Final payroll needs to be processed. Keys might need to be returned. Customers and suppliers may need to be informed. Someone else may need to take over the employee’s responsibilities.

But there’s another important task that shouldn’t be overlooked:

What happens to their IT access?

A departing employee may have access to email, Microsoft 365, OneDrive, SharePoint, business applications, company computers, VPNs and other systems.

Simply changing their email password isn’t necessarily enough.

A proper IT offboarding process helps protect company information while making sure important business data isn’t accidentally lost.

Offboarding should start before the employee leaves

Where possible, IT shouldn’t find out about an employee departure after they’ve already left.

The person responsible for IT should know:

• Who is leaving
• When their access should end
• Whether access needs to be removed immediately
• Who should receive their email
• Who should take ownership of their files
• Which company equipment needs to be returned
• Which business applications they use

The timing matters.

For a normal planned departure, access might remain available until the employee finishes work on their final day.

In other circumstances, access may need to be removed immediately.

That decision belongs with the business — but IT needs clear instructions so it can be implemented correctly.

Disable the account — don’t immediately delete it

One of the most important Microsoft 365 offboarding principles is not to rush into deleting a user’s account.

The account may contain important company information.

That could include email, contacts, calendars and OneDrive files.

Instead, the first priority is generally to prevent the former employee from signing in while preserving the information the business still requires.

Once the data has been reviewed and transferred appropriately, the account and licence can be dealt with according to the organisation’s retention requirements.

Sign the user out of existing sessions

Changing a password is useful, but users may already be signed into Microsoft 365 on multiple devices.

That could include:

• A company computer
• A personal laptop
• A mobile phone
• Outlook
• Microsoft Teams
• OneDrive
• Browser sessions

A proper offboarding process should therefore consider existing sessions and authentication tokens rather than relying only on a password change.

The objective is straightforward:

When access ends, it should actually end.

What happens to the employee’s email?

This needs a business decision.

Some organisations want incoming messages forwarded to another employee.

Others may provide another employee with temporary access to the former user’s mailbox.

In some circumstances, the mailbox may be converted to a shared mailbox so that authorised employees can continue accessing historical email.

There isn’t one correct approach for every organisation.

The important thing is deciding what should happen before deleting the user or removing important information.

Don’t forget OneDrive

Email is usually the first thing businesses think about when somebody leaves.

OneDrive can be just as important.

Employees may have stored business documents in their individual OneDrive account rather than a shared SharePoint location.

Before the account is removed, the organisation should determine whether those files need to be retained or transferred.

This is also a good opportunity to ask whether important company information should have been stored in an individual’s OneDrive in the first place.

Documents that belong to a team or the organisation may be better suited to SharePoint or another shared business location.

Review SharePoint and Teams access

The employee may have had access to multiple SharePoint sites, Teams and shared resources.

Disabling their Microsoft 365 identity can prevent them from signing in, but offboarding is also a useful opportunity to review ownership and permissions.

Was the departing employee the only owner of an important Team?

Were they responsible for a SharePoint site?

Did they manage a shared mailbox?

Did they own Microsoft Forms, workflows or other business resources?

These dependencies are much easier to resolve while the employee’s role and responsibilities are still understood.

Microsoft 365 isn’t the only system

A common mistake is to disable Microsoft 365 and assume the job is finished.

Employees often have access to many other services.

Depending on the business, these could include:

• Accounting software
• CRM systems
• Password managers
• VPN access
• Remote desktop systems
• Business phone systems
• Websites
• Social media accounts
• Domain or DNS platforms
• Cloud applications
• Industry-specific software
• Supplier portals

The organisation should maintain enough documentation to know which systems employees may have access to.

Without that visibility, accounts can remain active long after someone has left.

Shared passwords create problems

Employee departures highlight one of the biggest problems with shared accounts.

Imagine five employees all know the password to the same service.

One employee leaves.

How do you remove only that person’s access?

Usually, you can’t.

The password needs to be changed and redistributed to everyone else.

Wherever practical, employees should therefore have individual user accounts rather than sharing credentials.

Individual identities provide better security, accountability and offboarding.

Administrator access deserves special attention

If the departing employee had administrator privileges, their offboarding requires additional care.

Administrator access might exist in Microsoft 365, business applications, networking equipment, websites, domains or other systems.

These accounts can have extensive control over the organisation’s technology.

Businesses should regularly review who has administrative privileges and remove access when it is no longer required.

This follows the same principle we discussed in our AI security article:

People and applications should only have the access they actually need.

Recover company equipment

IT offboarding isn’t only about accounts.

Company-owned equipment should also be accounted for.

That might include:

• Laptop or desktop computer
• Mobile phone
• Tablet
• Headset
• Security keys
• Chargers and accessories
• Other company equipment

When equipment is returned, it shouldn’t automatically be handed directly to the next employee.

IT should check the device, protect or transfer any required information and prepare it appropriately for reuse.

What if the employee used a personal device?

This can make offboarding more complicated.

An employee may have configured company email, Teams, OneDrive or other applications on a personal phone or computer.

Businesses that allow personal devices should understand how company information is protected and what can be removed when the employment relationship ends.

This is one area where proper device management and Microsoft 365 security policies can provide considerably better control.

Backups still matter

Even with a well-managed offboarding process, mistakes happen.

Important email or files may be deleted before anybody realises they’re needed.

This is another reason businesses should understand their Microsoft 365 backup and retention strategy.

A backup shouldn’t replace proper offboarding.

It provides another recovery option if something goes wrong.

Remove licences when they’re no longer required

Microsoft 365 licences cost money.

Once the user’s information has been preserved appropriately and the account no longer requires licensed services, licences can potentially be removed and reassigned.

However, licence removal shouldn’t be the first step.

Understand what happens to the user’s mailbox, OneDrive and other information before changing licensing.

Saving one month’s licence cost isn’t worth accidentally losing important business data.

Create a repeatable onboarding and offboarding process

Employee departures shouldn’t require everyone to remember what happened last time.

Create a checklist.

The same applies when somebody joins the business.

A good onboarding process makes sure new employees receive the correct computer, Microsoft 365 account, applications and permissions.

A good offboarding process reverses that access when they leave.

This creates consistency and reduces the likelihood that something important will be forgotten.

