Microsoft 365 for Business: Where to Start the Implementation?

Microsoft 365 for Business: Where Should You Start?

For small and medium-sized businesses, Microsoft 365 should not begin with buying licences. It should begin by answering a much more important question: what should the organisation's working environment look like, who should have access to data, from which devices, under what rules, and how will the company respond when something goes wrong?

Only then comes the time to choose licences, migrate email, configure Microsoft Teams, SharePoint and OneDrive, and secure identities, devices and data. Unfortunately, many companies do not follow this approach, which leads to major misunderstandings during security incidents and the false assumption that Microsoft was supposed to protect them, even though the licences they had were only Business Basic or Standard.

At Security Masters, this is exactly how we look at Microsoft 365. Not as an Office package with email, but as a central digital working environment for the organisation, containing users, communication, documents, devices, business data and security mechanisms.

If a company is at the beginning of this journey, the recommended order is as follows:

1. Understand the current state (Audit/Assessment): users, email, domains, data, devices, permissions and existing security controls
2. Design the target environment: before migrating anything.
3. Choose licences based on actual needs and risk, not the other way around.
4. Plan the email and data migration without moving old chaos into the new environment, or build the environment from scratch, depending on where the organisation currently stands. For environments already in operation, perform an audit and execute a remediation plan.
5. Secure identities, devices, email and data from day one.
6. Prepare users and the IT department for the current way of working.
7. Develop and monitor the environment after deployment, because Microsoft 365 is not and never will be a one-off project. It requires ongoing development and updates, just like any other IT solution. It is not a closed box, but a living environment that also needs to be monitored, assessed and fixed.

This approach is based not only on good practice. Above all, it comes from the experience we have gained during Microsoft 365 deployments, audits and the handling of real security incidents.

What is Microsoft 365 in the context of a corporate working environment?

For users, Microsoft 365 most often means Outlook, Word, Excel, PowerPoint, Teams and OneDrive. From a business perspective, however, it is much more than that.

Microsoft 365 is now a platform on which a significant part of an organisation can operate.

Microsoft Exchange Online handles email and calendars. Microsoft Teams supports communication and collaboration. SharePoint Online stores knowledge and team data. OneDrive provides users with a personal workspace. Microsoft Entra ID manages identity and access. Microsoft Intune enables device management. Microsoft Defender provides many threat protection capabilities, while Microsoft Purview supports information protection and classification.

These components do not operate independently of one another.

A single employee account may provide access to email, Teams, SharePoint documents, OneDrive, business applications and other services connected to Entra ID. An employee's computer may provide access to data from several departments. A Board member's mailbox may contain financial information, contracts, customer correspondence and data requiring special protection.

This is why Microsoft 365 security directly affects the security of the entire company.

This is one of the most important changes in how this platform should be understood.

Just a few years ago, deploying Microsoft 365 was associated mainly with email migration and the Office suite. Today, an organisation builds a digital working environment that includes identity, devices, data, communication, collaboration, security and access processes.

This is precisely why the question "which Microsoft 365 package should we buy?" should only be asked after the question:

"What working and security architecture does our organisation need?"

Microsoft 365 should be designed as one ecosystem

At Security Masters, we divide this ecosystem into several connected areas.

• The first is identity. This includes users, administrators, service accounts, authentication, MFA, Conditional Access, and the way permissions are granted and revoked.
• The second is devices. Computers and phones must be properly configured, updated and managed. In environments using Microsoft Intune, we can centrally deploy security policies, applications and device compliance rules.
• The third is data and collaboration. Teams, SharePoint and OneDrive need defined owners, sharing rules and a logical structure.
• The fourth is security - protection of email, accounts, devices and information, as well as the organisation's ability to detect an incident and respond appropriately.

If each of these elements is deployed separately, without one coherent architecture, a company may have many modern products and still retain serious organisational and security gaps.

Which companies are best suited to Microsoft 365?

Microsoft 365 works particularly well for companies that want email, documents, communication, collaboration, devices and user management within a single ecosystem.

This does not mean, however, that it is a solution only for large enterprises.

We often see the biggest change in organisations that have outgrown a simple IT model.

At the beginning, a company's email may be hosted by an external provider. Documents sit on a network drive. Access is granted manually. Computers are configured one by one. Users send documents to one another as attachments. With a few or a dozen people, this model may still work.

Then the company grows, new departments appear, there are more devices, remote employees, external collaborators, new projects and an increasing volume of data.

Someone leaves the organisation and their access must be revoked quickly. Someone wants to work from a phone. The finance department receives a message that looks like genuine correspondence from a real supplier. A customer starts asking about MFA, backup, information protection or compliance with security requirements.

