Microsoft 365 consulting & support · Hamburg Setting up, securing and supporting Microsoft 365.
Microsoft 365 consulting for companies in Hamburg and remotely: I align identities, devices, email, data and collaboration, from licensing and migration through to security and governance.
How Microsoft 365 has often grown
When I review a Microsoft 365 tenant for the first time, I almost always find the same things. MFA is only partly enabled, some accounts hold permanent global admin rights and are used day to day, and former employees still have active or licensed accounts. Sharing via “anyone with the link” runs unchecked.
Teams have been created without naming or ownership rules, files sit on the file server and in SharePoint at the same time, and there is no backup beyond the recycle bin. Often the tenant still runs on its default configuration: the security features are there but have never been set up for the company, and alongside that, licences are paid for that nobody uses.
What makes a good environment
A cleanly structured and secured Microsoft 365 environment: the right licences, protected identities, managed devices, clear rules for Teams, SharePoint and OneDrive, and documentation your in-house IT can carry on itself. That lays the basis for collaboration, compliance and using Copilot and automation. If you want, I take over day-to-day operations as part of ongoing IT support.
What I take on for Microsoft 365.
Microsoft 365 does not automatically mean Windows. I design and run fully Mac-based company environments just as readily, with Intune, Entra ID and Apple Business Manager — from projects I know these at over 150 staff.
-
Tenant and licence audit
A review of your Microsoft 365 tenant covering security, configuration and licences: what is missing, what is paid for but not switched on, and which measures make sense in which order. You then find the results in your customer portal.
-
Tenant design and governance
Built to clear rules: identities, policies, naming conventions, storage locations and access rights for Teams, SharePoint and OneDrive.
-
Identity and access management
Entra ID with multi-factor authentication, Conditional Access, a role model and protection for privileged accounts.
-
Device management
Managing, securing and provisioning Windows and macOS devices centrally and to a standard, with Microsoft Intune and, for Apple devices, through Apple Business Manager: compliance policies, FileVault and BitLocker, software deployment, device configuration and automated onboarding. iPhones and Android devices run in the same system. Building device management from scratch or migrating from another MDM.
-
Migration and go-live
Moving from Exchange, IMAP, Google Workspace or file servers to Exchange Online and SharePoint, plus tenant-to-tenant migrations after acquisitions or a change of company name.
-
Security and compliance
Microsoft Defender, technical data protection and compliance settings, retention policies and backup for Microsoft 365.
-
Training and adoption
Briefings for staff and in-house IT so new structures actually take hold day to day.
-
Copilot readiness
Preparing permissions, data quality and governance so Microsoft 365 Copilot can be introduced safely.
How secure is your tenant?
I check your Microsoft 365 tenant against recognised frameworks and show where action is needed. The first check is free, with a short assessment as a PDF.
Get the free check→- Checks
- ~500 Checks
- Areas
- 12 Areas
- Frameworks
- 5 Frameworks
What I look at first
Security comes early. MFA and Conditional Access are among the first things I tackle, while the environment is still being reorganised. Security defaults are not enough for that; I replace them with Conditional Access as soon as possible. I always set up emergency access accounts, and administrators receive their rights only for a limited time through Privileged Identity Management, in small companies too.
When migrating from a file server, I do not copy the folder structure one to one. SharePoint works with few levels and several document libraries; I set permissions per library before the data moves. I train staff before the switch. Whether mailboxes move in waves or on a single date depends on size and starting point. I announce noticeable changes in advance, so that not everyone calls IT at the same time on the first morning.
What I advise against
Business Basic and Business Standard lack too many security features for today’s requirements, and managing devices needs Business Premium. E3 or E5 is unnecessary for most companies below 300 users: Business Premium for staff plus add-on licences such as Entra ID P1 or P2 for the IT team covers a great deal. Which features often go unused is covered in the article Business Premium: paid for, but not switched on.
Large CAD or media files rarely belong entirely in SharePoint. I only recommend Copilot once permissions have been cleaned up. The most common mistake I see is at rollout: staff are sent into Teams and SharePoint without guidance. Besides sprawl, misunderstood sharing often leads to real data protection problems.
The building blocks I work with.
These are the building blocks I use, depending on the requirement.
- Entra ID
- Central identities, roles and single sign-on for Microsoft 365 and connected applications.
- Conditional Access
- Controlling access by user, device, location and risk.
- Intune
- Device management for Windows, macOS, iOS and Android: configuration, compliance, app deployment, BitLocker and FileVault.
- Exchange Online
- Mailboxes, rules, archiving and protection against spam and phishing.
- SharePoint, Teams, OneDrive
- File storage and collaboration with governance rules and permissions you can follow.
- Microsoft Defender
- Protection for devices, email and identities within Microsoft 365.
- Privileged Identity Management
- Time-limited admin rights, with justification and audit trail. Requires an add-on licence such as Entra ID P2 for the administrators.
How a rollout or migration runs.
-
01
Analysis
Tenant review, licences, requirements and goals.
-
02
Design
A target picture for identities, devices, governance and migration, with sequence and effort.
-
03
Delivery
A gradual rollout and migration during normal operation: security first, then structure.
-
04
Operation
Documentation, training and, if you want it, an ongoing managed service.
Questions about Microsoft 365.
Your question isn't here? Write to me directly.
Usually yes. Most tenants have grown over the years. In the audit I check identities, admin rights, Conditional Access, email protection, sharing and device management against the features your licences already include. In parallel I analyse the licences: unused licences, suitable terms and where a switch makes sense. I go through the results with you, and they become an action plan with effort and sequence. What that looks like in practice is shown by a security concept for Microsoft 365 from a client project.
For many small and mid-sized companies Business Premium is a sensible starting point, because device management and important security features are already included. Which licence fits, however, depends on what you actually need. I do not recommend the larger licence automatically just because it can do more.
Through Intune and Apple Business Manager, on an equal footing with Windows devices: automated provisioning, compliance policies, FileVault and software deployment. For heavily Apple-based environments a specialist MDM such as Mosyle or Jamf can be the better choice. I support both and handle migrations between MDM systems. I have summarised the differences in a comparison of Intune, Mosyle, Jamf and Iru.
Nothing is changed. For the review I use access with read-only permissions that is closed again directly after the data has been retrieved. The access remains traceable in your tenant. If you want to keep an eye on things continuously, you receive a monthly report as part of IT support.
Want to talk through a specific project?
Send me a couple of lines about it, or just call. You reach me directly, no call centre.