IT access belongs to the business

Ultimately, business systems and information shouldn’t depend on individual employees.

The organisation should maintain control over its Microsoft 365 environment, domains, applications, passwords and company information.

Employees will inevitably come and go.

A well-managed IT environment should make that a normal administrative process rather than a security emergency.

Employee offboarding with itX365

For our managed IT clients, itX365 can assist with the technical side of employee onboarding and offboarding.

That can include Microsoft 365 accounts, authentication, computers, email, OneDrive, SharePoint, business applications and other managed services.

The business tells us who is joining or leaving, when it should happen and what should happen to their information.

We handle the agreed technical changes.

That creates a repeatable process and helps ensure important access isn’t accidentally left behind.

When did you last check your former employee accounts?

Here’s a useful exercise:

Look at the user accounts in your Microsoft 365 environment.

Does everyone listed still work for the business?

If you’re not sure, it may be worth reviewing your user accounts and access.

Talk to itX365 if you’d like help reviewing Microsoft 365 users, permissions or your employee onboarding and offboarding process.

But it can be one of the most important technology assets your business owns.

Your website may use it.

Your email depends on it.

Microsoft 365 may depend on its DNS records.

Customers recognise it.

And if something goes wrong with the domain, several seemingly unrelated business systems can stop working at the same time.

Despite this, many businesses aren’t completely sure where their domain is registered, who controls it or even whose name it’s registered under.

That’s a risk worth fixing before it becomes an emergency.

What is a domain name?

A domain is the address people associate with your business online.

For example:

yourbusiness.com.au

It can be used for your website and email addresses such as:

name@yourbusiness.com.au

But the domain does much more behind the scenes.

DNS — the Domain Name System — contains records that tell computers where different services associated with the domain can be found.

That can include your website, Microsoft 365 email and other cloud services.

If those records are changed incorrectly, services can stop working even though there is nothing wrong with Microsoft 365 or your website itself.

Domain registration and website hosting aren’t the same thing

This causes a lot of confusion.

Your domain registrar is the organisation responsible for registering and renewing your domain.

Your DNS provider hosts the DNS records that direct traffic for the domain.

Your web hosting provider hosts your website.

Your email provider might be Microsoft 365.

These can all be different companies.

For example, a business could have its domain registered with one provider, DNS hosted somewhere else, its website on another hosting platform and email with Microsoft 365.

That’s completely normal.

The important thing is knowing who is responsible for each component.

Who actually owns the domain?

This is one of the first things every business should know.

Ideally, the domain should be registered to the appropriate business entity using accurate and current information.

Problems can occur when domains were originally registered by:

• A former employee
• A previous IT provider
• A web developer
• A marketing agency
• The business owner’s personal account
• Someone who is no longer associated with the business

Often this arrangement works perfectly well for years.

Then somebody needs to transfer the domain or make an important change and discovers that nobody has access to the account.

What should have been a five-minute task can suddenly become a much larger problem.

Australian domains have eligibility requirements

Australian domain names such as .com.au aren’t simply anonymous internet addresses.

Registrants need to meet the relevant eligibility requirements for the domain they hold.

That makes accurate registration information particularly important.

If company details change, businesses shouldn’t assume their domain registration will automatically update itself.

Domain information should be treated as a business record that needs to remain accurate.

What happens if a domain expires?

This is where domain management becomes particularly important.

Imagine your business has used:

yourbusiness.com.au

for ten years.

Employees have email addresses using that domain. Customers know the website. Business cards, invoices and marketing material all contain it.

Then the domain isn’t renewed.

Depending on the circumstances, the website may stop resolving and email delivery can be affected.

Suddenly, a relatively inexpensive annual renewal has created a potentially serious business interruption.

Businesses should therefore know:

Who receives the renewal notices?

Is automatic renewal enabled?

Is the payment method current?

Who is responsible for checking that renewal succeeded?

Those are simple questions, but they’re worth answering.

DNS changes can affect your email

DNS is particularly important for Microsoft 365.

When somebody sends an email to your company, DNS records help determine where that email should be delivered.

Other DNS records can also help receiving email systems determine whether messages claiming to come from your domain are legitimate.

This can involve technologies such as:

SPF — identifies systems authorised to send email for your domain.

DKIM — uses cryptographic signatures to help verify email.

DMARC — provides policies and reporting around email authentication.

Incorrect DNS changes can therefore affect both incoming and outgoing email.

That’s why DNS access should be controlled carefully.

Your web developer doesn’t necessarily need control of everything

A web developer may need to make DNS changes when launching a new website.

That doesn’t necessarily mean they need permanent control over the business’s domain registration or entire DNS environment.

Where possible, access should follow the same least privilege principle used elsewhere in cybersecurity.

Give people the access they need to perform their role without unnecessarily transferring control of unrelated services.

For example, changing where a website points shouldn’t require handing over ownership of the entire domain.

Protect domain accounts with MFA

A domain registrar account is an important security account.

If somebody gains access to it, they may potentially be able to change where your website or other services point.

Registrar and DNS accounts should therefore use strong unique passwords and Multi-Factor Authentication wherever supported.

Administrative access should also be limited to people who genuinely need it.

This is another reason why domains shouldn’t remain indefinitely inside the personal account of a former employee or external contractor.

DNS providers can also provide security services

Modern DNS platforms can provide considerably more functionality than simply storing DNS records.

Depending on the provider and configuration, this can include security features, traffic management, website protection and improved visibility.

For business-critical domains, the DNS platform should be selected deliberately rather than simply using whatever service happened to be included when the domain was first purchased.

Document where everything is located

Businesses don’t necessarily need to understand DNS technically.

But somebody should maintain basic documentation.

At minimum, you should know:

• Where the domain is registered
• Who the registrant is
• When the domain expires
• Who has administrative access
• Where DNS is hosted
• Where the website is hosted
• Who manages Microsoft 365
• Who is responsible for renewals

If your current IT provider disappeared tomorrow, could somebody answer those questions?

If not, the environment needs better documentation.

Be careful when changing IT providers

Domain ownership becomes particularly important when a business changes IT providers, web developers or marketing companies.

Before ending the relationship, make sure the business has access to its domain and other important technology accounts.

