Manage
Microsoft 365
Your firm runs on Microsoft 365: we administer the accounts, licences, Teams, SharePoint and Entra ID in your own tenant, to a written baseline, and keep it that way.
Your tenant, run as if it were ours. It stays yours.
For most firms with 30 to 150 people, Microsoft 365 is the IT: mail, files, Teams, the identity every sign-in runs through. It comes with hundreds of settings, and the defaults suit nobody in particular. We administer your tenant to a baseline decided with you and written down: one identity per person in Microsoft Entra ID, files organised by matter, client or project in SharePoint, Teams set up for how your teams actually work, licences sized to the people you have. Everything stays in your own tenant and your own subscription. We administer it; we don’t move it into ours.
What we administer
Set up once, to a baseline. Then kept there.
The baseline is written down, every change to it is on record, and what it looks like today is always in your documentation.
-
One identity per person
Every colleague has one identity in Microsoft Entra ID, granted and withdrawn in one place. Groups and roles decide what it opens, so a new colleague gets the same access as a colleague in the same role.
-
Files where the work is
SharePoint and Teams organised by matter, client or project, with access that follows the people working on it. Who may share what outside the firm is decided with you and written down.
-
Teams, built the way you work
Project teams, their channels and their mail, created the same way every time by script. Project mail stays in the team instead of flooding every member’s inbox.
-
The security baseline, administered
A second factor for everyone, conditional access, protected admin roles, managed devices only: decided with you, switched on in the right order and kept as set. Defend goes deeper on each layer.
-
Licences sized to your people
Microsoft licences bought and managed for you, matched to the people you actually have. A leaver’s licence is released, and the monthly report shows what you pay for.
-
Changes on record
A change to your tenant is planned, made by a script that checks first where one exists, and written into your documentation with the date. Admin access to make it sits in the vault, every use logged.
On record
In your documentation and the monthly report.
- Every account, group and role, and who holds admin rights
- The baseline as it’s set, and every change to it with the date
- Licences held against people, reviewed each month
- Where your data lives, service by service
The same records feed your evidence file, so an insurer’s or a client’s question about your Microsoft 365 gets a page, not a guess.
What we find in tenants we take over.
-
Everyone can open almost everything
Sharing switched on by default, files in private OneDrives, groups nobody reviews. It works until a client asks who can see their matter, or an AI assistant is switched on and shows it all.
-
Licences for people who left
Accounts disabled but never cleaned up, licences still paid for, mailboxes nobody owns. The invoice counts people the firm no longer has.
-
Admin rights for convenience
Global admin on an everyday account, a shared admin password in a spreadsheet, the old provider still holding a role. Exactly the accounts attackers want.
Also under Manage
- Service desk Every request lands with an engineer who can fix it, and stays with them until it’s fixed.
- Devices and workstations Every laptop and workstation built the same way, kept current and watched centrally.
- Joiners and leavers The right access on day one, gone on the last day, by script, so nothing is forgotten.
- Printers and plotters Office printers and large-format plotters deployed straight to the devices that need them.
- Licences and vendors Microsoft licences sized to your people, and one call for every vendor your IT depends on.
- The first 30 days Access secured, what we find documented, every system on the monitoring, then a welcome review.
Questions we get
Does our data stay in our own tenant?
Yes. Everything stays in your own Microsoft 365 tenant and your own subscription. We administer it with named admin accounts whose passwords sit in a vault, every use logged, and the tenant, the files and the admin access remain your firm’s.
Can you take over a tenant someone else set up?
Yes. We secure the admin access first, document what we find and bring the tenant to the baseline step by step, in an order that doesn’t lock anyone out. The old provider’s accounts, roles and delegated access are removed, with a written check.
Where exactly is our data stored?
It’s written down service by service in your documentation. Where a client or a mandate requires your data to be kept under particular rules, there are sovereign hosting options.
Do you buy the licences, or do we?
Either. Microsoft licences can be bought and managed through us, sized to the people you have and adjusted as people join and leave. If you buy them elsewhere, we administer them all the same.
Start
Who administers your Microsoft 365 today, and is it written down?
In a first call we go through how your tenant is set up today, who holds admin rights, what your licences cover, and what a written baseline would change.
- No first level
- No surprises
- Pilot before you buy