Migrations that do not lose mail, licensing that fits the people you actually employ, and a tenant configured to be secure rather than merely switched on.
Microsoft 365 is the most common software subscription in small business, and it is also the one most often bought, switched on, and then left exactly as it arrived. Email works, so nobody looks further. Meanwhile the company is paying for SharePoint nobody uses, Teams calling nobody configured, security features nobody enabled, and licenses belonging to three people who left last year.
The gap between a 365 tenant that was set up and one that was merely turned on shows up in ordinary ways. Files live on somebody’s personal OneDrive and disappear when they quit. Mail from your domain gets flagged as spam by customers because SPF was never fixed after a hosting change. An account gets taken over because multi-factor authentication was optional. None of these are exotic failures. They are the default outcome of nobody owning the configuration.
We do the whole thing: the migration itself, the file structure, the licensing decisions, the security settings Microsoft leaves off, and the short training that determines whether people use any of it. Then we keep administering it, so the tenant does not slowly drift back into disorder as staff come and go.
We work with businesses across Murray, Calloway County, and western Kentucky, from four-person offices to companies with a hundred mailboxes and a decade of accumulated email nobody wants to lose.
What We Handle
From the first mailbox copied to the license you stop paying for when somebody leaves.
From Google Workspace, an aging on-premise Exchange server, or the POP mailbox your web host has been running since 2011. We copy rather than move, sync the bulk ahead of time, and do a final delta at cutover so the actual switch takes minutes and the old system stays available as a safety net.
Domain verification, MX and autodiscover records, SPF, DKIM, and DMARC configured properly the first time. Mail delivery problems six months later are almost always DNS decisions made carelessly on day one, so we do not make them carelessly.
Teams works well when somebody designs it and badly when it grows on its own. We set up channels that match how your business is actually organized, get meetings and calling working, and spend the time to show people the handful of features they will genuinely use.
A file structure with a clear rule: company files live in SharePoint, personal work files live in OneDrive. Permissions by role, version history on, and files that stay with the business when the person who made them moves on.
Multi-factor authentication on every account, conditional access rules, external mail forwarding blocked, administrator rights limited to the people who need them, mailbox auditing enabled, and alerting on suspicious sign-ins.
We license by role, not by whoever asked loudest. Shared and resource mailboxes are free, frontline plans exist for a reason, and licenses belonging to people who left last spring get reclaimed. This routinely pays for a chunk of the project.
Microsoft keeps your data highly available. That is not the same as backing it up, and their own service agreement says so. We add real backup for Exchange Online, OneDrive, SharePoint, and Teams so a deletion, a departure, or a ransomware event is recoverable months later.
A documented process for adding a new hire and, more importantly, for removing somebody: session revoked, license reclaimed, mailbox converted or delegated, and files handed to the right person rather than orphaned.
Licensing in Plain English
Microsoft’s plan names are not helpful and the comparison chart is worse. Here is how the three that matter to small businesses actually differ, and how we assign them.
Web and mobile apps only
Email, calendar, Teams, and the browser versions of Word, Excel, and PowerPoint. Genuinely fine for frontline staff who mostly need email and chat. Frustrating for anyone who lives in Excel.
The common default
Everything in Basic plus the installed desktop Office apps on up to five devices per person. This is where most office staff belong, and where most small businesses start.
Where the security lives
Standard plus conditional access, advanced phishing and link protection, device management, and data protection on phones. If you hold patient, client, or financial records, this tier is the one that makes compliance conversations easy.
The important part is that these are assigned per person, not per company. A ten-person business might run six Standard, two Premium for the owner and bookkeeper who handle money and sensitive records, and two frontline licenses for staff who only need email on a phone. Buying everyone the same tier is the most common way small businesses overpay Microsoft by a meaningful amount every single month.
Shared mailboxes such as info@, billing@, and sales@ do not need licenses at all up to a generous size limit, and we see them licensed unnecessarily on most tenants we inherit. That single correction has paid for the first month of managed IT more than once.
How a Migration Runs
Every mailbox, shared mailbox, distribution list, calendar, and file share gets counted, along with who needs what. Surprises during a cutover come from things nobody wrote down.
Tenant built, licensing assigned, security configured, and the bulk of your mail copied across days ahead of the switch while everybody keeps working as normal.
A final sync of new mail, then DNS flips during a quiet window. Outlook and phones get reconfigured, and the old system stays live behind us until we are certain.
Short, practical sessions on the parts people actually touch, then a follow-up two weeks later to fix the friction nobody predicted. This step is where rollouts succeed or quietly fail.
