IT Strategy for Melbourne Not-for-Profits: Doing More With ACNC-Grade Constraints

Melbourne not-for-profits run on volunteer-grade IT until something breaks. This is a practical strategy guide for NFPs with 25 to 150 staff: maximising the Microsoft non-profit licensing offers, the volunteer-vs-staff identity model, ACNC governance basics for donor data, and a realistic three-year roadmap on an NFP budget.

Why NFP IT looks the way it does

The pattern is consistent across the Melbourne NFP sector. A founder built the IT environment 8 to 15 years ago, probably with the help of a tech-savvy volunteer, and it grew organically as the organisation grew. Permissions accumulated, mailboxes were shared, board members got admin access, a couple of well-meaning contractors built things that nobody now understands. The IT spend looks lean on paper because most of it was donated, volunteered, or quietly absorbed into operational lines. The risk position looks fine until you actually audit it.

The Australian Charities and Not-for-profits Commission (ACNC) governance standards do not prescribe specific IT controls, but they do require that responsible persons act with reasonable care and diligence, that the organisation’s assets (including data) are managed properly, and that conflicts of interest are managed. For an NFP holding donor financial data, beneficiary case files, or vulnerable-person information, IT is in scope for that diligence obligation whether or not the board has framed it that way.

And then there is the funding reality. NFPs are running with thin margins, restricted grants, and a board that wants every dollar to go to the mission. Spending $80,000 a year on IT looks indefensible until you compare it to the cost of an incident that takes the organisation offline for a week. The strategy below is built to maximise the impact per dollar in an NFP context, drawing on a decade of work with Melbourne charities, social enterprises, and community organisations since founding TechAssist in 2014.

Maximising Microsoft non-profit licensing

The single largest cost lever for an Australian NFP is the Microsoft non-profit offer, and it is the one most under-claimed. Eligible organisations (registered charities with ACNC, plus some NDIS providers and educational organisations) can access:

The offers most NFPs underclaim are the Business Premium discount and the Azure credit. We routinely see NFPs running on Business Basic (free) when Business Premium at $8 per user per month would give them dramatically better security at trivial extra cost. We also see NFPs paying for Azure consumption that the annual credit grant would have covered.

A community services NFP in Footscray that we work with had 95 paid staff on Business Basic plus a handful of E3 licences for the leadership team. Migrating the whole organisation to Business Premium (at NFP discounted pricing) cost them an extra $9,500 a year and gave them Defender for Business, Intune device management, conditional access through Entra ID P1, and the foundation for an Essential Eight Maturity Level 1 posture. The same upgrade at commercial pricing would have cost $34,000 a year. The NFP discount made the security upgrade affordable.

The catch with the Microsoft non-profit offers is that they have changed several times over the past three years. The free E1 grant disappeared in 2024; the free Business Basic grant remains but with seat limits; pricing has shifted. The current state at the time of writing is in the Microsoft Tech for Social Impact portal, and we recommend reviewing your entitlements annually. The work to revalidate is small; the saving is large.

Donor data and ACNC governance basics

The IT-relevant parts of ACNC governance for an NFP holding donor or beneficiary data:

Responsible persons and diligence

Governance Standard 5 requires responsible persons (board members, trustees) to act with reasonable care and diligence in the role. In practice, that means the board needs to be able to demonstrate that data assets are being managed properly. The audit trail that satisfies this is documented controls (a basic security policy, evidence of MFA enforcement, a register of vendors processing personal data, an incident response plan). Not enterprise-grade artefacts, but defensible documents that would survive scrutiny.

The Privacy Act position

The Privacy Act small business exemption (under $3 million turnover) used to cover many NFPs. Two important caveats: NFPs providing health services (which is many) do not get the exemption, NFPs that are funded by government contracts may have contractual obligations equivalent to the APPs, and the Privacy Act reforms are narrowing the exemption for everyone. The pragmatic position for an NFP of any size is to operate as if the APPs apply, because the donor base, the grant funders, and the boards increasingly expect that posture. Our piece on the Privacy Act for SMBs and what your IT team must do covers the detail.

