Microsoft 365 & identity
Microsoft 365 & identity — set up properly, and secure from the first sign-in.
Most small businesses already pay for Microsoft 365. Far fewer have it set up well. Shared passwords on a shared mailbox, files scattered across personal OneDrive folders, no multi-factor sign-in, an admin account nobody can find the password for — we see it every week. We set up Microsoft 365 the way Microsoft intends businesses to use it: email, Teams and files organized around how you work, and sign-in protected so only the right people, on the right devices, get in.
The result
Your team works from anywhere, and only the right people get in.
Who it's for
This service is for any office that runs on — or wants to move to — Microsoft 365: medical and dental practices, accounting and law firms, retail and trade businesses, and startups. It suits you whether you’re setting up Microsoft 365 for the first time, moving from Google Workspace or an old email host, cleaning up a tenant that grew without a plan, or merging two offices into one.
It’s also for owners who have been told they need “Business Premium” or “Conditional Access” for cyber insurance or a client security review and want someone to explain what that means and set it up. Our comparison of Microsoft 365 Business Basic vs Standard vs Premium and the Microsoft 365 plan picker are good places to start.
- New businesses setting up email and files for the first time
- Offices moving from Google Workspace, GoDaddy email or another Microsoft 365 tenant
- Practices that need email and file sharing designed around HIPAA Security Rule safeguards
- Firms facing a client security questionnaire or cyber insurance renewal
- Teams whose files live on one person’s laptop or in personal Dropbox accounts
What's included
Tenant setup or clean-up
Your Microsoft 365 “tenant” is your company’s private space in Microsoft’s cloud. We set it up — or review an existing one — with your domain, admin accounts, security defaults, audit logging and naming conventions documented from day one.
Email migrations
We move mailboxes, calendars and contacts from Google Workspace, IMAP hosts or another Microsoft 365 tenant, with a planned cutover so email keeps flowing. We update your domain’s DNS records, including the email-authentication records below.
Multi-factor sign-in for everyone
Every account gets multi-factor authentication (MFA), preferably using the Microsoft Authenticator app or passkeys rather than text messages. Our MFA guide explains the options.
Conditional Access policies
With Conditional Access, sign-in rules depend on who you are, where you are and what device you’re using. For example: block sign-ins from countries you don’t work in, require a managed and compliant computer to open patient or client files, and block old sign-in methods that skip MFA.
Email security and authentication
We configure SPF, DKIM and DMARC so criminals can’t easily send email pretending to be you, and tune Microsoft’s anti-phishing and anti-malware filtering. Check your current records with our email security checker.
Shared mailboxes and calendars
Front-desk, billing and info@ addresses become shared mailboxes that several people can work from with their own sign-in — no more sharing one password. Room and equipment calendars set up where useful.
Teams and SharePoint organized around how you work
We design a simple structure: a Team or SharePoint site per department or function, with the right people in each and permissions that make sense. Files move off desktops and personal drives into a place that’s backed up, searchable and shared properly.
OneDrive and Known Folder Move
Each person’s Desktop, Documents and Pictures folders sync to OneDrive automatically, so a dead laptop doesn’t mean lost work.
Encrypted email where you need it
Microsoft Purview Message Encryption lets staff send encrypted email to patients or clients when required. See HIPAA-compliant email encryption.
Licensing done right
We match licenses to roles, remove unused ones and explain the difference between plans in plain English. Many small offices benefit from Microsoft 365 Business Premium, which adds Intune, Entra ID P1 and Defender for Business — but not everyone needs it.
Clean, documented admin access you own
Admin rights are limited to named people with strong sign-in, with emergency “break-glass” access stored safely. You own the tenant and the admin credentials — not us.
How it works
Review what you have
We look at your current email, file storage, licenses, admin accounts and security settings, and list what’s working, what’s risky and what’s wasted.
Design
We agree a plan with you: which plan(s) to license, how Teams and SharePoint will be organized, who needs access to what, and which security policies to enable.
Prepare
We create accounts, configure security, set up shared mailboxes and sites, and stage migrations in the background without disturbing current work.
Migrate and cut over
Mailboxes and files are copied ahead of time, then a final sync and DNS change happen at an agreed quiet time — often an evening or weekend.
Day-one support
We’re on hand for the first days after cutover to set up phones and Outlook, answer questions and fix anything unexpected.
Ongoing management
Under managed IT, we keep adding and removing users, adjusting access, watching sign-in alerts and reviewing settings as Microsoft releases changes.
For medical & dental practices
Microsoft 365 can be used in a way that supports HIPAA — but only if it’s configured properly and you have a business associate agreement in place. Microsoft offers a BAA covering its core business cloud services, including Exchange Online, SharePoint, OneDrive and Teams, through its standard online services terms. Signing up alone doesn’t make you compliant; how you set it up and use it matters. Our article Is Microsoft 365 HIPAA compliant? goes through the details.