A well-managed transition should include the transfer of appropriate credentials, documentation and administrative control.

The domain belongs with the business — it shouldn’t become leverage that makes changing providers unnecessarily difficult.

Domain management is business continuity

It’s easy to think of domains as a website issue.

They’re not.

For many businesses, the domain connects several critical systems together.

A problem with the domain or DNS can affect email, websites, cloud services and customer communication simultaneously.

That makes domain management part of the organisation’s broader business-continuity and cybersecurity strategy.

Managing domains with itX365

At itX365, we manage domains and DNS as part of the broader technology environments we support.

Our preference is to keep domain registration, DNS, Microsoft 365 and other critical services properly documented and under appropriate administrative control.

For DNS, we commonly use platforms such as Cloudflare, while Australian domain registration can be managed through Australian wholesale providers.

The specific provider matters less than making sure the business maintains control, renewals are managed and critical DNS records are protected.

Do you know who controls your business domain?

Try answering these four questions:

Where is your domain registered?

Whose name is it registered under?

Who controls its DNS?

When does it expire?

If you’re not sure about any of those answers, it’s worth finding out before you urgently need them.

Talk to itX365 if you’d like help reviewing your business domain, DNS or Microsoft 365 configuration.

AI Tools in the Workplace: What Businesses Should Consider Before Giving Them Access to Company Data

Artificial intelligence tools are rapidly becoming part of everyday business.

Employees are using AI to draft emails, summarise documents, analyse information, prepare reports and automate repetitive tasks.

Used appropriately, these tools can provide significant productivity benefits.

But there’s an important question businesses should ask before connecting an AI application to Microsoft 365:

What information are we giving it access to?

Clicking Allow on a permissions screen can potentially provide an application with access to much more company information than an employee realises.

That doesn’t mean businesses should avoid AI.

It means AI adoption should be managed in the same way as any other technology that handles company information.

Not all AI tools are the same

The term “AI” covers an enormous range of products.

Some AI tools operate as standalone websites where an employee manually enters information.

Others install applications on computers.

Some integrate directly with Microsoft 365.

Others connect to SharePoint, OneDrive, email, calendars, CRM platforms or other business systems.

These are very different risk scenarios.

The important question isn’t simply:

“Do we allow AI?”

A better question is:

“What does this particular application do, and what information does it need access to?”

Pay attention to Microsoft 365 permissions

When an application integrates with Microsoft 365, it may request permissions to access company information.

Depending on the application and permissions requested, this could potentially include access to things such as:

• User profiles
• Email
• Calendars
• OneDrive files
• SharePoint data
• Teams information
• Company directory information

Some applications only require limited access.

Others may request considerably broader permissions.

Before approving an application, businesses should understand what is being requested and why.

“Sign in with Microsoft” doesn’t mean Microsoft made the application

This is an important distinction.

Many third-party applications allow users to sign in using their Microsoft account.

That can be convenient and may provide secure authentication.

However, seeing a Microsoft login screen doesn’t necessarily mean the application itself is a Microsoft product or has been approved by Microsoft for your organisation.

The login process identifies the user.

The permissions requested afterwards determine what the application may be able to access.

Employees should therefore avoid treating every Sign in with Microsoft button as automatic approval to connect a service to company information.

The principle of least privilege applies to AI too

A useful cybersecurity principle is least privilege.

Users and applications should only receive the access they actually require.

For example, if an AI application only needs access to a specific set of documents, does it really need access to every SharePoint site in the organisation?

If it only needs to help draft text, does it need access to company email?

If the requested permissions seem much broader than the function being provided, that’s worth investigating.

Giving applications unnecessary access increases the potential impact if something goes wrong.

Where does your information go?

Before providing sensitive business information to an AI service, organisations should understand how that information is handled.

Useful questions include:

Is the information retained?

Where is it stored?

How long is it retained?

Is it used to improve or train models?

Can administrators control retention?

Can the information be deleted?

Where is the service hosted?

What happens when an employee leaves the business?

The answers will vary significantly between providers and between consumer and business versions of the same service.

Free and consumer AI accounts deserve particular attention

Employees may discover useful AI tools independently and create accounts using their company email address.

This can create what is sometimes called shadow IT — technology being used for business purposes without the organisation necessarily knowing about or managing it.

The problem isn’t that every free AI tool is unsafe.

The problem is that the business may have no visibility into what company information is being entered, where that information is going or whether access can be removed later.

For sensitive business information, organisations should consider whether an approved business-grade service is more appropriate.

Be especially careful with sensitive information

Not all business information carries the same risk.

Asking an AI tool to improve the wording of a generic marketing paragraph is very different from uploading confidential client documents.

Businesses should think carefully before providing AI systems with information such as:

• Customer records
• Legal documents
• Financial information
• Employee information
• Passwords or credentials
• Confidential correspondence
• Contracts
• Personally identifiable information
• Proprietary business information

Some industries may also have contractual, regulatory or professional obligations governing how information can be handled.

AI applications can create another path into company data

Cybersecurity traditionally focuses on users, computers and networks.

Cloud applications have added another consideration: application access.

Even if an employee has strong MFA and a properly secured computer, a third-party application that has been granted access to their Microsoft 365 information creates another relationship that needs to be considered.

That doesn’t automatically make the application dangerous.

But it does mean application permissions should form part of the organisation’s security management.

Administrator access requires even greater caution

Requests for administrator permissions should receive particular scrutiny.

Administrative accounts can potentially access or change significant parts of an organisation’s Microsoft 365 environment.

Providing an application with broad administrative permissions can therefore carry considerably more risk than allowing an ordinary user to sign in.

Before granting administrator access, businesses should understand exactly what permissions are being requested and whether they are genuinely required.

Convenience shouldn’t be the deciding factor.

Create an AI policy before you need one

Businesses don’t necessarily need a 40-page AI policy.

For many small organisations, a few clear rules can make a significant difference.

For example:

• Which AI services are approved?
• Can employees use company information with AI tools?
• What information must never be uploaded?
• Who can approve new AI applications?
• Who can approve Microsoft 365 integrations?
• Are free consumer AI accounts permitted?
• What happens when an employee leaves?
• Who reviews application permissions?

The goal shouldn’t be to prevent employees from benefiting from AI.