Beneficiary case data

For NFPs holding case data on beneficiaries – homelessness services, family violence support, mental health services, refugee support – the data sensitivity is at the highest tier. The controls need to match: encrypted storage, strict access controls, audit logs, MFA enforced for every user, careful management of contractors. Funders for these services often impose explicit data security clauses; the IT posture is contractual as well as ethical.

The volunteer-vs-staff identity model

The identity question is where most NFP IT environments fall apart. A typical mid-sized NFP has paid staff, volunteers, board members, contractors, partner organisations, and donors all interacting with various systems. The traditional approach – everyone gets a full Microsoft 365 licence with full mailbox and tenant access – is expensive, dangerous, and unnecessary.

The model we recommend for Melbourne NFPs:

The Entra ID guest (B2B) model is the unlock. Guests don’t consume Microsoft 365 licences from your tenant; they use their own. You pay for the infrastructure once, and contractors, board members at other organisations, and partner orgs can access scoped resources without licensing cost. For an NFP with 60 paid staff, 20 regular volunteers, 8 board members, 12 contractors, and 4 partner orgs, the licensing footprint is 60 paid licences plus 20 donated Business Basic. The other 24 people are B2B guests at zero licence cost.

The discipline that makes this work is the lifecycle. Guest accounts need to expire when the contract ends; volunteer accounts need to deactivate when the volunteer stops volunteering; board members need their access removed when they leave the board. Without lifecycle hygiene, the tenant fills up with orphaned accounts and the security posture rots. Conditional access policies and access reviews in Entra ID can automate most of this, but somebody needs to set it up and watch it.

Grant-funded vs operational IT spend

One of the structural challenges for Melbourne NFPs: most funders restrict grants to direct program costs, and IT is treated as overhead. The result is a chronic shortfall in IT investment because operational funding does not stretch and grant funding will not cover it.

Three practical strategies:

Bundle IT into program costs where it genuinely is

If a program needs a case management system, the licensing, training, and support for that system is a program cost, not overhead. The same logic applies to the laptops the program staff use, the security tooling that protects the beneficiary data, the M365 licences that enable the case workers to collaborate. Many funders accept this when it is explained. The key is to budget the IT for the program at the proposal stage, with the line items broken out.

Apply for dedicated IT capacity grants

Several Australian foundations and government programs fund organisational IT capacity specifically: cyber security uplift grants, digital transformation grants, infrastructure modernisation grants. They are competitive but real money is available. A heritage and arts NFP we work with in Brunswick received a $45,000 cyber security uplift grant in 2025 that funded the full Essential Eight Maturity Level 1 implementation we had been recommending for two years.

Treat the IT investment as risk mitigation in the board narrative

Boards approve risk mitigation spend when they understand the risk. The ‘this is the security stack’ conversation rarely lands; the ‘a successful cyber attack on this organisation would cost X dollars, take Y weeks to recover from, and trigger Z mandatory disclosures’ conversation usually does. The IT spend becomes risk insurance, which boards understand better than infrastructure.

The realistic 3-year roadmap (25 to 150 staff NFP)

What does a sensible IT modernisation roadmap look like for a mid-sized Melbourne NFP that is starting from a typical legacy posture?

Year 1: Foundation and triage

Year 1 focus: the controls that most reduce risk for the least money. By the end of Year 1 the NFP should have a defensible Essential Eight Maturity Level 1 posture, a documented identity model, and a working DR position. Approximate cost for a 60-staff NFP: $40,000 to $60,000 above the existing baseline, much of which can be partially grant-funded.

Year 2: Optimisation and capability

Year 2 focus: making the staff genuinely productive and reducing the operational tax of accumulated technical debt. The SharePoint rebuild alone often returns 2 to 4 hours per staff member per week in time saved looking for documents.

Year 3: Strategic and scale

Year 3 focus: capability that lifts the mission, not just the operational base. By the end of Year 3 the NFP should be at a mature state where the IT investment is producing visible program impact – more case workers serving more beneficiaries, more donor reach per fundraising dollar, better impact measurement for funders.

The two NFP-specific traps

Two patterns we see repeatedly in Melbourne NFPs that deserve specific attention.

