Microsoft 365 · Managed service
Service group: Microsoft 365One accountable owner for your entire Microsoft 365 tenant
Microsoft 365 is now where your email, files, meetings, identities and devices live. Our managed service puts the whole tenant under a single written scope, so administration, security configuration, device management and change planning are handled by one team instead of whoever happens to have the admin password.
At a glance
- Service
- Recurring management of a Microsoft 365 tenant, covering administration, identity, devices, security configuration and collaboration services as scoped
- Best suited to
- Canadian organizations of roughly 5 to 200 employees that run their business on Microsoft 365 and want one provider accountable for it
- Core inclusions
- User lifecycle, licence oversight, Entra ID and sign-in policy, Intune device policy, Exchange Online, Teams and SharePoint administration, security configuration reviews and a tenant roadmap
- Not included by default
- Microsoft licences, migrations, third-party backup subscriptions, custom development and after-hours coverage unless written into the proposal
- Licensing
- Microsoft 365 licences are purchased separately unless they are written into your proposal; we advise on the plan mix but do not bundle licences by default
- Pricing basis
- Per user per month, proposed in the Microsoft 365 pricing calculator and confirmed in a written quotation after discovery
- How to start
- Book a consultation or begin with a Microsoft 365 Tenant Assessment, then review a written scope before onboarding
What Microsoft 365 managed services cover
Microsoft 365 managed services is our umbrella offer for organizations that want their tenant run as a single, coherent system. It brings together the work described on our narrower pages: day-to-day administration, Microsoft Entra ID identity management, Intune device management, Exchange Online, Teams and SharePoint support, and security configuration. Instead of buying each of those separately, you get one scope, one team and one roadmap.
The difference from ad-hoc support is ownership. We keep a documented baseline of how your tenant is configured, track changes against it, review Microsoft’s message centre for changes that affect you, and meet with you on a regular schedule to decide what should be improved next. When Microsoft retires a feature, renames a product or changes a default, someone is already watching for it.
This page describes the managed relationship as a whole. If you only need routine user and licence changes, see Microsoft 365 Administration. If your priority is hardening the tenant, see Microsoft 365 Security. If you want a one-time review before deciding, start with a Microsoft 365 Tenant Assessment.
Problems a managed tenant solves
Most small and mid-sized tenants were set up quickly and then left to grow on their own.
The tenant grew without a plan
Licences were bought as people joined, Teams and SharePoint sites multiplied, and nobody can explain which settings were chosen on purpose and which are defaults from years ago.
Too many people hold Global Administrator
The original reseller, a former employee and two managers all have full rights. Nobody reviews who can change what, and admin accounts are used for everyday email.
Paying for features you are not using
You may already own Intune, Entra ID P1 or Defender for Business through Business Premium but never configured them, or you are paying for premium licences on accounts that no longer need them.
Changes from Microsoft catch you off guard
Retired authentication methods, new sign-in requirements and changes to Teams licensing arrive by message centre post, and nobody inside the business has time to read them.
What the managed service brings together
Administration and lifecycle
Joiners, movers and leavers, licence assignment through groups, shared mailboxes, distribution lists and permission changes handled through a documented process.
Identity and access
Microsoft Entra ID configuration, multifactor authentication registration, Conditional Access policies where your licences support them, and regular review of privileged roles.
Device management
Microsoft Intune enrolment, compliance and configuration policies, Windows Autopilot provisioning and app deployment for Windows, macOS and mobile devices.
Collaboration services
Exchange Online mail flow, Teams policies and governance, SharePoint and OneDrive structure and external sharing settings kept consistent with how you actually work.
Security configuration
Periodic review of Microsoft Secure Score recommendations, Defender settings, email protection policies and audit logging, with changes agreed before they are applied.
Roadmap and licence advice
A tenant roadmap reviewed with you, plus advice on whether Business Basic, Standard or Premium, or add-on licences, fit each group of users.
Included in a typical scope, and what is quoted separately
Your proposal sets the final list. This is the usual starting point for a managed tenant.
Typically included
- User, group, licence and shared mailbox administration for covered users
- Microsoft Entra ID configuration, MFA enforcement and privileged role reviews
- Intune policy management for enrolled devices in scope
- Exchange Online, Teams and SharePoint administration requests
- Scheduled review of security configuration and Microsoft message centre changes
- Tenant configuration documentation kept current
- Licence usage reviews and right-sizing recommendations
- Quarterly roadmap meeting with a named contact at your organization
Requires separate scope or quotation
- Microsoft licence purchases, unless written into your proposal
- Migrations from Google Workspace, on-premises Exchange or another tenant
- Third-party Microsoft 365 backup subscriptions
- Power Platform development, custom SharePoint solutions or automation
- Enterprise-scale Azure landing zones or multi-tenant identity architecture
- After-hours or weekend coverage, unless written into your plan
Microsoft 365 components we manage
Which components are in scope depends on the licences you hold. We confirm this during discovery.
