Managed IT
We set up, migrate, secure and support your tenant. In our view it isn't finished until MFA is enforced, sharing is controlled and admin accounts are separated.
01Who it's for
It suits organisations that run on Microsoft 365 or Google Workspace every day, whether they are changing platform or staying put and want it done properly.
02What's included
Set up & migrate
A new Microsoft 365 or Google Workspace environment set up correctly from the start: domains, email authentication, users, groups, shared mailboxes, Teams structure and file storage.
Email, calendars, contacts and files moved from Google Workspace to Microsoft 365, from Microsoft 365 to Google Workspace, or from on-premises Exchange or another tenant, planned to keep downtime low.
Administer
Mailbox, shared mailbox, distribution list and mail flow administration, plus a Teams and channel structure that matches how your organisation actually works, with owners and guest access agreed up front.
Sites, libraries and permissions designed so the right people see the right files, with external sharing set to a level you have agreed rather than left open.
We match each user to the licence their role needs and flag unused seats for removal, so you pay for what your staff actually use.
Secure
Windows, Mac and mobile devices enrolled in Microsoft Intune, with compliance policies, encryption, update rings and the ability to wipe company data from a lost device.
The protections a default tenant leaves for you to switch on, from MFA and conditional access to email authentication, macro controls and Microsoft Purview audit settings, applied and documented, then tracked over time with Microsoft Secure Score.
03In detail
A new Microsoft 365 tenant works straight away, but several important protections are left for you to switch on. Without SPF, DKIM and DMARC records, others can more easily send email that looks like it came from your domain. Office macro restrictions and other application settings follow the controls ASD prioritises, aligned with ASD Essentials. On Business Premium, we can also set up sensitivity labels and data loss prevention (DLP).
We document the settings we apply, so you have evidence for auditors, insurers and customers. For a deeper independent review of an existing tenant, see cloud and Microsoft 365 security.
Besides moving between Google Workspace and Microsoft 365, we move organisations off on-premises Exchange and between Microsoft 365 tenants after a merger or a change of provider. The step that most often gets rushed is the inventory: shared calendars, aliases and anything that sends email, such as scanners and business systems, go on the list before any data moves. The aim is a short, planned cutover rather than days of surprises.
It depends on how much security and device management you need. Microsoft 365 Business Premium suits many organisations with up to 300 users because it includes Intune and conditional access, which Business Basic and Business Standard don’t. Larger or regulated organisations may need an Enterprise plan. Paying for a cheaper plan and then buying add-ons can cost more overall than starting on the plan that includes what you need, so we recommend the plan that fits how your staff work, not the most expensive one.
Purchasing, renewals and true-ups are handled through our software licensing service, and ongoing administration can sit inside one of our managed IT plans.
Under Microsoft’s shared responsibility model, Microsoft runs the service, but protecting your data, accounts and devices remains your job. Our backup and disaster recovery service adds tested backups of your Microsoft 365 data, stored outside your tenant, so deleted or encrypted files can usually be recovered.
04The process
For an existing tenant, we review the configuration and security settings. For a migration, we inventory mailboxes, files and dependencies and agree a cutover plan.
We configure the tenant, apply the security baseline and test sign-in, mail flow and file access before anyone moves.
Data is copied in stages, then we switch email delivery and support your staff through the first days on the new platform.
We handle user changes, licences, policy updates and support requests through our helpdesk.
05Frameworks
Useful for your auditor, board or procurement team. The mapping shows where this service supports each framework. It doesn't replace a formal assessment.
| Control | ASD maturity model (current) | ISO/IEC 27001 | NIST CSF |
|---|---|---|---|
| Tenant security baseline | Not applicable | A.5.23, A.8.9 | Protect (PR.PS-01) |
| Email authentication and anti-phishing | Not applicable | A.8.7, A.5.14 | Not applicable |
| Purview retention and audit | Not applicable | A.8.15 | Not applicable |
| Office macro and app settings | Restrict Microsoft Office macrosUser application hardening | A.8.9 | Not applicable |
| Intune device compliance | Patch operating systems | A.8.1 | Not applicable |
06Pricing
Pricing*
Quoted for your environment
What changes the price
Migrations and new tenant setups are quoted as projects. Their cost depends on the number of mailboxes, the volume of data, the source platform and how many devices need enrolling in Intune.
Not included: a deeper independent security review of an existing tenant. That sits under cloud and Microsoft 365 security.
07FAQ
Can't see your question? Ask a specialist and get a straight answer.
Ask a specialistYes. We move email, calendars, contacts and files from Google Workspace to Microsoft 365, and we also migrate in the other direction for organisations moving to Google. We plan the order of the move, copy data in stages so the final cutover is short, and support your staff through their first days. Your new tenant is secured before anyone signs in.
A well-planned migration shouldn't lose email. We copy existing mail before the cutover, then switch where new email is delivered at an agreed quiet time, and run a final sync to catch anything that arrived in between. We test mail flow before and after the switch and check that each mailbox has moved completely.
A Microsoft 365 security baseline is a documented set of settings that closes the gaps in a default tenant. It typically covers MFA and conditional access, anti-phishing and anti-malware policies, SPF, DKIM and DMARC email authentication records for your domain, separate admin accounts, external sharing limits, macro controls and audit logging. We apply it, document it and check that it stays in place.
Yes. We review the existing configuration, confirm who holds global admin rights and list anything risky for you to approve before we change it. We set up least-privilege Microsoft partner access (GDAP) for our team, and can help you remove a previous provider's admin access when you ask. Documentation is updated as we go, so you know what your tenant looks like.
It depends mainly on the number of mailboxes, the volume of email and files, and how many shared drives and calendars need to move. Most of the time goes into copying data in the background while your staff keep working, so the cutover itself is short and planned. We give you a timeline with the quote, after an inventory of what needs to move.
Yes. We set up, administer and support Google Workspace, including Gmail routing and email authentication, shared drives and sharing settings, Calendar resources and Google endpoint management for staff devices. Account and access management follows the same process we use for Microsoft 365. If you are weighing up the two platforms, we can explain the trade-offs for your organisation before you commit.
Talk to our team
No obligation. You talk to the people who do the work. Enquiries usually get a reply within 3 business days.
