Microsoft 365 security baseline
The Microsoft 365 settings most small and mid-sized organizations should have in place, based on Microsoft's own guidance, with a checklist to work through.
Managed IT & Support
Microsoft 365 and modern workplace
Microsoft 365 lets your people work in a familiar Microsoft Office environment with broad compatibility and easy access from anywhere. We plan, migrate, secure and manage Microsoft 365, so the tools are configured properly, not just switched on.
Who this service is for
A good fit if
- You are moving email and files from on-premises servers or another platform to Microsoft 365.
- You already use Microsoft 365 but have never reviewed its security settings.
- Files are scattered across personal drives, shared drives and email attachments.
- New laptops take hours to set up, and staff wait for IT before they can start work.
- You pay for licences you are not sure you use, or lack the features you need.
Another approach may suit you better if
- Your organization has standardized on Google Workspace and is not planning a change.
- You need a single mailbox set up for a sole trader. Microsoft's own setup guides may be enough.
- You need a custom SharePoint application with heavy development. That is a software project, scoped separately.
What this service is
Microsoft 365 brings email, documents, meetings, file storage and device management together under one subscription. Even with modern cloud technology, your users keep working in a familiar Microsoft Office environment, with broad compatibility and easy access from any device.
The subscription alone does not make a secure, well-organized workplace. Default settings are rarely right for every organization, and many useful features are never switched on. We plan, migrate, secure and manage Microsoft 365 as a project or as part of managed IT services.
The Microsoft 365 tools we deploy and manage
- Exchange Online. Business email, calendars and contacts, with anti-spam and anti-malware protection. We migrate mailboxes from on-premises Exchange, hosted email or other platforms.
- SharePoint Online. Company document libraries and intranet sites, with permissions designed around how teams share information.
- Microsoft Teams and OneDrive. Chat, meetings, team files and personal storage, set up with sensible sharing rules.
- Microsoft Defender for Office 365. Protection against phishing, malicious links and harmful attachments. See also our email security service.
- Windows Autopilot. New devices configure themselves when a user signs in, so a laptop can be shipped straight to a remote worker.
- Microsoft 365 Apps (Office apps). Word, Excel, PowerPoint, Outlook and the rest, deployed and kept up to date.
- Windows 365. Cloud PCs that give staff a full Windows desktop from almost any device.
Depending on your licences, we also configure Microsoft Intune for device management and Microsoft Entra ID for identity and conditional access.
Security first
Most Microsoft 365 compromises start with a stolen password or a phishing email. Before we migrate any data, we put a security baseline in place: multi-factor authentication for everyone, limited administrative accounts, controls on external sharing, protection for email, and alerting for suspicious sign-ins. Our Microsoft 365 security baseline article describes the controls in detail.
Migrating without disruption
Moving to Microsoft 365, or between Microsoft 365 tenants after a merger or rebrand, touches every person in the organization. We migrate mailboxes and files in batches, synchronize data before the final switch so the cut-over is short, and update DNS records at a planned time. Users receive clear instructions beforehand: what will change, when, and what they need to do on the day. After each batch, we compare item counts and check that shared mailboxes, calendars and permissions work as expected before moving on.
Data location and Canadian obligations
Microsoft offers Canadian data centre locations for core Microsoft 365 services, which supports data residency. Where a specific tenant's data is stored depends on the service and on how the tenant was set up, so we verify it. We explain how your setup relates to PIPEDA and provincial privacy laws in technical terms; this is not legal advice.
Support after go-live
Once Microsoft 365 is running, users need help with sign-in problems, sharing, Teams meetings and mailbox issues. Our IT help desk handles these requests, and we review licences and security settings regularly as Microsoft adds features and changes defaults.
What is included
The exact list is agreed in writing for each project. These are the usual deliverables and the usual boundaries.
Typical deliverables
- A tenant review covering licences, security settings, sharing policies and data location.