At that point, the simple model is no longer enough. A well-designed Microsoft 365 environment allows these areas to be organised gradually, and not every company needs to deploy the most advanced mechanisms immediately.

At Security Masters, we support building security in stages. First, we create a stable foundation. We deploy further technologies when they solve a real business problem or reduce a specific risk.

For many small and medium-sized organisations, Microsoft 365 Business Premium can be a very good starting point. In our security model, depending on the organisation's risk level and needs, the architecture can be extended with Microsoft Entra ID Plan 2, phishing-resistant authentication using hardware security keys, and an additional layer of email protection. In more demanding environments, we develop the architecture further using the capabilities of higher Microsoft 365 plans.

The key principle, however, remains the same: the licence should follow the organisation's architecture and needs, not the architecture follow a licence purchased by chance.

Which areas should be planned before deployment?

A good Microsoft 365 deployment begins with understanding the current environment.

Before we create the first Conditional Access policy, migrate the first mailbox or create the first SharePoint site, we want to know how the company operates today.

What does email look like? Where are documents stored? How many domains are there? Who has administrator permissions? Are there accounts belonging to former employees? How does remote work operate? Which devices can access data? Which information is critical to the organisation's operations?

Only then can the target environment be designed responsibly.

Email and domain

Email is one of the most critical elements of a company's environment and, at the same time, one of the most commonly used attack channels.

This is why migration to Exchange Online should not consist only of copying messages from an old mailbox to a new one.

Before migration, we analyse domains, DNS records, users, aliases, shared mailboxes, groups, delegations, forwarding rules, archives and applications that use email.

Particular attention should be paid to mechanisms responsible for domain protection and email authenticity, including SPF, DKIM and DMARC.

The migration scenario itself is equally important.

Moving a few simple hosted email accounts is a completely different project from migrating from on-premises Exchange, a multi-domain environment or an organisation with large archives and complex permissions.

The cutover time, contingency plan, handling of historical email, and support for employees during the first hours and days after the change all need to be defined.

Email should also be secured from the start. Phishing protection, attachment and link controls, restrictions on dangerous forwarding, and the ability to report suspicious messages quickly should not be postponed until later.

In some projects, we use an additional layer of email protection beyond the mechanisms available as standard in Microsoft 365. The decision to use it, however, is based on the risk analysis and architecture of the specific client.

If a company is planning to change its current email system, preparing a migration to Microsoft 365 should be a separate stage.

Files, OneDrive, SharePoint and Teams

One of the most common mistakes is to treat file migration as simple data copying.

A company may have had a file server for many years. It contains old projects, folders belonging to former employees, duplicate documents, directories without owners and permissions granted on an ad hoc basis over many years.

Technically, everything can be moved, but why move the entire old problem into the new environment?

Before data migration, it is worth deciding which information remains active, which should be archived, who owns it and who should actually have access to it.

It is also important to understand the difference between services.

1. OneDrive is primarily the workspace of a specific user.
2. SharePoint Online should store team and corporate data that must not depend on a single employee's account.
3. Microsoft Teams is a communication and collaboration layer that uses, among other services, SharePoint to store documents.

A lack of this architecture quickly leads to situations where the same information exists in several places and the organisation does not know which version is current or who has access to it.

This is why, during deployment, it is worth planning the SharePoint structure, permission model, rules for creating Teams, workspace owners, external sharing and the lifecycle of teams and data.

More demanding organisations also need information classification, sensitivity labels, DLP, retention and restrictions related to data downloads or work on untrusted devices.

Data synchronisation must also be separated from Microsoft 365 backup. These are two different matters. The organisation should consciously define its data recovery model and know what will happen after accidental deletion, intentional deletion or a security incident.

Security and identity in MS365

User identity is now the digital key to the company.

A Microsoft Entra ID account can provide access to email, documents, Teams, SharePoint, OneDrive and business applications.

This is why identity protection is one of the first areas we design.

MFA is the foundation, but a modern approach to security cannot end simply with enabling an additional authentication factor.

Depending on the environment, we also use Conditional Access, separate administrator accounts, privilege restrictions, Break Glass emergency accounts, sign-in risk analysis and, for selected users and administrators, phishing-resistant authentication methods.

Access should be evaluated in the context of the user, device, application, location and risk.

This is where the practical Zero Trust model begins: we do not automatically assume that every sign-in is safe simply because the user knows the password.

Our incident experience shows why this matters.

In one case handled by Security Masters, a cybercriminal used a compromised mailbox belonging to a trusted business partner to send phishing messages that looked like legitimate correspondence. Some messages were detected by Microsoft Defender, while the rest were stopped by an additional email protection layer. One user, however, restored a message from quarantine and opened it, which triggered the full incident response process. A multi-person SOC and Microsoft 365 audit team then analysed the configuration, Exchange Online, user activity, administrator accounts and the potential impact of the incident.

