolting on paid add-ons piecemeal as needs emerge. That fragmented approach usually costs more than Business Premium and leaves security features switched off. Conversely, some firms buy Enterprise E5 for everyone when only a handful of privileged users need its advanced protection.
A sensible approach is to profile your users. Frontline or shared-device staff may suit Business Basic or an F-series licence, most office staff sit well on Business Premium, and a small number of admins or high-risk roles may justify stepping up. If you are unsure how to map licences to roles, our Microsoft 365 support team can model the cost against what each group genuinely uses.
Security settings most businesses miss
Turning on Microsoft 365 is not the same as securing it. The platform ships with sensible-looking defaults, but several of the most important protections are either off, weak, or need deliberate configuration. The single highest-value control is enforced multi-factor authentication (MFA) for every account, including admins and shared mailboxes accessed by staff.
Beyond MFA, the settings that quietly matter are Conditional Access (restricting sign-ins by location, device compliance or risk level), disabling legacy authentication protocols that bypass MFA entirely, and configuring anti-phishing and impersonation policies in Microsoft Defender. Email remains the primary attack route, so pairing Defender with a properly published DMARC record closes a gap attackers rely on.
These controls work best as a documented baseline rather than a one-off toggle exercise. We typically pair M365 hardening with email security and managed DMARC so inbound threats and domain spoofing are handled together rather than in isolation.
- Enforce MFA on all accounts, prioritising admins and finance staff
- Block legacy authentication protocols such as IMAP and POP
- Configure Conditional Access to limit risky or unmanaged sign-ins
- Enable Defender anti-phishing and impersonation protection
- Review sharing defaults so files aren't openly shareable by accident
- Restrict global admin roles to the minimum number of people
Is Microsoft 365 secure by default?
The honest answer is: partly, and not enough for a business relying on it. Microsoft secures the underlying platform \u2014 the data centres, the infrastructure, service availability \u2014 and that side is genuinely robust. What it does not do by default is protect you from weak passwords, phishing, misconfiguration, accidental oversharing, or a user deleting the wrong folder.
This is the shared responsibility model, and it trips up growing firms constantly. Microsoft runs the service; you own how it is configured and how your people use it. A brand-new tenant with no MFA, no Conditional Access and default sharing settings is a soft target, regardless of how secure Microsoft's infrastructure is.
The practical takeaway is that \"secure by default\" describes the platform, not your deployment. Treating the initial Microsoft 365 setup as a security project rather than an IT chore is what separates a resilient tenant from an exposed one.
Why native retention isn't a real backup
This is the most common and most dangerous assumption we correct. Microsoft 365 has retention policies, a recycle bin and litigation hold \u2014 and none of these are a backup in the sense most businesses mean. They are designed for compliance and short-term recovery, not for restoring data after accidental deletion, a ransomware event or a malicious departing employee months later.
Deleted items typically leave the recycle bin after a set window (often 30 to 93 days depending on configuration), after which recovery becomes difficult or impossible. Retention labels can hold data, but restoring a specific mailbox or SharePoint site to a point in time \u2014 quickly, granularly, at scale \u2014 is not what native tooling is built to do. If an account is compromised and data is encrypted or wiped, native retention often will not save you.
A proper third-party backup takes independent, restorable copies of Exchange, SharePoint, OneDrive and Teams, with point-in-time recovery and retention you control. This is exactly what our cloud backup solutions provide, and it is the piece most firms discover they are missing only when they need it. The value is operational rather than cosmetic: it is about who can restore what, and how fast, when something goes wrong.
Managing users, devices and offboarding
As headcount grows, the messy part of Microsoft 365 is rarely the technology \u2014 it is the lifecycle. Who provisions a new starter, and to what standard? Which groups and licences do they get? When someone leaves, who removes access, converts the mailbox, and reclaims the licence so you stop paying for it?
Device management matters just as much. With Intune, you can require that only compliant, encrypted devices reach company data, wipe a lost phone remotely, and separate corporate data from personal data on staff-owned devices. Without it, company email and files scatter across unmanaged laptops and phones with no way to pull them back.
Offboarding is where accountability gets tested. A former employee whose account is simply left active is both a licence you are still paying for and a live door into your systems. A documented leaver process \u2014 disable sign-in, revoke sessions, secure the mailbox and files, reassign the licence \u2014 closes that door reliably. Strengthening this with identity protection ensures dormant and risky accounts are flagged rather than forgotten.
How managed IT keeps Microsoft 365 running well
Microsoft 365 is not a set-and-forget product. Microsoft changes features, defaults and licensing regularly, new security recommendations appear, and your own tenant drifts as staff create sites, share files and install apps. Left unmanaged, a tidy deployment gradually accumulates orphaned accounts, over-shared documents and unused licences.
Managed IT brings ongoing ownership: someone monitors sign-in risks, reviews configuration against a security baseline, handles licence true-ups, and answers the day-to-day \"my Teams won't connect\" tickets with a defined service level agreement (SLA). The point is accountability \u2014 a clear owner for the problem, whether that is your internal team, an outsourced desk, or a blend of both.
For firms with existing IT staff who need extra capacity or specialist M365 depth, a co-managed IT support arrangement often works better than fully outsourcing. Either way, the goal is the same: a tenant that stays secure, stays lean on cost, and stays available. If you would like a review of your current setup, get in touch and we can benchmark it against a sensible baseline.