Most conversations about Microsoft 365 "management" start and end with licences. Who has E3 and only needs Business Standard? Which leavers are still being paid for? Those savings are real, and worth having. But if that's all your management covers, you're optimising the invoice while leaving the business exposed.
Microsoft 365 is now where most organisations keep their email, documents, conversations and identities. It's the front door to the business. Managing it properly means treating it like the critical platform it is.
Why "set and forget" doesn't work
Microsoft 365 changes every month. New features arrive switched on, defaults shift, and settings that were right when a tenant was set up can quietly drift out of step with good practice. Meanwhile, attackers have noticed where the data lives.
1,205
data breach notifications to the OAIC in 2025, the highest on record
Source: OAIC
59%
of those caused by malicious or criminal attacks (716 of 1,205)
Source: OAIC
8%
more notifications than in 2024
Source: OAIC
Many of those incidents start the same way: a compromised account, a phishing email that got through, or a file shared more widely than anyone intended. Every one of those has a control in Microsoft 365 that can prevent it or limit the damage. The question is whether it's switched on and configured well.
Microsoft runs the service. You run your tenant.
It's a common assumption that because Microsoft hosts the service, Microsoft looks after the data. Under the shared responsibility model, Microsoft keeps the platform available and secure. How it's configured, who can access what, and whether you can recover your data on your own terms is the customer's responsibility. Microsoft's own Services Agreement recommends that customers regularly back up the content they store in its services.
Who looks after what in Microsoft 365
Microsoft
- Data centres and hardware
- Service availability and uptime
- Physical and network security
- Replicating data for resilience
You (and your IT partner)
- Who can sign in, and how (MFA, Conditional Access)
- How devices and apps are configured
- What is shared, with whom
- Backups you can restore from on your terms
- Licences, people joining and leaving
What proper Microsoft 365 management looks like
Microsoft 365 management, done properly
- Step 1
Health check
Identity, devices, email, sharing, licensing and backup reviewed in one pass.
- Step 2
Compare to a baseline
Each setting measured against a best-practice baseline aligned to the ACSC Essential Eight.
- Step 3
Remediate
Gaps closed in priority order, with change records so nothing is a surprise.
- Step 4
Monitor continuously
Alerts on risky sign-ins, configuration drift and policy changes.
- Step 5
Back up
Exchange, OneDrive, SharePoint and Teams backed up independently of Microsoft.
- Step 6
Report & optimise
Monthly reporting on security posture, licence use and cost.
- Then it starts again: continuous, not a one-off project
Start with a health check
A structured review of identity, devices, email security, sharing, data protection, backup and licensing. Not a scan that produces a 200-page report, but a clear picture of what's in place and what isn't.
Measure against a baseline, not an opinion
Every setting is compared with a documented best-practice baseline. For Australian organisations that means one aligned to the Australian Signals Directorate's Essential Eight, adapted for Microsoft 365. A baseline turns "is our tenant secure?" from a feeling into a measurement you can track over time.
Example health-check scorecard
Bar = how much of the baseline is in place · line on the right = the baseline
Fix the gaps in the right order
Phishing-resistant multi-factor authentication and Conditional Access usually come first, because identity is the most common way in. Then device compliance, email protection, external sharing and data loss prevention. Each change is planned and communicated, so staff aren't surprised by a new prompt on Monday morning.
Monitor continuously
Configuration drifts. New admins get added. Someone creates a forwarding rule to a personal mailbox. Ongoing monitoring catches risky sign-ins, policy changes and drift from the baseline, and acts on them before they become incidents.
Back up independently
Retention policies and the recycle bin are not backups. An independent backup of Exchange, OneDrive, SharePoint and Teams lets you restore a mailbox, a site or a single file to a point in time, whatever happened in the tenant, including ransomware, accidental deletion or a malicious insider.
Then optimise licences, with evidence
With a clear picture of how people actually use the platform, licence decisions become straightforward: right-size plans, remove what isn't used, and only add security add-ons where they close a real gap. And when you buy through us, you pay 10% less than Microsoft's price for the same licences.
Licence savings pay for good management. Good management is what protects the business.
Experience across regulated industries
We manage Microsoft 365 for organisations where getting it wrong carries real consequences: law firms, educational institutions, and financial services organisations from small advisory practices to larger institutions. The platform is the same; the priorities aren't.
- Law firms hold privileged, confidential client material. Our focus is tight control of external sharing, matter-based access, email security against invoice and settlement fraud, and backups that can recover individual files and mailboxes quickly.
- Educational institutions manage large, changing populations of staff and students, often on shared devices. Our focus is identity hygiene through enrolment cycles, safe collaboration in Teams, protecting student data, and keeping licensing aligned with real usage across terms.
- Financial services, from small practices to larger institutions, work under strict regulatory expectations for information security and operational resilience. Our focus is evidence: a documented baseline, monitored controls, tested recovery and reporting that stands up to an auditor or a regulator's questions.
A 15-person financial advisory practice
Phishing-resistant MFA, Conditional Access and independent backup are switched on in the first fortnight. A monthly report shows the principal exactly where the practice stands, in plain English, ready for licensee and insurer questionnaires.
A 120-person law firm
A health check finds broad external sharing and forwarding rules nobody remembered creating. Both are fixed, sharing is governed per matter, and continuous monitoring flags any new forwarding rule within minutes.
A 1,500-user education provider
Identity is cleaned up across enrolment intakes, licences are reassigned by role each term, and the tenant is measured against the baseline every month, so the board sees a trend, not a one-off audit.
The bottom line
Saving on licences is the start of the conversation, not the end. Organisations that treat Microsoft 365 as a managed platform, measured against a baseline, monitored continuously and backed up independently, are the ones that keep working when something goes wrong.
