Microsoft 365 can be central to a small business without being properly configured. Email may work while administrator access, file ownership and recovery arrangements remain unclear. A good setup starts with the way people work, then connects the right controls to those requirements.
Give every person a clear identity
Use individual business accounts for staff so access can be granted, reviewed and removed deliberately. Avoid passing one person’s sign-in around the office. Keep an account register with an owner, role and current licence assignment. It makes onboarding and offboarding easier and gives the business a clearer picture of what it is paying for.
For addresses such as accounts@ or reception@, a shared mailbox may be appropriate. Staff access it through their own permitted accounts rather than sharing its password. Microsoft says the associated shared-mailbox account should remain blocked from direct sign-in. Storage, advanced features and the accessing users’ licences still need to be checked.
Protect ordinary and administrator access
Enable multi-factor authentication using a suitable approach. Microsoft recommends security defaults or Conditional Access. Conditional Access supports more specific access rules where the relevant licensing is available; it needs careful design and testing so essential users and services are not accidentally locked out.
Administrative work should use appropriately restricted administrator access rather than giving everyone broad privileges. Document emergency access and recovery arrangements securely. The business should retain control of its tenant even when an external provider handles day-to-day administration.
Decide where business files belong
OneDrive is associated with an individual user’s working files. SharePoint provides shared libraries for team information, and Teams connects collaboration with the underlying Microsoft 365 services. These products work together, but they do not remove the need for an understandable filing structure.
Define shared locations around business functions, with permissions that reflect actual responsibilities. Explain where staff should save final documents, how they should share externally and who approves access. Avoid building the whole company filing system around one employee’s personal work area.
Include the devices people use
Account protection is only part of the environment. Decide how computers are enrolled, updated and protected, and how business information is handled on personal devices. Available device-management and security capabilities depend on the subscription and device platform. A licence should be chosen against a requirement rather than its name alone.
Record device ownership, encryption and recovery information where applicable. Plan how lost devices and staff changes will be handled before either event occurs. Configuration needs ongoing review as the business changes.
Separate file synchronisation from recovery planning
Synchronisation makes files available across locations; it can also synchronise deletions. Version history, recycle bins and retention features provide recovery options, but their scope and time limits matter. Do not assume every item is retained indefinitely or that every recovery scenario is covered.
List the information the business needs to recover, the acceptable loss of recent work and how quickly it needs access again. Compare those requirements with the configured native features and any backup service. Test a restore, document the result and assign someone to review failures.
Make staff changes repeatable
A short checklist should cover accounts, groups, applications, devices, mailbox handling and file access. Offboarding must also consider session access and the preservation of business records before accounts or licences are removed. Microsoft 365 administration works best as a maintained environment rather than a one-off installation.
Further reading: Microsoft shared mailboxes; Microsoft MFA guidance; Microsoft file collaboration; ASD backup and operational management.