Microsoft 365, secured to one standard and managed for you
We set up Microsoft 365 the same secure way for every client, look after it every month and show you exactly what has been done.
The challenge
Most businesses run Microsoft 365 on default settings
Microsoft 365 includes strong security and management tools, but many of them aren’t switched on by default. Without a clear standard, settings are decided once by whoever is there at the time, and rarely checked again.
The result is a setup that works day to day but isn’t protected the way you might assume, and nobody can show you what has actually been configured.
Sound familiar?
- Multi-factor authentication not enforced for every account
- Staff with admin rights they don’t need
- Laptops that aren’t encrypted or centrally managed
- Former staff who still have access to company data
- Paying for licences nobody uses
- No record of what has actually been configured
The Zenvia 365 Secure Baseline
One documented standard, applied the same way for every client and checked every month. It’s built on Microsoft 365 Business Premium and covers five areas.
Identity
Make sure only the right people can sign in, from the right places.
- Multi-factor authentication for everyone
- Conditional Access policies
- Separate, protected admin accounts
Devices
Company laptops set up and secured the same way, wherever staff work.
- Automatic setup with Windows Autopilot
- Encryption and security baselines
- No local admin for everyday users
Endpoint protection
Threat protection on every device, managed centrally.
- Microsoft Defender for Business
- Attack surface reduction rules
- Web filtering and USB controls
Email & collaboration
Stop phishing and keep files from being shared where they shouldn’t be.
- SPF, DKIM and DMARC
- Safe Links and Safe Attachments
- External sharing limits
Backup & operations
Keep everything in place, and recover quickly when something goes wrong.
- Separate Microsoft 365 backup
- Joiner and leaver process
- Monthly checks for changed settings
Documented and reported
Every setting is written down. Each quarter you receive a plain-English report showing what’s in place, what changed and what needs attention next.
Built for Australian businesses
Mapped to the Essential Eight
The Australian Cyber Security Centre’s Essential Eight is the benchmark many Australian businesses are measured against. The baseline is designed to support each of its eight strategies.
| Essential Eight strategy | How the baseline supports it |
|---|---|
| Multi-factor authentication | Required for every user through Conditional Access, with stronger sign-in methods for admin accounts. |
| Restrict administrative privileges | Separate admin accounts with only the roles they need, and no local admin rights for everyday users. |
| Patch operating systems | Windows updates managed and reported through Intune. |
| Patch applications | Microsoft 365 Apps kept current, and business apps deployed and updated through Intune. |
| Configure Microsoft Office macro settings | Macros from the internet blocked by policy. |
| User application hardening | Attack surface reduction rules and hardened browser settings. |
| Application control | Application control policies for businesses that need a higher level of protection. |
| Regular backups | A separate Microsoft 365 backup, with restores tested regularly. |
Your Security Assessment shows where you stand today. We don’t promise a maturity level before we’ve reviewed your environment. Learn more about the Essential Eight.
How it works
Assess
We review your Microsoft 365 setup, licences and devices against the baseline and the Essential Eight.
Deploy
We roll out the baseline in planned stages, with clear notes for your staff before anything changes.
Manage
We look after users, devices and settings every month, and fix anything that drifts.
Report
Each quarter you receive a report showing what’s in place and what comes next.
Microsoft 365 services
Start with a health check or an assessment, or bring us in for a specific project.
Security Assessment
A detailed review of your tenant with a scored report and a prioritised plan.
Secure Baseline
Our Microsoft 365 security standard, deployed and kept in place every month.
Setup & Migration
New tenants set up properly, and moves from Google Workspace or other providers.
BYOD & Mobile
Work email and files on personal phones, without managing the whole device.
Teams, SharePoint & OneDrive
A clear structure for files and teamwork, with sharing that stays under control.
Licence Optimisation
The right plans for the right people, and value from what you already pay for.
Also part of the service
Is it right for your business?
A good fit if you
- Already use Microsoft 365, or are moving to it
- Don’t have a dedicated security person
- Want it set up properly and kept that way
- Need to show clients or insurers how your data is protected
Probably not the right fit if you
- Only need occasional, one-off fixes
- Prefer to manage every setting yourselves
- Aren’t ready to change how sign-in and devices work
Already have IT staff?
We also work alongside internal IT teams and other IT providers on Intune, Conditional Access, Microsoft Defender and migrations, either as a project or as ongoing co-managed support.
FAQs
Frequently asked questions
Do we need Microsoft 365 Business Premium?
For the full Secure Baseline, yes. Business Premium includes Intune, Microsoft Defender for Business and Conditional Access, which the device and identity controls rely on. If you’re on Business Basic or Standard, we can secure what those plans include and explain what upgrading would add.
Will our staff notice the changes?
Mostly at sign-in. Staff will use multi-factor authentication, and some older apps may need replacing. We roll changes out in stages and give you simple instructions to share with your team beforehand.
Can you work alongside our current IT provider?
Yes. We can look after Microsoft 365 while they manage other systems, or work with your internal IT team on specific projects.
What admin access do you need?
We use named admin accounts protected by multi-factor authentication, with only the roles needed for the work. Access is documented and can be removed at any time.
Does this make us Essential Eight compliant?
No service can make a business compliant on its own. The baseline is designed to support the Essential Eight strategies, and your assessment report shows where you currently stand and what’s needed to reach your target level.
Can you move us from another email provider?
Yes. We plan and carry out email and file migrations to Microsoft 365, aiming to keep disruption to a minimum.
Does Microsoft back up our Microsoft 365 data?
Microsoft keeps the service running, but that isn’t the same as a complete backup of your data. We recommend a separate Microsoft 365 backup, which is part of the Secure Baseline.
Can you help our staff use Teams and SharePoint better?
Yes. We can set up a sensible structure and give your team practical guidance on sharing files and working together.
Find out how secure your Microsoft 365 really is
Answer 12 quick questions and we’ll send you a short summary of where you stand and what to fix first.