Trap 1: Founder-era shared mailboxes

Almost every long-running NFP has a set of shared mailboxes that date to the founder era: info@, admin@, donations@, volunteers@, plus a clutch of program-specific ones. They were set up with shared passwords, often without MFA, often with everyone who has ever worked there still having access. The risk is enormous and the cleanup is awkward because important communications are routed through them.

The fix is a structured project: identify every shared mailbox, identify the legitimate access list, convert to proper Microsoft 365 shared mailboxes with delegated access (which means access is tied to individual identities, MFA-protected, and auditable), and migrate the workflows that depended on shared passwords to proper licensed accounts. Not glamorous, but it removes a real attack surface. Expect 60 to 100 hours of work for a typical mid-sized NFP.

Trap 2: Board members with full SharePoint access from 2018

Board membership turns over, but historical access often does not. A typical mid-sized NFP has 4 to 8 former board members whose accounts are still active in the tenant with the access they had when they left. Some of them may also be working at competing or partner organisations now. The conditional access policies they fell under in 2018 are not the policies in force today.

The fix is an Entra ID access review, run annually, against the board membership records held by the company secretary. Every former member’s access is removed cleanly. Future board members are onboarded with a clear lifecycle (account provisioned at appointment, access removed within 7 days of departure, conditional access policy enforced).

This sounds like basic hygiene because it is. The fact that it is missing in 80% of the NFPs we have audited is the point.

Security posture: aligning to Essential Eight on an NFP budget

The Australian Signals Directorate’s Essential Eight is the de facto baseline for organisational cyber security in Australia. Maturity Level 1 is achievable for a mid-sized NFP at modest cost when the Microsoft non-profit licensing covers the underlying infrastructure. The strategies that map to NFP-relevant controls:

Maturity Level 1 across all eight strategies, for a 60-staff NFP, is achievable at around $25,000 to $40,000 in tooling and project costs above the existing licensing. Maturity Level 2 adds another $30,000 to $50,000 and is appropriate for NFPs with sensitive beneficiary data or government contracts that require it. For the broader context on aligning to the Essential Eight, our zero trust security model piece covers the complementary thinking.

The MSP question for NFPs

Most Melbourne NFPs that engage an MSP fall into one of three models:

1. Pro-bono or heavily discounted MSP – the MSP donates time, often through their own community engagement program. Variable quality; the MSP’s paying clients always come first.
2. Volunteer-led with MSP escalation – a tech-skilled volunteer manages day-to-day and engages an MSP for specific projects. Works well if the volunteer is genuinely skilled and committed; falls apart when they move on.
3. Standard per-user managed services engagement – the NFP pays standard rates for the engagement, sometimes with a sector discount.

The honest assessment after a decade of NFP work: the third model produces the best long-term outcome. Pro-bono engagements are inconsistent and don’t survive the MSP changing strategy; volunteer-led models work until they don’t, and the transition cost is high. A standard managed engagement at a sector-appropriate rate gives the NFP the same response model as a paying commercial client, which matters when something is on fire at 3 a.m.

For TechAssist, our NFP engagements run on the same model as our commercial managed clients: per-user fixed monthly pricing, sub-15-minute P1 response from our 24/7 NOC at Tecoma, same-business-day on-site response across Melbourne metro from our two offices (Tecoma and 575 Bourke Street CBD), and the same 13 Australian engineers across helpdesk, projects and security. We typically offer a sector-appropriate rate that reflects the NFP budget reality, but the service is the same. The discipline of running it as a real engagement is what makes it work for both parties. To talk through an NFP engagement, our team is reachable through the contact page, or our Melbourne managed IT services page covers the broader engagement model.

Frequently Asked Questions

We are a very small NFP (under 25 staff). Does this strategy still apply?

Most of it does, scaled down. The Microsoft non-profit licensing maximisation is still the biggest lever. The identity model still matters even at smaller scale. The Essential Eight Maturity Level 1 alignment is still achievable. The MSP engagement is the piece that scales differently; for very small NFPs, a co-managed model or a sector-shared service can be more affordable than a per-user managed engagement. Our co-managed IT support page covers that model.

How do we get board buy-in for an IT investment that competes with program funding?

