The first few weeks of a new organisation are a blur of small decisions. Someone picks an email address, someone orders the laptops and someone creates a shared folder because a file needs to go somewhere. None of it feels important at the time, which is exactly the problem, because each one becomes something other things get attached to. A year later you’ve got forty people, a pile of devices and thousands of files that all depend on how you set things up in week one.
Three of those early choices are worth slowing down for: who your people sign in as, which devices are allowed to hold your data, and where each kind of data lives. They’re cheap to get right at the start and surprisingly tedious to fix later. They apply whatever platform you choose, though the worked example here is Microsoft 365, because its plan contents are documented in enough detail to check. If you’re setting up a new organisation, our Startup services page describes how we work with them, and our Microsoft 365 and Azure page covers the Microsoft side.
Start with who your people sign in as
Your identity setup is the account each person uses to get into everything else, from email and files to chat. In Microsoft’s world those accounts live in a tenant, which is your organisation’s own space inside the service, holding your accounts, settings and data. The question is whether people sign in with accounts you own, under your own domain name, or with personal accounts and the odd shared login someone set up to save time.
Go for accounts you own, one per person. When somebody leaves, you can switch off their access in one place instead of asking them to hand over a personal account and hoping they do. It also keeps your files and subscriptions out of the hands of individuals, which matters the first time the person who signed up for something is on holiday, or gone.
While you’re at it, decide who gets administrator rights and keep the number small. We’d also keep a second administrator route, so that losing one login doesn’t lock you out of your own tenant. That’s our approach rather than a Microsoft requirement, and it needs storing somewhere safe. Then turn on multifactor authentication, the second proof at sign-in, for every account, starting with the administrators.
Microsoft 365 Business Premium is a useful example of what a plan can bring. As at June 2024, Microsoft’s documentation listed Microsoft Entra ID P1 as included (if you know it by the old name, Microsoft renamed Azure Active Directory to Entra ID) and allowed up to 300 licences, so if you expect to outgrow that, raise it with your supplier early. Check what each plan includes before you rely on it, multifactor authentication included, and switch it on from the first day wherever your plan allows. A good question for any supplier is a plain one: when someone leaves, who can remove their access, and how?
Then decide what’s allowed to hold your data
Laptops and phones are where your data ends up, so it pays to decide early which of them may hold it. You could own the devices, let people use their own or mix the two. In general terms, device management lets you set rules on a device and remove your organisation’s data from it, for example when a laptop goes missing. The fullest control needs the device to be enrolled, which is a small job on a brand new laptop. Enrolling dozens of devices that have been in use for a year means handling each one separately, and that’s the real cost of deciding late. The same Business Premium plan includes Intune (Microsoft’s device management service) and Defender for Business (an endpoint security product), and its subscribers are licensed to use the full Intune capabilities for iOS, Android, Mac and other cross-platform device management.
For a small organisation we’d lean towards company-owned laptops, enrolled before they’re handed out, and be stricter about phones only if they’ll hold anything sensitive. There’s a trade-off worth being honest about, though. Managing people’s personal phones raises privacy questions for them, so decide what you can and can’t see on a device like that, and tell people before you enrol it. If you’d rather the data never sat on a laptop at all, a cloud desktop is one way to do it.
Give every kind of data one home
Documents, email, finance records and, if it applies to you, source code or design files all need somewhere to live. For each one, write down where it is, who owns it, who can open it and how you’d get it back if it vanished. It doesn’t take long, and a shared folder created in a hurry rarely answers any of those questions.
Skip it and you end up with copies. Files drift onto personal laptops and drives, and before long nobody can say which version is current or who’s holding one. Recovery has its own post, our backup strategy guide, so we won’t repeat it here. One thing is worth asking up front, though: keeping files in a cloud service isn’t the same as backing them up, so find out what happens when a file is deleted or overwritten, and how far back it can be restored.
Before you place that first laptop order or set up your tenant is a good moment for a second opinion on these three decisions, since they get harder to undo with every month. If you’d like one, drop us a line.