It’s to establish reasonable boundaries.

AI security shouldn’t become AI prohibition

There is a danger of approaching AI entirely from a security perspective.

Businesses that prohibit every AI tool may miss genuine productivity opportunities — and employees may simply start using unapproved services instead.

A better approach is to evaluate the business requirement and then find an appropriate way to meet it.

Ask:

What is the employee trying to achieve?

There may be an approved AI platform that provides the required capability while giving the organisation better control over its information.

Security works best when it enables the business rather than simply saying no.

Review connected applications regularly

Application access shouldn’t be treated as permanent.

Over time, employees leave, projects finish and applications stop being used.

Businesses should periodically review which applications have access to their environment and remove permissions that are no longer required.

This principle applies to AI applications as well as traditional cloud software.

AI should become part of your broader cybersecurity strategy

AI isn’t a completely separate security problem.

It fits into many of the same principles businesses should already be applying:

• Multi-Factor Authentication
• Least privilege
• Device management
• Data protection
• User awareness
• Application control
• Administrator security
• Monitoring
• Backup and recovery

As AI becomes more deeply integrated into business applications, these controls will become even more important.

Helping businesses adopt AI safely

At itX365, we believe businesses should be able to benefit from new technology without unnecessarily exposing company information.

When an application requests access to Microsoft 365, the question shouldn’t simply be whether the software is useful.

We also need to understand what it can access, what permissions it requires and how that fits into the organisation’s overall security environment.

For businesses using Microsoft 365, this can form part of a broader managed IT and cybersecurity strategy.

Before you click “Allow”

The next time an AI application asks for access to your company’s Microsoft 365 environment, take a moment to look at what it’s requesting.

If you’re unsure what those permissions mean, ask before approving them.

A five-minute security review is considerably easier than investigating a data-security problem afterwards.

Talk to itX365 if you’d like help reviewing Microsoft 365 application permissions or developing practical guidelines for the use of AI within your business.

Most businesses have a router.

It connects the office to the internet, provides Wi-Fi and usually includes some basic firewall functionality.

So it’s reasonable for a business owner to ask:

Why would we need anything else?

The answer comes down to the difference between simply connecting a business to the internet and actively managing the security of that connection.

For a very small business with simple requirements, a basic router may be perfectly adequate.

But as a business becomes more dependent on cloud applications, Microsoft 365, remote access and connected devices, the network becomes an increasingly important part of its cybersecurity.

That’s where a managed firewall can provide additional protection and visibility.

What does a firewall actually do?

At its simplest, a firewall controls network traffic between your business and other networks, including the internet.

It decides which connections should be allowed and which should be blocked based on configured rules.

Basic firewall functionality has been built into routers for many years.

Modern business firewalls, however, can provide significantly more security capabilities.

Depending on the solution, this may include:

• Intrusion detection and prevention
• Malicious website blocking
• DNS filtering
• Application control
• Geographic filtering
• Threat intelligence
• VPN connectivity
• Network segmentation
• Security logging
• Monitoring and alerts

The important distinction isn’t simply whether a business has a firewall.

It’s what that firewall is capable of doing and whether somebody is actually managing it.

What makes a firewall “managed”?

Installing a firewall and never looking at it again doesn’t make it managed.

A managed firewall is actively maintained as part of the business’s IT environment.

This can involve keeping its software and security services updated, reviewing alerts, maintaining security policies, monitoring its health and changing its configuration as the business evolves.

For example, if a firewall goes offline at 2:00 AM, does anybody know?

If a security service stops updating, is somebody alerted?

If an employee needs remote access, is it configured securely?

If suspicious network activity is detected, who investigates it?

Those operational questions are often more important than the brand printed on the device.

Your network is part of your cybersecurity

Cybersecurity discussions often focus heavily on computers and email.

Those are important, but they’re only part of the environment.

Your network connects computers, printers, phones, wireless access points, servers, security cameras and an increasing number of other devices.

Some of those devices may have very different security capabilities.

A properly designed network can help control how these devices communicate and reduce unnecessary access between different parts of the environment.

What is network segmentation?

Imagine an office containing employee computers, printers, security cameras and guest Wi-Fi.

Do all of those devices really need to communicate freely with each other?

Usually not.

Network segmentation allows different types of devices or users to be separated into logical networks.

For example, guest Wi-Fi can be isolated from the internal business network.

Security cameras or other connected devices can potentially be placed on a separate network from employee computers.

This doesn’t eliminate security risk, but it can reduce unnecessary exposure.

DNS filtering can stop connections before they happen

Every time you visit a website, your computer normally uses DNS to determine where that website is located.

Security-focused DNS services can use this process to block access to known malicious or inappropriate destinations.

For example, if an employee clicks a link to a known malicious website, DNS filtering may prevent the computer from reaching it.

This provides another security layer alongside endpoint protection, email security and browser protections.

It isn’t a replacement for those systems.

It’s an additional layer.

What about geographic blocking?

Many small businesses operate almost entirely within Australia.

That raises an interesting question:

Should every service on the business network be accessible from everywhere in the world?

In some environments, geographic filtering can be used to reduce unnecessary exposure by restricting certain traffic based on its country of origin or destination.

However, geographic blocking shouldn’t be treated as a magic cybersecurity solution.

Attackers can use infrastructure located in many different countries, including Australia.

It’s another tool that can reduce exposure when used appropriately.

Can a firewall stop phishing emails?

Generally, that’s not its primary job.

This is an important example of why cybersecurity needs multiple layers.

A firewall protects the network.

Email security helps identify malicious email.

Endpoint protection helps protect computers.

MFA helps protect user accounts.

Backups provide recovery options when preventative controls fail.

Each layer addresses different risks.

No single security product — including an expensive firewall — solves everything.

What happens when employees work from home?

This is another reason cybersecurity can no longer depend entirely on the office firewall.

A laptop might spend half its time connected to the office network and the other half connected to an employee’s home Wi-Fi, a hotel or another external network.

Security therefore needs to follow the device and user.

Technologies such as endpoint protection, Microsoft 365 identity security, MFA and device management remain important regardless of where the employee is working.

The firewall is one component of the overall security strategy.

Does every small business need an expensive enterprise firewall?

No.

Security should be proportionate to the business.

