Microsoft 365 for UK Small Businesses — Setup, Migration and Day-to-Day

Which plan do you actually need?

Business Basic (£4.90/user) — cloud-only, no desktop Office apps, fine for reception/warehouse staff. Business Standard (£10.30) — adds installable Office, right for most knowledge workers. Business Premium (£18.10) — adds Intune device management, Defender for Business and Azure AD Premium P1; the correct choice for any business that takes security seriously. If you're on Business Standard and complaining about security posture, upgrade to Premium — it's the single best-value SKU Microsoft sells. Prices ex-VAT, correct as of writing; check current pricing before quoting a client.

• Under 5 seats: Business Standard is usually right.
• 5–50 seats handling any client data: Business Premium, no argument.
• Frontline / shift staff: F1 or F3 licenses, much cheaper.

Day 1: the tenant setup checklist

Every new tenant we build gets the same day-one configuration. Skip any of this and you're building on sand.

• Custom domain verified (add SPF, DKIM, DMARC records at the same time — don't leave it).
• Break-glass admin account created, stored offline, excluded from Conditional Access.
• Security defaults ON if you're not doing Conditional Access; OFF (replaced by CA policies) if you are.
• MFA enforced for all users via Conditional Access.
• Legacy auth blocked (SMTP AUTH, IMAP, POP unless explicitly needed).
• Audit logging enabled (it's on by default on new tenants but confirm).
• Sensitivity labels defined even if you're not deploying DLP yet — future-proofs you.

Migrating without downtime

Coming from Google Workspace, IMAP or on-prem Exchange, the pattern is the same: (1) provision M365 users first, (2) run a pre-stage sync of mail/files while the old system is still live, (3) cut MX records over on a Friday evening, (4) run a delta sync over the weekend. The users log in Monday to a mailbox that already has everything. We've done this dozens of times — the two things that ruin it are shared mailboxes not being planned properly, and calendar recurring meetings from a decade ago. Both are handled if you plan for them.

• Pre-stage sync first, delta sync at cutover — never a single big-bang migration.
• Plan shared mailboxes and distribution groups as part of the design, not an afterthought.
• Communicate the cutover date and what changes for the user — the biggest complaint post-migration is 'nobody told me'.

SharePoint and OneDrive — the bit everyone gets wrong

OneDrive is for personal work in progress. SharePoint is for team files. If you use OneDrive as a file server (mapping it as a drive and dumping everything in) you'll hit the 100,000-file sync limit, then it silently stops syncing, and by the time anyone notices you've lost a fortnight's work. Build proper SharePoint sites per department, sync only the libraries each user actually needs, and turn on Known Folder Move for Desktop / Documents / Pictures.

• One SharePoint site per team, not one giant one.
• Known Folder Move ON for all users.
• Turn on 'always keep on this device' for critical local folders on laptops that leave the office.
• Retention policy configured — minimum 7 years for finance, minimum 6 for HR.

Teams: policies, meetings and channels

Two rules and Teams stays sane: (1) restrict team creation to owners/admins (otherwise you'll have 400 teams in 18 months), (2) archive completed project teams rather than delete — they take almost no space and you'll want the history when someone asks about a decision. Standard channels for open work, private channels for HR / finance / management, shared channels for external collaboration (better than guest access for regular partners).

Security baseline (the free stuff most people skip)

Even without Business Premium there is a lot of security in the base tier that most tenants aren't using. Turn it all on — it costs nothing and stops the most common attacks.

• Anti-phishing policy in Defender for Office 365 (impersonation protection for domain + key users).
• Safe Links + Safe Attachments (Business Premium and above).
• Alert policy for mailbox forwarding rule creation.
• External sender warning banners.
• Guest access reviewed quarterly.

Real-world monthly cost for a 10-person business

Ten Business Premium licenses at £18.10 = £181/month ex-VAT. Add a third-party M365 backup (Datto or Barracuda) at roughly £30/month for 10 seats. Optional: a phishing simulation platform like Usecure or KnowBe4 at ~£40/month. Total properly-configured cost: around £250/month for a 10-person business with genuine security posture. Compared to the cost of a single BEC incident (average £27,000 in the UK per Get Safe Online 2024) — this is not the expensive part.