- Microsoft 365 admin centre and Microsoft 365 Business Basic, Standard and Premium plans
- Microsoft Entra ID, including security defaults, Conditional Access and Entra Connect or Cloud Sync for hybrid identity
- Microsoft Intune, Windows Autopilot and Apple Business Manager integration
- Exchange Online and Exchange Online Protection
- Microsoft Teams, including meeting, messaging and guest access policies
- SharePoint Online and OneDrive for Business
- Microsoft Defender for Business and Defender for Office 365 Plan 1 where licensed
- Microsoft Purview retention and sensitivity labels at a small-business level
Who this is built for
Microsoft-first small businesses
Teams of 5 to 50 who run email, files and meetings in Microsoft 365 and want it maintained properly without hiring an administrator.
Growing organizations on Business Premium
Firms of 50 to 200 employees that own Intune, Entra ID P1 and Defender for Business and want those features configured and kept current.
Businesses leaving a reseller-only arrangement
Organizations whose licence reseller never managed the tenant and who now need someone accountable for how it is configured.
What changes when the tenant is managed
- One team accountable for identity, devices, email, files and meetings together
- Licences matched to roles, with unused or mismatched licences flagged
- Security features you already pay for actually switched on and maintained
- A written baseline, so configuration drift is visible instead of hidden
- Microsoft platform changes reviewed and planned rather than discovered by users
- A roadmap that ties tenant improvements to your budget and priorities
How we take over management of your tenant
Consultation
We discuss your users, licences, devices, current provider and the Microsoft 365 problems you most want fixed.
Tenant discovery
With delegated read access, we review admin roles, licences, sign-in policies, device enrolment, mail flow and sharing settings.
Written scope and proposal
You receive a proposal listing covered users and services, urgent findings, exclusions and pricing confirmed in a written quotation.
Onboarding and baseline
Administrative access is consolidated, break-glass accounts are documented, and the agreed baseline configuration is recorded.
Operate and improve
Requests are handled under the scope, security and licence reviews run on schedule, and roadmap items are delivered as agreed.
Ways to engage
All recurring arrangements are confirmed by a written quotation before billing begins.
Microsoft 365 Administration subscription
Per-user monthly administration for organizations that mainly need reliable user, licence and mailbox management.
Managed IT packages
Microsoft 365 management combined with help desk, device care and endpoint security in a Business or Advanced package.
Start with a Tenant Review
A fixed-scope Microsoft 365 Tenant Review documents your current configuration and priorities before you commit.
Larger Azure or identity architecture projects
If your Microsoft 365 work is part of a wider Azure landing zone, multi-tenant identity design or complex enterprise migration, our sister brand CloudArchitects.expert handles that architecture work. We can coordinate so the day-to-day tenant management stays with us.
Frequently asked questions
How is this different from Microsoft 365 Administration?
Administration covers routine changes such as users, licences and mailboxes. The managed service adds ownership of the whole tenant: identity and device policy, security configuration reviews, platform change tracking and a roadmap.
Do we have to buy Microsoft licences from you?
No. Licences are purchased separately unless they are written into your proposal. We can manage a tenant whose licences come from another source, provided we have the administrative access the scope requires.
Which Microsoft 365 plan should we be on?
It depends on each group of users. Business Basic suits web and mobile use, Business Standard adds desktop Office apps, and Business Premium adds Intune, Entra ID P1 and Defender for Business. Business plans are capped at 300 users. We recommend a mix after discovery.
Will you need Global Administrator access?
We use the least privilege the scope allows and prefer named, MFA-protected admin accounts or delegated access over shared credentials. Some tasks do require elevated roles, and we document who holds them.
How is the managed service priced?
Per covered user per month. The Microsoft 365 pricing calculator shows proposed figures, and your written quotation confirms the price after discovery. Licences and projects are quoted separately.
What happens to our tenant if we leave?
The tenant, its data and its documentation belong to you. Offboarding transfers administrative access and configuration records to you or your new provider through an agreed handover.
Related services
Products and packages
Industries we support
Service areas
Find out what managing your tenant would involve
Book a consultation to talk through your users, licences and Microsoft 365 priorities. You will receive a written scope before any recurring commitment.