Tenant hardening
Security defaults, Conditional Access, MFA enforcement, legacy auth off, risky OAuth apps revoked. Every tenancy we take on is brought up to a Cyber Essentials-aligned baseline in the first two weeks.
SERVICE · MICROSOFT 365
Microsoft 365,
Microsoft 365,
without the
admin tax.
Microsoft 365 managed services — Entra ID, Intune, SharePoint, Teams
Your tenancy, administered end-to-end by a UK team. Licensing sized to what you actually use. Teams, Exchange, SharePoint and OneDrive, hardened to Cyber Essentials and watched against misuse.
Business Standard
Business Premium
Enterprise E3 / E5
Non-profit tenants
01 / WHAT'S INCLUDED
The whole tenancy,
The whole tenancy,
under one roof.
Everything Microsoft 365 touches: identity, collaboration, storage, email and the licensing that ties them together. Administered, monitored, patched.
Licence optimisation
Quarterly licence review. Right-size subscriptions, remove orphaned accounts, consolidate duplicate add-ons, and check you're on the correct channel (NCE vs Enterprise Agreement).
Entra ID administration
Groups, roles, Conditional Access policies, device compliance, and guest access governance. Joiner / mover / leaver runs from a single form with full audit trail.
Exchange & email
Transport rules, anti-impersonation, DMARC / SPF / DKIM, shared mailboxes, distribution lists. Mailbox hygiene reviewed monthly against signs of compromise.
Teams, SharePoint & OneDrive
Governance for team sprawl, external sharing controls, sensitivity labels where needed, retention policies, and a sensible permissions model that doesn't leak.
Intune & endpoint
Device compliance, app deployment, encryption, and the conditional-access glue that ties it all to identity. Zero-touch rollout for new laptops.
Microsoft 365 backup
Retention is not backup. We layer immutable, off-tenant backup of mail, SharePoint, OneDrive and Teams with tested restores quarterly.
UK helpdesk
Your team emails / rings / chats a UK engineer who already knows your environment. CSAT is published monthly with every KPI.
02 / HOW WE RUN IT
From chaos
From chaos
to calm in
four weeks.
-
WEEK 01
Audit
Inventory every tenancy, licence, mailbox, group and policy. Written baseline of what you have, what's missing, and what's leaking money.
- Licence & SKU register
- Security posture score
- Risk & waste heatmap
-
WEEK 02
Harden
MFA everywhere, Conditional Access live, legacy auth off, risky forwarders removed, OAuth app clean-up. Everything documented.
- CA baseline rolled out
- MFA enforced
- DMARC / SPF / DKIM fixed
-
WEEK 03
Operate
We take the keys. Joiner / leaver runs through us, helpdesk goes live, monitoring starts feeding the SOC, backups are verified end-to-end.
- JML automation live
- Backup job verified
- Helpdesk walk-through
-
WEEK 04+
Optimise
Monthly plain-English report, quarterly licence review, continuous policy improvement. If we've done our job, you forget we're here.
- Monthly report
- Quarterly vCIO
- Roadmap on file
03 / THE OUTCOME
Predictable IT.
Predictable IT.
Happier people.
Tenancy hygiene is boring work, which is exactly why most SMBs skip it. Our clients stop skipping it, and the knock-on effects compound: fewer password problems, fewer lost files, fewer security incidents, a shorter day for the person who used to fix Outlook.
- ✓One accountable teamLicensing, identity, email, Teams, endpoint, one phone number.
- ✓Written SLAs, published CSATResponse targets in your MSA, CSAT in the monthly report.
- ✓Right-sized licencesSpend reviewed quarterly, not "renewed" silently.
- ✓Cyber-Essentials-aligned baselineEvery tenancy we manage is brought to CE baseline as standard.
04 / WHAT WE RUN ON
A stack that
A stack that
scales with you.
We standardise on the tools that work in production. No bespoke integrations to untangle later.
Microsoft 365
Entra ID
Intune
HaloPSA
Action1
NinjaOne
Huntress
SentinelOne
CrowdStrike
Addigy
Google Workspace
Azure
05 / FAQ
Questions
Questions
we hear a lot.
Do I need to sign a long contract?
No. We operate on rolling monthly terms after an initial 90-day stabilisation period so you can see the service working before any commitment. Nothing in our service model relies on locking you in.
Can you help us reduce Microsoft 365 licence spend?
Yes. Most new clients have 15–30% licence waste: duplicate subscriptions, Business Premium seats on accounts that only need Basic, unused Project or Visio add-ons, and orphaned mailboxes still being billed. We audit and right-size in the first month and review quarterly.
Will you replace our existing IT person?
Usually we become the whole IT function, but we also work alongside an in-house admin as their escalation point and after-hours cover. We're happy with either model, as long as responsibilities are written down.
Is our data UK-hosted?
Yes. All new tenancies we provision are UK or EU data residency by default. For existing tenants we verify the geo during onboarding and can initiate a migration if the region is wrong.
What happens if we want to leave?
You own your tenancy, documentation, runbooks and data. We hand everything back in a structured exit pack with zero egress charges. It's in the MSA in plain English.
RELATED SERVICES
Often runs with.
01
Microsoft 365 Migrations
Tenant-to-tenant, Google Workspace → M365, on-prem Exchange → Exchange Online.
Read more 02Backup as a Service
Retention is not backup. Immutable off-tenant backup for M365, endpoints and servers.
Read more 03Managed Security
Endpoint, identity, email, DNS and patch, watched by a 24/7 SOC.
Read more
NEXT STEP
A 30-minute audit.
A 30-minute audit.
That's the whole ask.
Send us a read-only admin role and we'll come back with one concrete recommendation for your tenancy, even if you never hire us.