A two-person business doesn’t necessarily need the same network infrastructure as a 100-person organisation.

Technology has also changed considerably.

Modern security services make it possible to provide useful network protection to very small businesses without installing large and expensive enterprise appliances.

The right solution should be based on the organisation’s size, network, information, risk and operational requirements.

Why monitoring matters

One of the biggest differences between consumer networking equipment and a managed business environment is visibility.

When something fails or behaves unexpectedly, somebody needs to know.

Monitoring can help an IT provider identify problems such as an offline firewall, failed internet connection or unavailable network device.

That can sometimes allow an issue to be investigated before employees even realise something has gone wrong.

This is part of the broader shift from reactive IT support to proactive managed IT.

A firewall should be part of a layered security strategy

A managed firewall can be an important cybersecurity control, but it shouldn’t operate in isolation.

For many small businesses, a broader security approach might include:

• Multi-Factor Authentication
• Endpoint protection
• Microsoft 365 security
• Email protection
• Managed firewall
• DNS filtering
• Security updates
• Device management
• Backup and recovery
• Monitoring

If one security layer fails, another may still prevent or limit the incident.

That’s the principle behind layered security.

Managed network security with itX365

At itX365, we help Perth businesses implement practical network security based on their actual requirements.

That can include managed firewalls, secure DNS, network segmentation, Wi-Fi, VPN connectivity, internet failover and ongoing monitoring.

For very small businesses, we can also use appropriately sized security solutions rather than assuming every organisation needs expensive enterprise equipment.

The objective isn’t to make the network complicated.

It’s to provide appropriate protection, visibility and management without getting in the way of employees doing their jobs.

Not sure what’s protecting your business network?

If your firewall is simply the router that arrived with your internet service — and nobody is quite sure what it’s doing — it may be worth reviewing your network security.

Talk to itX365 about managed firewall and network security options for your Perth business.

Microsoft 365 has transformed how small businesses store and access information.

Email is stored in Exchange Online, documents are kept in OneDrive and SharePoint, and employees can access company information from almost anywhere.

Because this information is stored in Microsoft’s cloud, it’s easy to assume that everything is automatically backed up and can always be recovered.

The reality is more complicated.

Microsoft operates highly resilient infrastructure and provides a range of retention and recovery capabilities. But businesses are still responsible for protecting their information against many everyday risks.

That’s why understanding the difference between cloud availability, retention and backup is important.

Isn’t Microsoft 365 already protected by Microsoft?

Yes — but that protection shouldn’t automatically be considered the same thing as an independent backup.

Microsoft is responsible for operating the Microsoft 365 platform and protecting the infrastructure that delivers services such as Exchange Online, OneDrive and SharePoint.

Microsoft builds substantial redundancy into these services.

But infrastructure resilience solves a different problem from backup.

If Microsoft experiences a hardware failure, its infrastructure is designed to keep the service operating.

If an employee deletes important information, a user account is compromised, or information is changed or removed intentionally, that’s a different type of problem.

This is where independent backup can become valuable.

What can cause Microsoft 365 data loss?

Data doesn’t need to disappear because Microsoft’s servers have failed.

Some of the most common risks happen at the user or organisation level.

Accidental deletion

People make mistakes.

An employee might delete an email, overwrite a document or remove an entire folder without realising that other employees still need it.

Often the mistake isn’t discovered immediately.

By the time somebody notices, the available recovery options may be more limited.

A departing employee

Employee departures can create complicated data-management situations.

Their mailbox, OneDrive files and access to SharePoint may contain important business information.

Simply deleting the user’s account without considering what information needs to be retained can create unnecessary risk.

This is why offboarding should be a managed process rather than simply removing a Microsoft 365 licence.

Cybersecurity incidents

A compromised user account can potentially give an attacker access to business information.

Depending on the circumstances, an attacker could delete or alter information in addition to stealing it.

Ransomware and other malicious activity can also affect files synchronised between computers and cloud storage.

Backups provide another recovery option when preventative security controls fail.

Malicious deletion

Not every data-loss incident is accidental.

A disgruntled employee or somebody with excessive permissions could intentionally delete or alter business information.

Good access controls reduce this risk, but independent backups provide another layer of protection.

What about Microsoft’s recycle bins and retention?

Microsoft 365 includes useful recovery and retention capabilities.

For example, deleted files may remain recoverable for a period of time, and administrators can configure retention policies for certain types of information.

These features are extremely useful.

However, retention and backup aren’t exactly the same thing.

Retention primarily helps organisations preserve information within Microsoft 365 according to configured policies.

An independent backup creates another copy of the information outside the primary Microsoft 365 environment.

That separation can be valuable when something goes seriously wrong.

What should a Microsoft 365 backup protect?

The exact requirements depend on the business, but organisations commonly consider protecting:

Exchange Online — employee and shared mailboxes, including email, calendars and contacts.

OneDrive — individual users’ business files.

SharePoint — shared company documents and information.

Microsoft Teams — depending on the backup platform and the information the organisation needs to retain.

The important thing is to understand exactly what your backup service protects rather than assuming that “Microsoft 365 backup” means everything is covered.

Backup retention matters

Having a backup is only part of the equation.

How long is the information retained?

Imagine an important document was deleted four months ago but nobody noticed until today.

If the backup system only retains information for 30 days, the backup may not help.

Different organisations have different retention requirements based on operational, legal and compliance considerations.

This is something businesses should understand before they need to recover information.

A backup is only useful if you can restore from it

This principle applies to almost every backup system:

A successful backup isn’t the same thing as a successful recovery.

Seeing a green “backup successful” status is reassuring, but ultimately the purpose of a backup is to restore information.

Businesses should know how information can be recovered and who is responsible for performing the recovery.

For important systems, recovery should also be tested periodically.

What about data stored on business servers?

Microsoft 365 isn’t necessarily the only information a business needs to protect.

Some organisations still operate servers, NAS devices, databases or industry-specific applications.

Those systems may require completely different backup strategies.

A sensible backup plan starts by asking:

What information would seriously affect the business if we lost it tomorrow?

Once that information has been identified, you can determine where it lives and how it should be protected.

Backup is part of a broader disaster-recovery strategy

Backup and disaster recovery are related, but they’re not the same thing.

Backup is about preserving information.