- Migration of mailboxes, calendars and contacts to Exchange Online.
- File migration and structure design for SharePoint Online, Teams and OneDrive.
- A security baseline, including multi-factor authentication, conditional access where licensed, and Microsoft Defender for Office 365 policies.
- Device enrolment with Windows Autopilot and Intune, so new devices configure themselves.
- Microsoft 365 Apps deployment and update management.
- Windows 365 Cloud PC setup, where it suits the way you work.
- Licence optimization recommendations.
- User guides and short training sessions for staff.
Not included unless agreed separately
- Microsoft licence and subscription costs, billed by Microsoft or your licence provider.
- Recovering data already lost before we started.
- Custom software development on SharePoint or Power Platform, unless scoped separately.
- Legal advice on records retention or privacy obligations.
What we will need from you
Most delays in this kind of work come from access and decisions, not from the technical build. Knowing these early keeps the project predictable.
- Global administrator access to your Microsoft 365 tenant, or the ability to create one.
- Access to your current email system and file storage for migration.
- Control of your domain name's DNS records.
- A list of users, shared mailboxes and file owners.
- A contact who can approve security policies that affect how staff sign in.
Delivery
How the work is delivered
Each stage ends with something you can review before the next one starts.
Review and plan
We review your current tenant or email system, licences, data volumes and security settings, and agree the target setup.
Output: Tenant review and migration plan.
Secure the foundation
Multi-factor authentication, administrative roles, sharing rules and threat protection are configured before data moves.
Output: Security baseline report.
Migrate
Mailboxes and files move in batches, with users told what to expect and when.
Output: Migrated data and a migration report.
Enable devices and people
Devices are enrolled, apps are deployed and staff receive guidance on Teams, SharePoint and OneDrive.
Output: User guides and a short adoption review.
Testing and handover
- Security settings are compared with a documented baseline before and after migration.
- Mailbox and file counts are checked after migration to confirm nothing was missed.
- Break-glass administrative accounts are set up and secured.
- Licence assignments match what each user actually needs.
- Administrators receive documentation of every setting we changed.
What affects the cost
We do not publish package prices. Each estimate is based on an agreed scope, in Canadian dollars, with taxes shown separately. These are the things that move the number most:
- The number of users, mailboxes and devices.
- The volume of email and files to migrate, and where they are today.
- Which Microsoft 365 licences you hold, since security features vary by plan.
- The complexity of permissions and file structures.
- Whether devices are enrolled with Autopilot and Intune.
Questions buyers usually ask
Is our Microsoft 365 data stored in Canada?
Microsoft has Canadian data centre locations for core Microsoft 365 services. Where your data is stored depends on the service, when your tenant was created and its billing country. We check your tenant's actual data locations rather than assume, and we explain what that means for your privacy obligations in technical terms.
Does Microsoft 365 need to be backed up?
Microsoft keeps its service running, but retention settings and recycle bins are not the same as an independent backup. Accidental deletion, ransomware or a departing employee can still cause data loss. We usually recommend a separate backup, covered in our backup and disaster recovery service.
Can staff use Microsoft 365 in French?
Yes. Microsoft 365 apps and web interfaces support French and English, and users can choose their display language. We can configure language settings and provide guidance for bilingual teams.
What is Windows 365?
Windows 365 provides a Cloud PC, a full Windows desktop running in Microsoft's cloud that staff can reach from almost any device. It suits contractors, seasonal staff and people who work from many locations. It is licensed per user, so we compare the cost with physical devices first.
Related
Email security
Protect your mailboxes and your domain from phishing, impersonation and invoice fraud, with filtering, authentication and staff reporting.
24/7 IT help desk and service desk
Direct, organized IT support for your users, with clear priorities, tracked tickets and 24/7 cover for managed-service clients.
Getting the most from Microsoft 365?
Tell us what you use today and what you want to change. We will reply to arrange a conversation.