For practices, we focus on the HIPAA Security Rule’s technical safeguards: unique sign-ins for every staff member (no shared front-desk logins), multi-factor sign-in, automatic sign-out, audit logs turned on and retained, encryption in transit and at rest, and access limited to the people who need it. Conditional Access lets us say “patient files can only be opened on practice-managed devices,” which is a big step beyond a password.
Email is where practices most often get caught out — referral letters and lab results sent unencrypted, or a phishing email that gives an attacker access to a mailbox full of patient information. We configure encryption so staff can send protected email with one click, set up data loss prevention rules where your plan supports them, and strengthen protection against phishing and impersonation. See phishing and business email compromise.
We also set up shared mailboxes for front-desk and billing so several people can work the same inbox with their own accounts — and when someone leaves, removing their access doesn’t mean changing a password everyone knows. More on our medical & dental page.
More on how we work with practices: IT for medical & dental practices.
Typical problems we solve
| The problem | What we do about it |
|---|---|
| Everyone shares one password for the front-desk or info@ mailbox. | Convert it to a shared mailbox that each person opens with their own account and MFA. |
| A staff mailbox was taken over and sent fake invoices to customers. | Reset and secure the account, check for malicious inbox rules, enforce MFA and Conditional Access, and turn on alerts for suspicious sign-ins. |
| Your emails land in customers’ spam folders — or criminals send email “from” your domain. | Set up SPF, DKIM and DMARC correctly and move DMARC toward enforcement. |
| Files live on desktops, USB drives and personal Dropbox accounts. | Move them into Teams/SharePoint with clear permissions, and sync personal folders to OneDrive. |
| You’re paying for licenses for people who left long ago. | Audit licenses, remove what isn’t used and right-size plans by role. |
| Nobody knows who the global admin is — or the admin is a former IT provider. | Recover and document admin access, remove unknown admins and give you ownership. |
| A client or insurer asked whether you use Conditional Access. | Design and roll out sensible policies in report-only mode first, then turn them on with no disruption. |
Tools we use — and what they do
- Exchange Online
- Microsoft’s business email and calendar service — what Outlook connects to.
- Exchange Online Protection & Defender for Office 365
- Filters spam, malware and phishing. Defender for Office 365 (included in Business Premium) adds link and attachment checking and impersonation protection.
- Microsoft Entra ID
- Microsoft’s identity system: user accounts, groups, MFA, single sign-on and Conditional Access. See Entra ID and SSO.
- Microsoft Teams
- Chat, meetings and calls, plus a shared workspace for each team’s files.
- SharePoint & OneDrive
- Cloud file storage. SharePoint holds shared company files; OneDrive holds each person’s own work files.
- Microsoft Purview
- Information protection tools: message encryption, sensitivity labels, data loss prevention (DLP) and retention, depending on your plan.
- Microsoft 365 admin center
- Where licenses, users and settings are managed — and where we keep your setup tidy.
Microsoft 365 & identity: frequently asked questions
Which Microsoft 365 plan do we need?
Business Basic gives web and mobile apps plus email and Teams; Business Standard adds the desktop Office apps; Business Premium adds Intune device management, Entra ID P1 (Conditional Access) and Defender for Business security. Try our plan picker or read the plan comparison.
Is Microsoft 365 HIPAA compliant?
Microsoft will sign a BAA covering its core business services, and Microsoft 365 has the security features HIPAA expects. But compliance depends on how you configure and use it — MFA, access controls, encryption, audit logs and staff training. More here.
Can you move us from Google Workspace?
Yes. We migrate email, calendars, contacts and files, and plan the cutover so you don’t lose email during the move.
Will we lose email during a migration?
Not if it’s planned properly. We copy data ahead of time and switch delivery at a quiet time. There may be a short window where new mail arrives in one place or the other, and we sync that too.
What is Conditional Access, in plain English?
Rules that decide whether a sign-in is allowed based on who, where, and what device — for example, “allow access to company files only from company-managed computers” or “block sign-ins from overseas.” It’s included in Entra ID P1, which comes with Business Premium. See Conditional Access.
Do we own our Microsoft 365 tenant?
Yes. The tenant, data and admin access belong to you. We work in it with delegated admin rights that you can remove.
Can staff use Microsoft 365 on their personal phones?
Yes, safely. With Intune app protection we can protect company data inside Outlook and Teams on personal phones without managing the whole phone, and wipe only company data if needed.
Do you help with Microsoft Teams phone calling?
Yes — see network, internet & phones.