Frame it as risk mitigation and capacity-building, not infrastructure. The board cares about the mission and about not having a catastrophic incident; they typically do not care about Entra ID conditional access policies. Show the worst-case scenarios with realistic numbers, show what an Essential Eight Maturity Level 1 posture costs to put in place, and frame the spend as protecting program continuity. Most boards approve when the trade-off is framed honestly.

What is the single most impactful change for an NFP starting from a typical legacy posture?

Enforcing multi-factor authentication on every account, with no exceptions for the founder, the board, or ‘the person who has been here forever.’ It costs nothing beyond the Microsoft licensing you already have. It prevents the most common attack pattern. It is the change most NFPs delay because it is annoying for users in the first week, and the change that most NFPs regret delaying after the first incident.

Can we just rely on the donated free Microsoft 365 Business Basic?

For very small NFPs with low risk profiles, possibly. For most mid-sized Melbourne NFPs holding donor or beneficiary data, no. Business Basic does not include Defender for Business, does not include Intune device management, and does not include the conditional access capabilities that an Essential Eight posture requires. The Business Premium upgrade at NFP-discounted pricing is one of the highest-ROI spending decisions an NFP can make.

How do we handle the long tail of historical accounts in our tenant?

Run an Entra ID access review, focused on accounts that have not signed in for 90 days. Most are former staff, former volunteers, former board members, or test accounts that were never cleaned up. Disable them (do not delete immediately; the licence cost is zero and the audit trail is valuable). After 90 days of being disabled without complaint, delete. The cleanup typically removes 20 to 40% of the tenant accounts in a long-running NFP.

Where do we start if we have no IT documentation at all?

Start with three documents: a tenant configuration baseline (what is currently configured, by whom, for what reason), an asset list (devices, accounts, key vendors), and a basic incident response plan (who calls whom when something happens). These three documents are 80% of the audit-readiness conversation and form the foundation that everything else builds on. The work is typically 20 to 30 hours of MSP time and is some of the highest-value spending in the first year of a managed engagement.

Not-for-profit IT in Melbourne is different from commercial SME IT in four practical ways: discounted Microsoft 365 nonprofit licensing through TechSoup Australia, much higher user churn from volunteers, stricter donor-data privacy obligations under the APPs, and a board that expects IT spend justified against the mission and ACNC reporting.

That mix changes how we scope, price, and run support for charities and community organisations. If you treat an NFP like a 30-person law firm, you’ll over-engineer some things, miss compliance gaps elsewhere, and quietly burn through the small operating surplus the board has fought to protect.

This piece walks through what genuinely differs about not for profit it services melbourne organisations need, where the savings really are, where the risks hide, and what we’ve learned running IT for charities, community legal centres, peak bodies, and social enterprises across Greater Melbourne.

Why NFP IT is its own discipline

Most MSPs treat NFPs as small businesses with a tighter budget. That’s lazy and it costs you money. A 40-person charity in Carlton running donor records, a volunteer roster of 200, an ACNC Annual Information Statement, and a Salesforce NPSP instance has more compliance surface than a 40-person engineering firm. The complexity sits in different places, not in fewer places.

The four pressure points we see consistently:

• Licensing eligibility and renewals. Microsoft 365 Business Premium retails around $30 per user per month. For eligible NFPs through TechSoup Australia, equivalent licensing can drop to a small admin fee per year. Get the eligibility wrong, or let DGR status lapse, and the saving evaporates.
• Volunteer lifecycle. Paid staff might churn at 10 to 15 per cent per year. Volunteer access turns over far faster — short placements, event crews, board members rotating off. Identity hygiene is the single biggest control gap we find in NFP audits.
• Donor-data sensitivity. A donor list is regulated personal information under the Privacy Act and the Australian Privacy Principles. Fundraising compliance varies by state. Most boards don’t know where their donor database actually lives or who can export it.
• Mission-aligned spend. Every dollar spent on IT is a dollar not spent on programs. The board will ask. Your MSP needs to be able to defend the spend in plain English against program outcomes, not feature lists.

