Zenvia 365 Secure Baseline
A documented Microsoft 365 Business Premium security standard, rolled out in planned stages and kept in place every month.
Why a standard matters
The same proven setup, every time
When each setting is decided case by case, gaps appear and nobody can say for certain what’s protected. A baseline means the same tested configuration for every user and device, written down and checked regularly.
It also makes change easier: new staff, new laptops and new offices all follow the same rules from day one.
What a standard gives you
- Consistent protection for every user and device
- Fewer surprises when staff join or leave
- Clear documentation of your setup
- Planned changes rather than reactive fixes
- Evidence of your settings when clients or insurers ask
Five areas, one standard
Every client receives the same baseline, adjusted only where your business genuinely needs something different.
Identity
Make sure only the right people can sign in, from the right places.
What’s configured
- Multi-factor authentication for every user, with stronger methods for admins
- Conditional Access to block older sign-in methods and risky access
- Separate admin accounts with only the roles they need
- Emergency access accounts, stored securely
- Self-service password reset
- A branded sign-in page so staff can spot fake ones
Devices
Company laptops set up and secured the same way, wherever staff work.
What’s configured
- Windows Autopilot so new laptops set themselves up
- Microsoft security baseline for Windows 11
- BitLocker encryption with recovery keys stored safely
- Local admin rights removed, with Windows LAPS for IT access
- Managed update rings for Windows and Microsoft 365 Apps
- Compliance policies so only healthy devices reach company data
Endpoint protection
Threat protection on every device, managed centrally.
What’s configured
- Microsoft Defender for Business on every device
- Attack surface reduction rules
- Web content filtering
- USB and removable storage controls
- Office macro settings hardened
Email and collaboration
Stop phishing and keep files from being shared where they shouldn’t be.
What’s configured
- SPF, DKIM and DMARC for your domain
- Safe Links and Safe Attachments
- Anti-phishing and impersonation protection
- Automatic forwarding to outside addresses blocked
- External sharing limits in SharePoint, OneDrive and Teams
Backup and operations
Keep everything in place, and recover quickly when something goes wrong.
What’s configured
- A separate Microsoft 365 backup, with restores tested regularly
- Monitoring of security alerts
- A documented joiner and leaver process
- Regular checks for settings that have changed
- A quarterly report on what’s in place and what’s next
How we roll it out
Assess
We review your current setup so we know what will change and who it affects.
Plan
We agree a staged rollout and prepare simple instructions for your staff.
Deploy
We apply the baseline in stages, testing as we go to avoid disruption.
Manage
We keep the baseline in place and report on it every quarter.
Choose your level of support
Every option starts with an assessment and the baseline rollout. Then choose how much ongoing help you need. Costs depend on your number of users and devices, so we’ll give you a clear quote.
Essentials
For businesses that want the day-to-day basics looked after.
- User, licence, joiner and leaver management
- Monthly baseline checks
- Microsoft 365 support during business hours
- A quarterly summary report
- Works with Business Standard or Business Premium
Recommended
Secure
The full Secure Baseline, managed for you.
- Everything in Essentials
- Intune device management and patching
- Microsoft Defender and email security managed
- Microsoft 365 backup with regular restore tests
- A full quarterly report, including Essential Eight progress
Secure Plus
For businesses handling sensitive client information.
- Everything in Secure
- Weekly baseline checks
- Data protection with Microsoft Purview
- Security awareness training for staff
- Security monitoring
- A quarterly review meeting
Microsoft licences are billed separately. Secure and Secure Plus require Microsoft 365 Business Premium.
FAQs
Frequently asked questions
Do we need Microsoft 365 Business Premium?
For the Secure and Secure Plus options, yes. Business Premium includes Intune, Microsoft Defender for Business and Conditional Access, which the baseline relies on. Essentials works with Business Standard too.
How long does the rollout take?
It depends on your number of users and devices. We roll out in stages and agree the timeline with you during planning.
Will it disrupt our staff?
Changes are planned and staged, and staff receive simple instructions beforehand. Most will notice multi-factor authentication at sign-in and little else.
Can we start with Essentials and move up later?
Yes. You can change your level of support as your needs change.
What if our business needs something different?
The baseline is our starting point, not a straitjacket. Where a setting doesn’t suit how you work, we document the exception and the reason for it.
Related services
You might also need
Security Assessment
Find out where you stand before the rollout begins.
Device Management
Laptops, phones and tablets managed and secured with Microsoft Intune.
Email Security
Protection against phishing, impersonation and malicious attachments.
Ready to secure your Microsoft 365?
Book a free consultation and we’ll recommend the right starting point for your business.