Microsoft 365 is one of the best investments a small business can make. For a fixed monthly cost, you get professional email, Word, Excel, Teams, cloud storage, and a suite of security tools — all in one place.
But setting it up properly is a different story. Many small businesses rush the setup, skip the security configuration, and end up with a system that’s messy, insecure, or underused.
This guide walks you through how to do it right.
Step 1: Choose the Right Plan
Microsoft 365 comes in several tiers. For most small businesses, Microsoft 365 Business Basic (£4.90/user/month) or Business Standard (£10.30/user/month) is the right starting point.
- Basic — web and mobile apps, Teams, Exchange email, 1TB OneDrive storage
- Standard — everything in Basic, plus desktop Office apps (Word, Excel, PowerPoint, Outlook)
- Business Premium — adds advanced security features; recommended if you handle sensitive client data
If you’re handling financial, legal, or health data, go straight to Business Premium.
Step 2: Set Up Your Custom Domain Email
One of the first things to do is connect your business domain (e.g. yourname@yourbusiness.co.uk) to Microsoft 365. This replaces any Gmail or Hotmail addresses your team might be using — which immediately looks more professional to clients.
To do this, you’ll need to update your domain’s DNS records. Your domain registrar (e.g. GoDaddy, Namecheap, 123-reg) will have a DNS management panel where you add the records Microsoft provides during setup.
If this sounds daunting, it’s one of the most common things we help small businesses with — it usually takes about 30 minutes.
Step 3: Create User Accounts
Add a Microsoft 365 account for each member of your team. Assign licences based on what each person needs — not everyone needs a full Business Standard licence if they only use email.
Set up a sensible naming convention from the start:
- firstname@yourbusiness.co.uk ✓
- john123@yourbusiness.co.uk ✗
Step 4: Enable Multi-Factor Authentication (MFA)
This is the single most important security step and it’s free.
MFA means that even if someone’s password is stolen, they can’t log in without a second verification (usually a code on their phone). It blocks over 99% of account takeover attacks.
Enable it for every user — no exceptions, including yourself.
In the Microsoft 365 admin centre, go to Security defaults and turn it on. It takes two minutes.
Step 5: Set Up OneDrive and SharePoint
Stop saving files to local desktops. Move everything to OneDrive (personal files) and SharePoint (shared team files). This means:
- Files are accessible from any device
- Automatic version history — you can recover deleted or overwritten files
- Built-in backup — no more relying on a single laptop or server
Create a logical folder structure in SharePoint from day one. Retrofitting a messy file structure later is painful.
Step 6: Configure Microsoft Teams
Teams replaces the need for most internal emails and keeps communication organised by project or department. Set up channels for different areas of your business (e.g. General, Projects, Finance) and encourage your team to use it consistently.
Teams also integrates with your calendar, SharePoint files, and external apps — making it a genuine productivity hub.
Step 7: Set Up Email Security
Out of the box, Microsoft 365 has decent spam filtering — but there are a few extra steps worth taking:
- Enable Microsoft Defender for Office 365 (included in Business Premium) for advanced phishing and malware protection
- Set up SPF, DKIM, and DMARC records on your domain — these prevent criminals from spoofing your email address to send phishing emails that appear to come from you
- Configure email retention policies if you need to keep records for compliance reasons
Common Mistakes to Avoid
- Skipping MFA — the number one cause of Microsoft 365 account breaches
- Not setting up a backup — Microsoft 365 is not a backup solution. Files deleted from OneDrive can be permanently lost after 93 days. Use a third-party backup tool like Veeam or Backupify
- Giving everyone admin access — limit admin rights to one or two trusted people only
- Ignoring the audit log — turn on audit logging so you have a record of who accessed what, useful for compliance and incident response
Need Help Setting It Up?
Microsoft 365 setup is one of the most common things we do for small businesses across the UK. We handle everything from DNS configuration and user setup to security hardening and staff training — usually in a single session.
Get a quote or browse our Microsoft 365 services to find out more.