Microsoft 365 nonprofit licensing — what actually qualifies

This trips people up more than any other single thing. Microsoft’s nonprofit program in Australia runs through TechSoup Australia (the merged Connecting Up service). To qualify, your organisation generally needs:

• Endorsement as a charity by the ACNC, or eligibility as a deductible gift recipient (DGR) under the ATO, or recognition as an NFP under specific categories Microsoft accepts
• A mission that meets Microsoft’s anti-discrimination policy
• Re-validation roughly every two years

Common stumbles: a social enterprise structured as a company limited by guarantee but without ACNC endorsement, an auxiliary or fundraising entity that doesn’t itself hold DGR status, or a hospital foundation that assumes the parent entity’s status carries across. None of those automatically qualify.

When eligibility is confirmed, the savings are significant. Business Premium grants for up to ten users plus discounted licensing beyond that, free Exchange Online Plan 1 grants, and discounted Power Platform and Azure credits. For a 40-staff charity, the annual Microsoft saving versus commercial pricing typically runs $12,000 to $18,000. That’s a part-time program worker. It’s worth getting right.

We handle the TechSoup validation, link the tenant to the nonprofit program, set up the grants correctly, and diarise the re-validation so it doesn’t lapse mid-financial-year. More on the platform piece at our Microsoft 365 page.

TechSoup Australia beyond Microsoft

Worth naming because most NFP managers under-use it. TechSoup Australia (connectingup.org) brokers donated and discounted software, hardware, and services for eligible NFPs. Beyond Microsoft, the catalogue covers Adobe, Autodesk, Bitdefender, Cisco Webex, Tableau, Zoom, and a long tail of sector-specific tools.

Hardware is more limited but worth checking — refurbished laptops and desktops are sometimes available at sharp prices for small charities. Where new hardware is needed, we’ll often spec mid-range business-grade machines and budget for a 4-to-5 year refresh cycle rather than the 3-year cycle commercial clients run, because the cashflow profile suits NFPs better and the warranty exposure is manageable.

The governance burden — what your board actually needs

Commercial directors care about uptime and cost. NFP boards care about uptime, cost, mission alignment, risk, and the Annual Information Statement. The reporting cadence is different.

A useful NFP IT governance pack, delivered quarterly to the board, contains:

• Operational summary — tickets resolved, P1 incidents, average response, uptime
• Risk register update — top three IT risks with current mitigations and residual rating
• Privacy and donor-data control status — who has access to the CRM, MFA coverage, recent access reviews
• Spend against budget and mission alignment — what was spent and how it served the program
• Compliance calendar — ACNC due dates, cyber insurance renewals, software re-validations

This is not heavy. Done properly it’s two pages plus appendices. But it’s the artefact that lets the board sign off the IT spend without flinching, and it’s the artefact that auditors (internal and external) lean on at year end. If your current MSP isn’t producing something like this, ask why.

Donor data and the Privacy Act

If your NFP has annual turnover over $3 million, the Privacy Act applies in full and the Australian Privacy Principles are mandatory. Below that threshold, you may still be caught — for example, if you provide health services, hold tax file numbers, or have opted into the Act voluntarily. Many DGR-status charities are caught regardless of turnover because of the type of information they hold.

Practical implications for IT:

• Donor records must have access controls and an access log. A shared “fundraising” mailbox with the password on a sticky note is not defensible.
• Exports of donor lists need to be auditable. Power Automate alerts on bulk exports from your CRM are simple and cheap to set up.
• The Notifiable Data Breaches scheme applies. You need an actual incident response plan, not just a vague “we’ll call the MSP” — including who notifies the OAIC and on what timeframe.
• Fundraising agencies and external suppliers handling donor data need contractual privacy clauses and an annual review.

This sits alongside broader security posture work — MFA everywhere, conditional access, endpoint protection, mailbox audit logging. The full picture is on our cybersecurity services page.

Volunteer access — the silent risk

A community legal centre in Footscray we onboarded had 47 active Microsoft 365 accounts on a paid-staff headcount of 22. The rest were volunteers and former volunteers who’d never been offboarded. Three accounts hadn’t logged in for over two years but still had access to client matter folders. None had MFA enrolled. The original IT contact had left 18 months earlier and the handover was a single shared spreadsheet.

