Microsoft 365 for business, designed as a system
Microsoft 365 is not just a mailbox subscription. It is a set of services that depend on identity, devices, DNS, permissions and licenses. We design it, migrate your data into it from other providers, and manage it over time, one component at a time but with the whole picture in view.
- Exchange Online and email
- Migration from other providers
- SharePoint design
- Licensing and security
- Identity
- Entra ID, MFA, Conditional Access
- Exchange Online, domains, DNS, Outlook
- Content
- SharePoint, OneDrive, Teams
- Devices
- device management and compliance
- Protection
- Defender, Purview, backup
- Licensing
- the right plan for each role
- Governance
- ongoing tenant management
Not every component is needed by every company: the choice starts from your requirements, not from the catalog.
01 The Microsoft 365 system
Microsoft 365 is an ecosystem: every service depends on something else
Email depends on DNS and identities, SharePoint on permissions, Teams on SharePoint and OneDrive, security on devices and licenses. That is why a Microsoft 365 project is drawn as a map, not as a list of apps.
From the top: business, users, Entra ID, MFA and access. Then three branches: Exchange Online with Outlook, SharePoint with content, Teams with collaboration. Below: OneDrive, devices, Intune, Defender, Purview, backup and recovery, governance.
- Business
- Users
- Entra ID
- MFA and access
- Exchange OnlineOutlook · email and calendars
- SharePointcontent and documents
- Teamscollaboration
- OneDrive
- Devices
- Intune
- Defender
- Purview
- Backup and recovery
- Governance
Confusing Outlook with Exchange Online leads to real mistakes: people "fix Outlook" when the problem is a DNS record, or migrate email and forget the calendars, shared mailboxes and permissions that live on the server.
02 Where to start
Eight common situations, and where each one begins
The requests we receive almost always start from a specific need. Each one leads to a type of project, and to the page that covers it in depth.
«I want to migrate my email from my current provider»
Migration to Exchange Online, covering DNS, identities and clients.
Email migration to Microsoft 365«I have a file server and I want to work in the cloud»
A data assessment and a SharePoint and OneDrive project.
SharePoint for business«I pay for a lot of licenses but I don't know if they're the right ones»
License analysis against roles, devices and security needs.
Microsoft 365 license optimization«I want to protect our accounts better»
Entra ID, MFA and Conditional Access policies.
Security and compliance in Microsoft 365«I want to manage our company PCs and laptops»
Device management with Intune, where the license includes it.
Users and devices with Entra ID and Intune«I need to organize documents and permissions»
Designing the information architecture in SharePoint.
SharePoint site creation«We already have Microsoft 365 but nobody manages the tenant»
A configuration review and ongoing management.
Microsoft 365 consulting«I need to know whether I need E5 for security or compliance»
A joint review of licensing and security requirements.
Business Office 365: the plans
03 The components
Ten components, read through the same seven questions
For each component: what it is for, what it interacts with, which decisions it requires, what it solves, what it does not solve on its own, how it fits into the tenant lifecycle, and what we do.
Exchange Online
- What it is for
- Email, calendars, contacts and shared mailboxes for the company.
- Interacts with
- Entra ID, domain DNS, Outlook, mobile devices, Defender, Purview.
- Design decisions
- Domains, shared mailboxes and groups, permissions, mail flow, retention, threat protection.
- Solves
- Hosted, always up-to-date email, accessible from any device.
- Does not solve on its own
- The quality of the DNS configuration (SPF, DKIM, DMARC) and an independent backup of the data.
- Lifecycle
- Migration, configuration, handling of joiners and leavers, policy review.
- What we do
- Migration from other providers, domain and DNS configuration, anti-phishing policies, user support.
Outlook
- What it is for
- The client users work with for email and calendars.
- Interacts with
- Exchange Online, devices, user profiles, add-ins.
- Design decisions
- Which version to deploy, profile configuration, smartphone access.
- Solves
- A single experience across PC, Mac, web and mobile.
- Does not solve on its own
- Problems that sit in the service, in DNS or in identities.
- Lifecycle
- Reconfiguration after the migration, updates, support.
- What we do
- Reconfiguring clients after the switch and post-migration support.
SharePoint Online
- What it is for
- The organization's content, documents and sites.
- Interacts with
- Teams, OneDrive, Entra ID and groups, Purview, search.
- Design decisions
- Information architecture, sites and hubs, libraries, metadata, permissions, external sharing.
- Solves
- Shared documents with versioning, permissions and search.
- Does not solve on its own
- The mess of the old file server, if it is copied over as is.
- Lifecycle
- Design, build, migration, governance, maintenance.
- What we do
- Designing and building sites, migrating from file servers and other platforms, permissions and versioning.