Disaster recovery asks a larger question:

How do we get the business operating again?

If a server fails, having its data backed up is important. But the business may also need replacement infrastructure, applications, configuration information and a plan for restoring services.

Likewise, if internet connectivity fails, having perfect backups doesn’t help employees access cloud applications.

A good business-continuity strategy considers these dependencies together.

Does every business need third-party Microsoft 365 backup?

There isn’t one answer that applies to every organisation.

Microsoft provides useful native recovery and retention capabilities, and businesses should understand those capabilities before purchasing additional products.

However, organisations that rely heavily on Microsoft 365 may decide that an independent backup provides worthwhile additional protection.

The decision should be based on the value of the information, the organisation’s recovery requirements and the consequences of losing access to that information.

The important thing is to make the decision deliberately rather than simply assuming:

“It’s in Microsoft 365, so it must be backed up.”

Protecting business data with itX365

At itX365, we help Perth businesses understand where their important information is stored and how it is protected.

This can include Microsoft 365 backup, server backup, offsite backup, monitoring and disaster-recovery planning as part of a broader managed IT strategy.

Our approach is to start with the business requirement rather than the product.

What information matters?

How long should it be retained?

How quickly would it need to be recovered?

And who is responsible for making sure that recovery actually works?

Those questions are far more important than simply having a box somewhere that says “Backup Enabled.”

Is your business data actually protected?

If you’re unsure what happens to your Microsoft 365 data when something is accidentally deleted, compromised or lost, it may be worth reviewing your current backup and recovery strategy.

Talk to itX365 about reviewing your Microsoft 365 and business backup requirements.

Unfortunately, a password on its own is no longer enough to adequately protect important business information.

Employees use Microsoft 365, cloud accounting systems, online banking, CRM platforms and dozens of other online services. If an attacker obtains the password to one of these accounts, they may be able to access sensitive business information without ever touching the employee’s computer.

That’s why Multi-Factor Authentication (MFA) has become one of the most important basic cybersecurity controls for businesses.

What is Multi-Factor Authentication?

Multi-Factor Authentication adds another verification step when someone signs into an account.

Instead of relying only on something you know — your password — the system asks for another form of verification.

This might include:

• An authentication app on your phone
• A security key
• A biometric such as a fingerprint
• A passkey
• A temporary verification code

The important difference is that stealing the password alone may no longer be enough to access the account.

Why aren’t passwords enough anymore?

The problem isn’t necessarily that employees choose terrible passwords.

Even a strong password can be compromised.

Passwords can be exposed through phishing attacks, malware, compromised websites and other data breaches.

An employee might also be presented with a convincing fake Microsoft 365 login page and unknowingly provide their credentials directly to an attacker.

Without additional protection, those credentials could potentially be used to access the employee’s account.

MFA creates another obstacle.

What happens when a Microsoft 365 account is compromised?

A compromised Microsoft 365 account can be much more serious than somebody simply reading a few emails.

Depending on the user’s permissions and the organisation’s configuration, an attacker may gain access to email, OneDrive files, SharePoint information and other company resources.

Email accounts are particularly valuable because attackers can use them to impersonate employees.

For example, an attacker could monitor an email conversation involving an invoice and then attempt to substitute different banking details.

Because the message appears to come from a legitimate company account, these attacks can be extremely convincing.

MFA significantly improves account security

With MFA enabled, knowing the username and password may no longer be sufficient.

The attacker also needs to satisfy the additional authentication requirement.

This makes many common account-compromise attacks considerably more difficult.

However, it’s important to understand that not all MFA methods provide the same level of protection.

SMS vs authenticator apps

One of the earliest widely adopted MFA methods was sending a verification code via SMS.

SMS verification is generally better than protecting an account with only a password, but stronger authentication methods are now available.

Authenticator applications such as Microsoft Authenticator can provide a better authentication experience and support more modern security capabilities.

Instead of receiving a text message containing a code, the employee verifies the authentication request using an application registered to their account.

For businesses using Microsoft 365, moving away from reliance on SMS authentication is a sensible part of improving account security.

MFA isn’t completely phishing-proof

This is an important point.

Simply enabling MFA doesn’t mean an account can never be compromised.

Attackers have developed techniques designed to trick users into approving fraudulent authentication requests or providing authentication information through sophisticated phishing websites.

That’s why MFA should be considered one layer of security rather than the entire security strategy.

Modern identity security can go further by considering factors such as the user, device, location and risk associated with a login attempt.

Microsoft 365 Business Premium, for example, provides additional identity and device-management capabilities that can be used to build stronger access policies.

Related: Microsoft 365 Business Standard vs Business Premium: Which Does Your Business Need?

Be careful with unexpected authentication requests

One simple rule can prevent a lot of trouble:

If you aren’t trying to sign in, don’t approve an authentication request.

If an unexpected Microsoft Authenticator notification appears on your phone, somebody may be attempting to access your account.

Don’t simply approve the request to make the notification disappear.

If you’re unsure why you’re receiving authentication requests, contact your IT provider.

MFA should also protect administrator accounts

Administrator accounts deserve particular attention.

These accounts can potentially make significant changes to a company’s systems and security configuration.

An administrator account compromised by an attacker can therefore create considerably more risk than an ordinary user account.

Businesses should minimise unnecessary administrator access and ensure privileged accounts are appropriately protected.

The principle is straightforward:

Users should only have the access they actually need to perform their job.

What about shared accounts?

Businesses sometimes create a single username and password and give it to several employees.

This creates security and accountability problems.

Where possible, employees should have their own identities and permissions rather than sharing login credentials.

This makes it easier to control access when somebody joins or leaves the organisation and provides better visibility into who has access to company information.

MFA is only one layer of cybersecurity

MFA is extremely important, but businesses shouldn’t stop there.

A sensible cybersecurity strategy can include:

• Multi-Factor Authentication
• Endpoint protection
• Email security
• Managed firewalls
• DNS and web filtering
• Security updates
• Device management
• Access controls
• Backups
• Security monitoring

No individual security product can eliminate every risk.

The objective is to create multiple layers so that the failure of one control doesn’t automatically result in a serious security incident.

Who should have MFA enabled?

For most businesses, the answer is simple:

Everyone.