In another environment we analysed after a cyberattack, an in-depth audit identified, among other issues, a compromised user account, the creation of email forwarding rules, access to mailboxes and data, the creation of an application and an active OAuth token, and indications of information leakage. No malware activity was detected.

This is an important lesson: the absence of a malicious file on a computer does not mean that the Microsoft 365 environment has not been compromised.

This is why security should be designed before an incident, not only after one has occurred.

Our own data also shows that since 2020, during Microsoft 365 diagnostic meetings, we have identified 309 active cyberattacks where organisations were unaware that an attack was already in progress.

If Microsoft 365 has been used in a company for some time and there is uncertainty about how it is configured, a sensible starting point is a Microsoft 365 Audit or a review of the Microsoft 365 security configuration.

Licences and costs - MS365 costs in your company

Licences are important, but they should not be the starting point of an architecture discussion.

The cheapest licence is not always the cheapest solution.

If separate tools later need to be purchased for device management, email protection, access control or security, the apparent saving disappears very quickly.

On the other hand, there is no point in buying the most advanced plan for every user if the company does not use its capabilities.

At Security Masters, we select licences based on user roles, working methods, the data users can access and the level of risk.

A field employee may have different needs from accounting, HR, the Board, or an administrator responsible for the entire environment.

In many projects, Microsoft 365 Business Premium is a very good foundation because it combines the working environment with security and device management capabilities. This does not mean, however, that it is automatically the right choice for every company.

In environments requiring advanced identity protection, we can extend the architecture with Microsoft Entra ID Plan 2. For privileged and high-risk users, we can use phishing-resistant security keys. In organisations with more complex regulatory and security requirements, Enterprise-class solutions may be the natural next stage.

The most important thing is to define the requirements first and then choose the technology.

The budget should also include not only the monthly licence cost, but migration, configuration, testing, documentation, training, backup, ongoing maintenance and further development of the environment.

Therefore, Microsoft 365 licensing advisory and licence selection should be part of the overall project, not a separate purchasing decision.

Deploy Microsoft 365 yourself or with an IT partner - what should you choose when considering MS365 licences?

Microsoft 365 can be deployed independently.

With a few users, a simple domain, a small amount of data and basic security requirements, some organisations will be able to configure it in-house.

However, two things need to be distinguished:

Microsoft 365 that has been switched on, and Microsoft 365 that has been designed.

On migration day, the difference may not be visible.

Email works. Teams starts. Users have licences. Files have been moved. Problems appear later.

An employee leaves the company and all of their access needs to be checked. An administrator needs unusually broad permissions "for a moment", which remain in place for years. More Teams are created. Nobody knows who is responsible for a particular SharePoint site. The company hires a new employee and prepares each device differently. The Board asks about the security level, but no one has a single view of the entire environment.

That is when it becomes clear whether the deployment was merely a service configuration exercise or the construction of an architecture.

A Microsoft 365 partner should not be needed simply to "click through the admin portal". Their value should come from experience that connects technology, security and business needs.

At Security Masters, our model begins with building the environment, but it does not end after migration.

1. The first stage is secure Microsoft 365 deployment: analysis, architecture, configuration, migration, securing users, data and devices, and preparing the environment for ongoing use.
2. The second stage is Microsoft 365 Concierge, which provides day-to-day care and development of the environment. We do not treat it as an ordinary helpdesk. Users receive support, the local IT department gains access to experts, and the Board receives recommendations for further Microsoft 365 development.
3. The third stage is Microsoft 365 Security Operations Center, whose role is continuous monitoring of security events, analysis of alerts and logs, identification of anomalies and recommendation of appropriate actions.

We call this model:

We Build. We Develop. We Protect.

It was created on the basis of many years of work with Microsoft technologies and experience gained during projects, audits and real security incidents.

Security Masters founder Damian Wróblewski has over 20 years of IT experience, previously worked at Microsoft in Poland and Ireland, and was awarded the Microsoft Most Valuable Professional title in the Microsoft 365 area.

At the same time, we do not replace the local IT team. Our role is to give it access to specialist expertise in areas such as Microsoft Entra ID, Intune, Exchange Online, Teams, SharePoint, OneDrive, Defender, Purview, architecture and Microsoft 365 cybersecurity.

The most common mistakes when getting started with MS365

The biggest problem in Microsoft 365 deployments is usually not a lack of available technology.

The problem is a lack of architecture and rushing.