OneDrive
- What it is for
- Each user's personal working files.
- Interacts with
- SharePoint, Teams (files sent in chats), devices, Entra ID.
- Design decisions
- What stays personal and what goes into shared sites, sharing rules, sync.
- Solves
- Personal files available anywhere, with version history.
- Does not solve on its own
- Structured team collaboration: that belongs in SharePoint.
- Lifecycle
- Activation, migration of personal folders, handling when a user leaves.
- What we do
- Migrating personal data and sharing rules consistent with SharePoint.
Microsoft Teams
- What it is for
- Communication and collaboration: chat, meetings, channels.
- Interacts with
- SharePoint (channel files), OneDrive (files in chats), Microsoft 365 groups, Exchange.
- Design decisions
- Which teams to create, who owns them, external guests, team lifecycle.
- Solves
- One place to communicate and work on the team's documents.
- Does not solve on its own
- Document organization: every team creates a SharePoint site, which has to be governed.
- Lifecycle
- Controlled creation, access reviews, archiving of inactive teams.
- What we do
- Implementing and configuring Teams together with SharePoint and OneDrive, within the tenant's access rules.
Microsoft Entra ID
- What it is for
- Identity, authentication and access to all services.
- Interacts with
- All Microsoft 365 services, devices, third-party applications, on-premises Active Directory.
- Design decisions
- MFA, Conditional Access, administrative roles, sync with on-premises AD, guests.
- Solves
- A single, controllable identity for every user.
- Does not solve on its own
- Accounts without MFA or with excessive privileges: the rules have to be set.
- Lifecycle
- Joiners, role changes, leavers, privilege reviews.
- What we do
- Enabling MFA, Conditional Access policies, account management and offboarding.
Microsoft Intune
- What it is for
- Management and compliance of company and personal devices.
- Interacts with
- Entra ID and Conditional Access, Defender, Microsoft 365 apps.
- Design decisions
- Company-owned or personal devices, full device or app-only management, compliance requirements.
- Solves
- Uniform configurations and access allowed only from compliant devices.
- Does not solve on its own
- Devices left outside management, or policies that were never defined.
- Lifecycle
- Enrollment, configuration, updates, device retirement.
- What we do
- Assessing and setting up device management in projects where the license includes it.
Microsoft Defender
- What it is for
- Protecting email, devices and identities from threats.
- Interacts with
- Exchange Online, Intune, Entra ID, devices.
- Design decisions
- Which level of protection is needed, anti-phishing and anti-malware policies, who handles the alerts.
- Solves
- Filtering and detection built into the ecosystem.
- Does not solve on its own
- Alerts nobody reads and users who are not trained.
- Lifecycle
- Configuration, policy review, event handling.
- What we do
- Setting up the anti-phishing and anti-malware policies the license provides.
Microsoft Purview
- What it is for
- Information protection, retention and data loss prevention.
- Interacts with
- Exchange, SharePoint, OneDrive, Teams, sensitivity labels.
- Design decisions
- What to classify, how long to retain it, which data must not leave the company.
- Solves
- Retention rules and controls on how sensitive data circulates.
- Does not solve on its own
- A data backup: retaining data is not the same as being able to restore it at will.
- Lifecycle
- Defining requirements, configuration, periodic verification.
- What we do
- Configuring classification and data loss prevention compatible with the license.
Microsoft 365 Apps
- What it is for
- Word, Excel, PowerPoint and Outlook as desktop, web and mobile versions.
- Interacts with
- OneDrive and SharePoint, licenses, devices.
- Design decisions
- Which users need the desktop versions and which only need the web ones.
- Solves
- Productivity tools that are always up to date.
- Does not solve on its own
- The license choice: not every plan includes the desktop apps.
- Lifecycle
- Deployment, updates, removal when a user leaves.
- What we do
- Deployment coordinated with licenses and devices.
04 Exchange Online and business email
An email project is much more than mailboxes
Email is the most visible service, and the one where a mistake shows immediately: a message that doesn't arrive, a colleague who can no longer see a calendar, a domain that lands in spam. That is why we run it as a project, not as an activation.
A Microsoft 365 email project starts from the existing environment: which domains are in use, how many personal and shared mailboxes, which aliases and distribution lists, who has access to what, and from which devices email is read. From there we design the destination tenant and the path to get to it.
The least visible part is the one that matters most for message delivery: the DNS records. Microsoft notes that using only some of the email authentication mechanisms gives insufficient protection: SPF, DKIM and DMARC should all be configured, with DMARC moved gradually from monitoring to quarantine and reject.
Exchange Online retains data, but the recycle bin and retention have limited windows. That is why, in the same phase, we decide how to protect email with an independent backup.