If an account provides access to business information, it should generally have appropriate authentication protection.

This is particularly important for Microsoft 365 because email, OneDrive, SharePoint and Teams can contain a significant amount of sensitive company information.

Don’t wait for an account compromise

Cybersecurity improvements are much easier to implement before an incident occurs.

If your business is still relying primarily on usernames and passwords, MFA is one of the most important security improvements you can make.

But enabling MFA is only the beginning.

Businesses should also consider how authentication, device security, Microsoft 365, backups and network security work together as part of their overall cybersecurity strategy.

Protecting Microsoft 365 with itX365

At itX365, we help Perth businesses manage and secure their Microsoft 365 environments as part of our managed IT services.

This includes helping businesses implement appropriate authentication, Microsoft 365 security, device protection and other cybersecurity controls based on their requirements.

Technology security doesn’t need to become complicated for employees.

The goal is to make the secure way of working the normal way of working.

Concerned about the security of your Microsoft 365 environment?

Talk to itX365 about reviewing your current Microsoft 365 security configuration.

Two of the most common options for small and medium businesses are Microsoft 365 Business Standard and Microsoft 365 Business Premium.

At first glance, they can look very similar. Both provide the core Microsoft 365 applications most businesses need.

The major difference is security.

For businesses deciding between the two, the question isn’t simply whether you need Word, Excel and Outlook. You should also consider how your company protects its computers, user accounts and business information.

What do you get with Microsoft 365 Business Standard?

Microsoft 365 Business Standard provides the productivity tools most businesses expect from Microsoft 365.

This includes desktop versions of applications such as Word, Excel, PowerPoint and Outlook, together with Microsoft’s cloud services such as Exchange Online, OneDrive, SharePoint and Teams.

For many businesses, that covers the basic productivity requirements very well.

However, Business Standard doesn’t include the same advanced security and device-management capabilities available with Business Premium.

This distinction becomes increasingly important as a business grows or becomes more dependent on Microsoft 365.

What does Microsoft 365 Business Premium add?

Business Premium includes the productivity features of Business Standard but adds a significant collection of security and device-management technologies.

These capabilities allow a business or its IT provider to do much more than simply provide employees with email and Office applications.

Some of the most important additions include Microsoft Intune, Microsoft Defender for Business and Microsoft Entra ID P1.

Together, these provide considerably greater control over who can access company information, which devices can access it and how those devices are protected.

Conditional Access

One of the most useful security capabilities available with Business Premium is Conditional Access.

Traditional security often works on a simple principle: if somebody knows the correct username and password, they can attempt to sign in.

Modern security needs more context.

Conditional Access can consider factors such as the user’s identity, location, device and authentication status before allowing access to company resources.

For example, a business could require stronger authentication under certain circumstances or restrict access from locations that don’t make sense for its operations.

This provides another layer of protection if a user’s password is compromised.

Device management with Microsoft Intune

As businesses adopt laptops, mobile devices and remote working, controlling access to company information becomes more complicated.

Microsoft Intune allows businesses to manage supported devices and apply policies to them centrally.

This can help ensure that devices accessing company information meet the organisation’s requirements.

It also becomes particularly valuable when employees join or leave the business.

Instead of relying entirely on manual configuration, policies can be applied consistently across managed devices.

Microsoft Defender for Business

Cybersecurity isn’t only about protecting Microsoft 365 accounts.

The computers employees use every day are another important part of the security picture.

Microsoft Defender for Business provides endpoint security capabilities designed for small and medium businesses.

It can help identify and respond to threats affecting business computers rather than relying solely on traditional antivirus protection.

This becomes part of a broader security strategy that can include MFA, email protection, managed firewalls, DNS security, backups and ongoing monitoring.

So, is Business Standard insecure?

No.

This is an important distinction.

Choosing Business Standard doesn’t automatically mean that a business has poor security. There are other ways to provide endpoint protection, device management and additional security controls.

The real question is how those requirements are being addressed.

A business using Business Standard together with appropriately configured third-party security services may have an excellent security posture.

However, businesses should understand what security products they already have before comparing licence prices.

Sometimes Business Premium can replace or consolidate separate products that the business is already paying for.

When does Business Premium make sense?

Business Premium becomes particularly attractive when a business wants Microsoft 365 productivity, endpoint security, identity protection and device management within the Microsoft ecosystem.

It may be worth considering when:

• Employees regularly work remotely.
• Business information is stored in OneDrive and SharePoint.
• The business wants centrally managed computers.
• Stronger identity and access controls are required.
• The business wants Microsoft endpoint security.
• Employees access company information from multiple locations or devices.
• Cybersecurity or compliance requirements are becoming more important.

For a business with several employees and important information stored in Microsoft 365, these capabilities can become considerably more valuable than the difference in licence cost alone.

Don’t choose Microsoft 365 licences based only on price

It’s tempting to compare Microsoft 365 licences by looking at the monthly price per user.

But this doesn’t always show the complete cost.

Consider the other security products your business needs.

If Business Standard requires separate endpoint security, device-management or identity-security products to achieve the desired outcome, those costs should be included in the comparison.

Likewise, there’s little benefit in paying for Business Premium if nobody is configuring or managing the additional security capabilities.

A security feature that exists in a licence but hasn’t been properly configured may provide little practical benefit.

Microsoft 365 is only one part of business security

Business Premium provides some excellent security capabilities, but it shouldn’t be considered a complete cybersecurity strategy by itself.

Businesses still need to think about areas such as backups, firewalls, DNS security, employee awareness, administrator access, software updates and disaster recovery.

Security works best when these protections are treated as layers rather than relying on any single product.

This is also where a managed IT provider can help. Rather than looking at Microsoft 365 licensing in isolation, the provider can consider how Microsoft 365 fits into the organisation’s broader technology and cybersecurity environment.

Which Microsoft 365 licence should your business choose?

There isn’t one answer that applies to every business.

For a small organisation with straightforward requirements and security provided through other systems, Microsoft 365 Business Standard may be perfectly suitable.

For organisations that want stronger identity security, centrally managed devices and Microsoft’s endpoint-security capabilities, Business Premium can provide substantial additional value.

The important thing is understanding what you’re paying for — and making sure the features you’re paying for are actually configured and used.