1. First mistake: buying licences before defining requirements. The company starts by comparing Basic, Standard, Premium or E5 before answering what users need, which data must be protected and what level of risk is acceptable.
2. Second mistake: migrating the old environment one-to-one. Every folder, every account, every permission and every old habit is moved to the cloud. Microsoft 365 starts to look more modern, but organisationally the company still operates in exactly the same way.
3. Third mistake: treating MFA as the entire security programme. MFA is very important, but it does not solve every problem. Administrative roles, sessions, applications, devices, sign-in risk and access to data must also be controlled.
4. Fourth mistake: using privileged accounts for day-to-day work. A highly privileged account should be properly separated and secured. Compromising such an account has an incomparably greater impact than compromising a standard user account.
5. Fifth mistake: Teams and SharePoint without governance. If everyone can create new spaces without defined rules, owners and lifecycle management, the environment starts generating information chaos after just a few months.
6. Sixth mistake: no offboarding process. Removing a licence does not always close every access path. The organisation should have a defined process for blocking accounts, sessions, devices, data access, forwarding and other mechanisms associated with the user.
7. Seventh mistake: no realistic data recovery plan. The organisation should know how data will be recovered after a user error, deletion, failure or incident, and where retention and versioning mechanisms end and the need for an independent Microsoft 365 backup begins.
8. Eighth mistake: ending the project on migration day. Microsoft 365 changes constantly. People, devices, business processes and threats change as well. An environment that is not developed gradually drifts away from the organisation's needs.
9. Ninth mistake: overlooking users. Even very well-configured technology will not help if an employee restores a dangerous message from quarantine, does not understand the difference between OneDrive and SharePoint, or shares a confidential document with the wrong person. Training is therefore part of security, not a marketing add-on.
10. Tenth mistake: no single point of responsibility for the entire environment. One partner supplies licences, another migrates email, another secures devices, and yet another appears only after an incident. Each is responsible for their own part, but no one is responsible for the whole.

This final problem was one of the reasons we created our Modern Work + Security Microsoft 365 model.

Expert summary and recommended next steps

Microsoft 365 for business is much more than email, Teams and Office applications.

It is an environment in which employee identities, devices, communication, documents, customer data and many key business processes operate.

This is why deployment should begin with architecture, not licences.

If a company is only planning Microsoft 365, the first step should be to understand the current environment and prepare the target architecture. Licences can then be selected, email and data migration planned, security controls prepared and a deployment schedule created.

If a company already uses Microsoft 365, but the environment was built gradually, it is worth starting with a configuration review. Identity, MFA, Conditional Access, administrators, Exchange Online, Teams, SharePoint, OneDrive, devices, external sharing, backup and security logs are particularly important.

If there is a suspicion that the environment may contain a larger number of errors, or the organisation wants to understand its real security level based on data, we recommend a Microsoft 365 Audit.

At Security Masters, an audit is not a checklist of a dozen settings. We analyse the configuration and security logs, identify risks and vulnerabilities, and then prepare recommendations and an action plan. A comprehensive report can contain more than 200 pages of detailed analysis, with separate perspectives for the Board and the IT department.

If the organisation is ready for change, the next step is to plan a Microsoft 365 deployment and, if required, a migration to Microsoft 365.

The most important thing, however, is not to treat migration as the end of the project.

Microsoft 365 develops together with the organisation. New users, devices, applications, data, customer requirements, regulations and new cyber threats appear over time.

This is why our approach to Microsoft 365 can be summarised in three words:

We Build. We Develop. We Protect.

1. First, we create the right foundation.
2. Then we help the organisation develop the environment and support its users.
3. At the same time, we monitor its security and help respond to threats.

Because a secure Microsoft 365 environment is not a product that is purchased once.

It is a process that must be managed responsibly throughout the entire lifecycle of the environment.

Frequently asked questions

Where should a company start with a Microsoft 365 deployment?

Start with an analysis of the current environment: users, email, domains, files, devices, permissions, security controls and licences. Only on this basis should the target architecture and migration plan be prepared.

Does buying Microsoft 365 licences mean the environment is secure?

No. A licence provides specific capabilities, but the level of security depends on their correct configuration, the way users and devices are managed, data protection and the ongoing monitoring of the environment.

Is Microsoft 365 Business Premium enough for a company?

For many small and medium-sized organisations, it can provide a very good foundation. The final choice, however, should depend on the number of users, working methods, security requirements, devices, data and regulatory requirements. Some environments need additional solutions or higher plans.

Is migrating email to Microsoft 365 enough to deploy M365?

No. Email migration is only one part of the process. A full deployment may also include identity, Teams, SharePoint, OneDrive, devices, security, backup, training and ongoing administration.

Does Microsoft 365 need to be monitored after deployment?

Yes. Threats, users, devices and environment configuration change over time. Deploying security controls alone does not provide a full picture of what happens afterwards. This is why logs, alerts, anomaly analysis and a properly prepared response process are important.