What it can include
- Assessment of the existing environment
- Domains and DNS records
- Personal and shared mailboxes
- Aliases, distribution lists and groups
- Identities and permissions
- Authentication and MFA
- Security and anti-phishing policies
- Outlook clients and mobile devices
- Retention and archiving, where applicable
- Backup and recovery
- Mail flow
- SPF, DKIM and DMARC
- Cutover and post-migration validation
05 Migrating from another provider
Migrating email to Microsoft 365 from another provider
Migrating does not mean copying emails. It means moving identities, domains, shared mailboxes, permissions, calendars and users' habits, while keeping the business running during the switch.
| Source | Method | What to consider |
|---|---|---|
| IMAP provider | IMAP migration | Moves mail folders, not contacts, calendars and tasks: those have to be handled separately. The mailboxes must already exist in Microsoft 365. |
| Google Workspace | Automated migration from Google Workspace | Brings over email, contacts and calendars, with specific preparation on both sides. |
| On-premises Exchange, few mailboxes | Cutover | All mailboxes in a single pass, from Exchange 2003-2013; the technical limit is 2,000 mailboxes, but Microsoft describes it as reasonable up to about 150 users. |
| On-premises Exchange, larger environments | Hybrid | Coexistence between the on-premises server and the cloud, with mailboxes moved gradually. |
| Another Microsoft 365 tenant | Tenant-to-tenant migration | A method documented by Microsoft with a dedicated per-user license: we assess it case by case during the assessment. |
The migration process
- Discovery
- Source analysis
- Domain analysis
- Mailbox inventory
- Identity mapping
- Destination tenant design
- License assignment
- Security baseline
- Migration and sync
- DNS switch
- Client reconfiguration
- Validation
- Post-migration support
Cutover window
The moment the MX records change is chosen together, to reduce the impact on operations.
Coexistence
Where the source allows it, the old and new systems run side by side for as long as needed.
Rollback plan
When appropriate, we define in advance how to go back, and until when that remains possible.
Validation
After the switch we verify delivery, shared mailboxes, calendars, permissions and devices.
User communication
People need to know when it happens, what changes and who to contact.
Post-switch support
The first days are when profiles, rules and devices that need fixing come to light.
We don't promise migrations with "no interruption" or "no risk": timing and impact depend on the source, the volumes and the clients. A good plan doesn't remove risk, it reduces it and makes it predictable.
07 OneDrive, Teams and SharePoint
Three apps, one content store
OneDrive, Teams and SharePoint look like three separate places, but they share the same storage and the same identities. Understanding where a file ends up is the basis for deciding permissions and governance.
Microsoft 365 at the top, three branches: OneDrive for personal files, Teams for collaboration, SharePoint for the organization's content. Below, in sequence: content, identity, security, governance.
- OneDrivepersonal working files, and files shared in Teams chats
- Teamscollaboration and communication; channel files are stored in SharePoint
- SharePointthe organization's content and sites
- Content
- Identity
- Security
- Governance
08 Identity, devices and security
In Microsoft 365, identity is the perimeter
A tenant is almost always attacked through an account. That is why Microsoft 365 security starts at Entra ID and extends to devices, and it has to fit with the security of the rest of the infrastructure.
Security defaults
Free and on by default in new tenants: they require every user to register for MFA, always require it for administrators and block legacy authentication. They are the minimum, not the project.
Conditional Access
Rules based on user, application, device and location. Requires Entra ID P1, included in Business Premium and Microsoft 365 E3; risk-based conditions require Entra ID P2.
Administrative accounts
Kept separate from everyday accounts, protected with MFA, and limited to the bare minimum.
Managed devices
With Intune you manage the entire device or only the work apps, typical for personal devices.
Email protection
Defender anti-phishing and anti-malware policies, together with SPF, DKIM and DMARC.
Information protection
Sensitivity labels and data loss prevention, within the limits of the license.
Microsoft 365 on its own does not make a company compliant with NIS2 or other regulations: it provides tools that must be configured, documented and governed. We support our clients on the technical side.
09 Microsoft 365 backup
The recycle bin and retention are not an independent backup
Data in Microsoft 365 is available and redundant, but the native recovery windows are limited: deleted files stay in the SharePoint and OneDrive recycle bins for 93 days in total, and a deleted mailbox is recoverable for 30 days. Beyond that, or after a mistake nobody noticed in time, you need a backup.
| Tool | What it offers | Limit |
|---|---|---|
| SharePoint and OneDrive recycle bin | Recovery of deleted files | 93 days in total across the two recycle bin stages |
| File versions | Rolling back to an earlier version | Applies to a single file, not to a whole site at a specific point in time |
| OneDrive restore | Rolling an entire OneDrive back to a past point in time | Last 30 days |
| Deleted mailbox | Recovery of the mailbox | 30 days |
| Retention policies | Retention for obligations or policy | Designed to retain, not to quickly restore a given state |
| Dedicated backup | Independent copies with defined retention and granular restore | Has to be designed, monitored and tested |
We protect Exchange Online, OneDrive, SharePoint and Teams with Veeam Backup for Microsoft 365, delivered as a managed service, with defined retention and restore testing.
