The consultancy ran on a mix of Microsoft 365 Business Standard and Basic licences: good for email and documents, but without the security and device-management tools a remote team handling third-party HR data actually needs. Security rested on Microsoft’s default settings alone. There were no Conditional Access policies, no device baseline, and several laptops were only loosely registered rather than properly joined and managed. Their Microsoft Secure Score sat in the mid-60s.
Two things made this urgent. The team wanted Microsoft 365 Copilot, and Copilot is only as safe as the permissions and controls beneath it - it will happily summarise anything a user can open, so over-shared files and unmanaged devices become AI-accelerated leaks. And as a business processing sensitive personal data on behalf of clients, they needed to be able to evidence good security practice, with Cyber Essentials certification as the goal.
Licensing that fits the risk
- Moved the whole team from Business Standard and Basic to Microsoft 365 Business Premium
- Added Microsoft 365 Copilot licences once the security groundwork was in place, not before
- Consolidated licensing and billing under one managed agreement instead of scattered direct subscriptions
Every home device managed
- Every laptop enrolled in Microsoft Intune with a full security baseline: hardening, attack surface reduction, Defender antivirus, firewall and tamper protection
- Stale and unknown devices identified and removed from the tenant
- Controlled Folder Access run in audit mode first, then enforced once the data confirmed it was safe
Identity and access, built for remote work
- Nine Conditional Access policies designed, tested in report-only mode against real sign-in data, then enabled with zero disruption
- MFA for everyone, phishing-resistant MFA for admins, legacy authentication blocked, only managed devices allowed onto company data
- UK-only sign-in restriction and dedicated break-glass access for emergencies
- Orphaned and over-privileged admin accounts found and removed
Data and mail protection
- Anti-phishing with impersonation protection for every named staff member, Safe Links, quarantine and outbound-forwarding controls
- Teams meetings hardened against anonymous join, external-sharing and add-in exposure closed off
- SharePoint idle session sign-out and mailbox auditing for accountability
- Independent Microsoft 365 backup covering mail, files and SharePoint
89% Secure Score
Up from the mid-60s - a top-tier score for a business of any size, let alone a small remote team.
Copilot, safely
Microsoft 365 Copilot enabled on a foundation of managed devices, controlled access and protected data.
Remote-first security
A home-based team with the same device, identity and access controls a corporate office would expect.
Cyber Essentials ready
Every technical control aligned to the Cyber Essentials requirements - certification is now a formality, not a project.
Zero-disruption rollout
Conditional Access proven in report-only mode against live sign-ins before enforcement - nobody locked out.
Client data protected
Sensitive HR records for dozens of client companies now held on managed devices, behind MFA, with backup and audit trails.