Security Defaults Are Not Enough
Microsoft has improved its out-of-the-box posture considerably, and security defaults on a new tenant now force multi-factor authentication, which stops the overwhelming majority of account takeovers on its own. That is real progress and it is still the floor, not the ceiling.
A stock tenant will happily let a compromised account forward every incoming message to an outside address, which is exactly how invoice fraud works: the attacker watches your mail quietly for weeks, then intercepts a real invoice and changes the bank details. Blocking external forwarding takes one policy and closes that entire attack.
We work through the full list on every deployment, and we can audit an existing tenant you already own. It pairs directly with our email security work and our broader cybersecurity services.
Microsoft’s own agreement recommends you keep third-party backups. Their job is uptime and replication; if a file is deleted or encrypted, it gets replicated in that state. Retention windows are short and unforgiving. See our backup and disaster recovery page for how we cover this.
FAQ
No. A migration done properly copies your mail rather than moves it, so the old system stays intact and running the entire time as a fallback. We sync the bulk of your mailboxes days ahead of the cutover, then run a final delta sync of anything new right at the switch, so the gap is minutes rather than hours. Folder structure, calendars, contacts, and shared mailboxes come across too. The one thing we ask for is a low-traffic window, which for most Murray businesses means a Friday evening or a Saturday morning.
Most small businesses land on Business Standard or Business Premium, and the deciding factor is security rather than features. Business Basic gives you email and the web versions of Word, Excel, and Outlook but no installed desktop apps, which frustrates people fast. Business Standard adds the desktop apps and is the common default. Business Premium adds the security and device management pieces that actually matter: conditional access, advanced phishing protection, device compliance, and data protection on phones. If you handle patient, client, or financial data, Premium is not a luxury. We size this per user rather than buying everyone the top tier, because a warehouse worker who only needs email does not need the same license as your bookkeeper.
They are three doors into the same storage, and confusing them is the single biggest reason 365 rollouts feel messy. OneDrive is your personal work drive, for files that belong to you. SharePoint is the shared drive, for files that belong to the company and should survive the person who created them leaving. Teams is a chat and meeting interface that stores its files in SharePoint behind the scenes. The rule we give people is simple: if somebody else would need this file when you are on vacation, it belongs in SharePoint, not OneDrive. Getting that boundary right at setup prevents years of "the file left when Dave left."
It is better than it used to be and still not where it should be. Microsoft now enables security defaults on many new tenants, which forces multi-factor authentication, and that alone stops most account takeovers. But a default tenant still allows automatic email forwarding to outside addresses, does not enforce device compliance, has no configured DMARC policy, keeps legacy authentication paths open on some setups, and gives global administrator rights far too freely. We harden all of it as part of any deployment, because a compromised 365 account is the most common way a small business ends up wiring money to a stranger.
Yes, both are routine. Google Workspace migrations bring across Gmail, Google Calendar, Contacts, and Drive content, with the main planning work being how shared drives map onto SharePoint sites. On-premise Exchange migrations are usually easier technically and more valuable practically, because they retire a server you are still patching, backing up, and eventually replacing. We also migrate from POP or IMAP mail hosted at a web host, which is the setup we see most often at older Murray businesses, and which almost always improves reliability and spam filtering immediately.
Yes. We manage licenses so you are not paying for people who left, adjust tiers as roles change, and handle the administrative work of adding and removing staff, which is where most businesses quietly lose money and leave security holes. Ongoing support is included in our managed IT plans, so mailbox problems, permissions, shared calendars, Teams issues, and the inevitable "I deleted a folder" requests go to somebody local who already knows how your tenant is set up.
Microsoft 365 sits at the center of most small businesses, which is why we manage it as part of our IT services in Murray, KY rather than as a one-off project. It connects directly to email security, backup, and managed IT.
Already on 365? We will audit your tenant for unused licenses, security gaps, and DNS problems, and give you the findings in writing whether or not you hire us.
Murray, KY 42071 • Serving Calloway County and western Kentucky
Ready to Transform Your Technology?
Let’s discuss how we can help streamline your IT infrastructure, improve security, and accelerate your business growth with our comprehensive technology solutions.
Ready to discuss your technology needs? Our team of experts is here to help you find the perfect solution for your business. Contact us today for a free consultation.
Phone
(270) 807-1000Service Area
Murray, KY & Western Kentucky — Remote Support Available Nationwide
Support Hours
24/7 Emergency Support
For urgent technical issues or emergency support, our team is available 24/7 to ensure your systems stay operational.