10 License optimization
Microsoft 365 license optimization: the right license for each role
We can supply your licenses, but the value lies elsewhere: working out which licenses you actually need based on users, roles, devices, security and requirements.
The model we use
- User
- Role
- Devices
- Applications
- Security requirements
- Compliance requirements
- Required features
- License
- Periodic review
| Question | When it makes sense | What to verify |
|---|---|---|
| Is Business Premium enough? | Often for SMBs: it includes Entra ID P1 with Conditional Access, Intune, Defender for Business, Defender for Office 365 Plan 1 and information protection features. | The 300-license limit, which applies to all Business plans in the tenant combined. |
| When should you consider E3? | Beyond the limits of the Business plans, or when you need Enterprise plan features and terms. | Which additional security components are needed, and whether add-on suites cover them. |
| When does E5 make sense? | Advanced security and compliance requirements: higher-tier identity and endpoint protection, advanced eDiscovery and audit, insider risk management. | Whether someone, in-house or external, will actually configure and run those features. |
| When is E5 oversized? | When its features won't be configured, or only a few users need them. | Whether it is enough to assign it to a subset of users or to use a targeted add-on. |
| When do you need add-on components? | When only one area is missing: Microsoft offers Microsoft Defender Suite and Microsoft Purview Suite for E3, and the "for Business Premium" versions for Business Premium. | Prerequisites and limits of each suite in the current Microsoft documentation. |
Plans, features and names change over time, including because of the offers with and without Teams: we check them against the current Microsoft documentation at every assessment. No plan is assigned to a person without first analyzing their role.
As a Microsoft partner we supply and manage licenses, but we always start by analyzing how they are used: periodic review is part of the service.
11 From another provider to Microsoft 365
Not just the mailbox: the full adoption path
When a company moves to Microsoft 365 from another vendor, email is only one of the things to move. The full path touches files, identities, permissions and the applications that depend on the old system.
The path
- Current provider
- Assessment
- What needs to be migrated?
- Files
- Identities
- Permissions
- Application dependencies
- Target Microsoft 365 design
- Licenses
- Migration
- Security
- Validation
- Tenant management
Application dependencies are the most often overlooked point: multifunction printers that send email, business software that sends invoices via SMTP, website forms that write to a mailbox, services that authenticate with email credentials. If they are not inventoried beforehand, they stop working on the day of the switch.
12 Tenant management
After the migration: who runs the tenant?
Many tenants start out well and then are left without an owner: departed users with the license still active, administrators without MFA, external shares nobody has ever reviewed.
Licenses
Assignment, review of actual usage, renewals and adjustment as headcount changes.
Joiners and leavers
Account creation, role changes, offboarding with handling of email and files.
Security policies
MFA, Conditional Access, email protection policies and reviews of unused accounts.
External sharing
Consistent external sharing rules across SharePoint and OneDrive, so documents aren't open to anyone with a link.
Updates
Security updates and tenant configuration looked after over time, together with licensing.
A single point of contact
Ongoing management stays with our lab in Melzo, with the same point of contact.
Microsoft 365 is one component of the company's infrastructure: identity, devices, network and backup must be designed together with the on-premises side.
From Aruba to Microsoft 365 for a consulting firm
A consulting firm asked us to move its email from Aruba, an Italian hosting and email provider, to Microsoft 365. The project involved three tools in the ecosystem, Exchange Online, Outlook and Teams, and a comparison of two migration approaches, assisted and self-service.
It is an example of this page's thesis: even when the request is "move the email", the work touches the service, the client, collaboration and the way people work after the switch.
We report only what the published case study documents: no mailbox counts, volumes or timelines that don't appear in it.
What it involved
- SourceAruba email
- DestinationMicrosoft 365
- ServicesExchange Online, Outlook, Teams
- Approaches evaluatedassisted and self-service migration
14 · Microsoft 365 assessment
Request a Microsoft 365 assessment
We start from how you work today, whether on your current provider or on a tenant that is already live. The result is a clear picture of what to migrate, how to configure it and which licenses you really need.
What it can include
- Current email environment
- Domains and DNS
- Identities and MFA
- Permissions and shared mailboxes
- File server and SharePoint
- Licenses and roles
- Devices
- Tenant security
- Backup
- Application dependencies
The scope is agreed at the start, based on the size and complexity of your environment.