Need help reviewing your Microsoft 365 environment?

itX365 helps Perth businesses manage Microsoft 365 licensing, security, users and devices as part of our managed IT services.

If you’re unsure whether your current Microsoft 365 licences are appropriate for your business, we can review your environment and help identify what you actually need.

That approach might have worked when technology played a smaller role in day-to-day business. Today, most businesses depend on technology for almost everything they do.

Email, Microsoft 365, cloud applications, internet connectivity, cybersecurity, backups, phones and business data all need to work reliably — and securely.

That’s where managed IT services come in.

What is managed IT?

Managed IT is an ongoing approach to looking after a business’s technology rather than simply waiting for something to break.

A Managed Service Provider (MSP) takes responsibility for monitoring, maintaining and supporting agreed parts of your IT environment.

Instead of only asking:

“How quickly can we fix this?”

managed IT also asks:

“What can we do to prevent this from happening in the first place?”

That difference is important.

Break-fix IT vs managed IT

Traditional break-fix IT is relatively simple. Something goes wrong, you contact an IT technician, they fix it and you pay for the time involved.

There is still a place for this type of support, particularly for very small businesses with simple IT requirements.

The problem is that the provider is usually involved only after something has already gone wrong.

Managed IT changes the relationship.

Your IT provider becomes involved in the ongoing health of your technology environment, including maintenance, monitoring, security and planning.

The objective isn’t to generate more support calls. It’s to reduce the number of problems that become support calls in the first place.

What does a managed IT provider look after?

Every business is different, but managed IT will typically cover several important areas.

Computers and devices

Business computers need ongoing maintenance.

Operating systems and applications require updates, security patches need to be installed, hardware needs to be monitored and problems should ideally be identified before they cause significant downtime.

Remote monitoring and management tools allow an IT provider to monitor supported devices and perform many maintenance tasks without interrupting the user.

Microsoft 365

Microsoft 365 has become a critical business platform for many organisations.

But buying a Microsoft 365 licence doesn’t automatically mean the environment has been configured appropriately for your business.

A managed IT provider can help administer services such as Exchange Online, Teams, OneDrive and SharePoint while also managing users, permissions, licensing and security settings.

When an employee joins or leaves the business, access to company information also needs to be handled correctly.

Cybersecurity

Cybersecurity is no longer something that only large organisations need to worry about.

Small businesses hold valuable information and rely heavily on their systems being available.

Security should therefore involve multiple layers rather than relying on a single antivirus product.

Depending on the business, this can include:

• Multi-factor authentication
• Endpoint security
• Email protection
• Managed firewalls
• DNS and web filtering
• Security updates and patching
• Access controls
• Monitoring and alerting
• Backup and recovery

The appropriate level of protection depends on the business, the information it holds and the risks it faces.

Backups and disaster recovery

Having data in the cloud doesn’t necessarily remove the need for backup.

Businesses should understand what information is being backed up, where the backups are stored, how long information is retained and — importantly — how that information would be recovered when something goes wrong.

This can include Microsoft 365 data, business servers, applications, databases and other important company information.

A backup that has never been tested shouldn’t simply be assumed to work when it’s needed.

Internet and connectivity

Internet connectivity has become critical infrastructure for many businesses.

If your phones, email, Microsoft 365, accounting system and other applications depend on an internet connection, an outage can quickly become a business outage.

A managed IT provider can help businesses understand their connectivity requirements and determine whether services such as a secondary connection or 4G/5G failover are justified.

The goal isn’t necessarily to eliminate every possible outage. It’s to understand the risk and put sensible measures in place.

Business phone systems

Modern business phone systems are increasingly connected to the rest of the IT environment.

Cloud phone systems, VoIP services, Microsoft Teams integration, mobile applications and internet connectivity all overlap.

Having one technology provider involved across these services can make troubleshooting considerably easier when a problem isn’t clearly an “internet problem”, “phone problem” or “computer problem”.

Working with other technology vendors

One of the less obvious roles of a managed IT provider is dealing with other technology suppliers.

A typical small business may have separate providers for its:

• Internet
• Phone system
• Website
• Printers
• Microsoft 365
• Accounting software
• Industry-specific applications
• Domains and DNS
• Cloud services

When something goes wrong, it isn’t always obvious which provider is responsible.

A managed IT provider can become a central technical contact who understands the environment and can work with other vendors to help resolve problems.

For a business owner or manager, this can remove a lot of unnecessary complexity.

IT planning is just as important as IT support

Good managed IT isn’t only about today’s problems.

Computers eventually need replacing. Servers reach end of life. Software vendors change their requirements. Businesses grow. Employees start working from different locations. Security threats evolve.

An IT provider that understands the business can help plan for these changes rather than dealing with them as unexpected emergencies.

This allows technology decisions to become part of normal business planning.

Does every small business need managed IT?

Not necessarily.

A sole trader with one laptop and relatively simple technology requirements may be perfectly comfortable using IT support only when required.

But the equation changes as a business becomes increasingly dependent on technology.

If several employees rely on Microsoft 365, shared business information, cloud applications, internet connectivity and other systems every day, the impact of downtime or a security incident becomes much greater.

At that point, the question isn’t simply how many computers the business has.

A better question is:

How dependent is the business on its technology continuing to work?

Choosing a managed IT provider

When comparing IT providers, don’t look only at the monthly price.

Ask what is actually being managed.

Does the service include monitoring? What happens to security alerts? Are backups monitored? Who manages Microsoft 365? What happens when an employee leaves? Who looks after the firewall? What support hours are included? What isn’t included?

Most importantly, find out whether the provider is simply offering unlimited support or is actively taking responsibility for maintaining the environment.

There is a significant difference between the two.

A practical approach to managed IT

At itX365, we work with small and growing businesses across Perth to simplify their technology and provide ongoing IT support, security and management.

Our approach is straightforward: understand how the business operates, identify the technology it depends on and put appropriate systems in place to keep it reliable and secure.

That can include Microsoft 365, computers, cybersecurity, backups, internet connectivity, business phone systems, cloud infrastructure and ongoing technical support.

Technology doesn’t need to be complicated for the people using it.

It just needs to work.

Looking for managed IT support for your Perth business?

Talk to itX365 about your current IT environment and where we may be able to help.