We cleaned it up over a fortnight — proper joiner-mover-leaver process, a volunteer access tier with restricted permissions, time-boxed accounts that auto-disable after 90 days of inactivity, and MFA enforced via conditional access. Annual cost impact: minimal once the cleanup was done. Risk reduction: enormous.

The pattern repeats. NFPs need a different identity model — one that assumes high volunteer churn and treats short-term access as the default, not the exception. Group memberships driven by HR data, not manually maintained. Self-service password resets so the operations manager isn’t fielding calls on a Saturday.

Pricing models that actually work for NFPs

The fully managed, per-user fixed monthly model still works for NFPs — it just needs to be priced honestly against the user mix. We bill paid staff at the standard per-user rate and volunteer accounts at a reduced rate that reflects the lower support load and lighter device footprint.

Some MSPs offer “pro bono” arrangements. Treat them carefully. Pro bono can mean genuinely donated time from a community-minded MSP, or it can mean a junior tech with no backup and no SLA. Ask the questions: who covers if the named engineer is on leave, what’s the response time, what happens at midnight when ransomware lands. If those answers are vague, the arrangement will fail when you most need it.

Our model: 13 Australian-based engineers, sub-15-minute P1 response, 24/7 NOC at Tecoma, per-user fixed monthly with NFP rates for eligible organisations. Predictable, accountable, defensible to the board.

NFP-specific platforms — Salesforce NPSP, Blackbaud, iMIS, Donortec, ThankQ

The CRM choice in the NFP sector is more fragmented than commercial. We see and support:

• Salesforce Nonprofit Cloud / NPSP — powerful, scales well, free for first 10 users via Salesforce.org, but real implementation costs and admin overhead. Best for organisations $5m+ turnover or with complex program data.
• Blackbaud Raiser’s Edge NXT — donor-focused, strong for traditional fundraising charities, weaker for case-management workflows.
• iMIS — common for peak bodies and member associations, integrates membership and events.
• Donortec / ThankQ — Australian-grown, strong fit for mid-sized fundraising charities, sensible licensing.
• Microsoft Dynamics 365 (with nonprofit accelerator) — viable if you’re already deep into Microsoft and want tighter integration.

Where we add value isn’t reimplementing the CRM — there are specialist NFP CRM partners who do that well. Our role is the Microsoft 365 integration layer: single sign-on so volunteers don’t have ten passwords, Power Automate workflows that move data between the CRM and finance system, mailbox routing for donor communications, document storage that respects the privacy controls in the CRM. That’s where most of the day-to-day friction lives.

NFP IT vs commercial SME IT — the practical differences

A worked scenario — Carlton health-promotion charity

A health-promotion charity in Carlton came to us with 28 paid staff, around 60 active volunteers, and a Salesforce NPSP instance about three years old. They were paying full retail for Microsoft 365 because their previous IT provider had never enrolled them in the nonprofit program. MFA was on for finance staff only. The board was asking for cyber insurance and the underwriter had sent back a 47-question security questionnaire that no one knew how to answer.

What we did over the first 90 days:

• Validated ACNC and DGR status, completed TechSoup registration, migrated their Microsoft 365 tenant to the nonprofit grant tier. Annual saving: $11,800.
• Built a tiered identity model — paid staff, board, standing volunteers, event volunteers — with conditional access policies for each. MFA enforced across the tenant.
• Cleaned up 14 dormant accounts, recovered 9 unused Salesforce licences.
• Implemented a joiner-mover-leaver workflow tied to their HR system so volunteer access auto-expires.
• Wrote the responses to the cyber insurance questionnaire and produced an evidence pack. Premium came in 30 per cent lower than the original quote.
• Set up the quarterly board IT report template, walked the operations manager through delivering it.

Net result: annual IT spend dropped by roughly $7,500 versus their previous arrangement (after our fees), security posture moved from poor to defensible, board confidence in IT measurably improved. Nothing exotic — just NFP-aware execution.

Where to start if you’re reviewing your IT now

If you’re an NFP exec or operations manager and any of the above is unfamiliar, three practical first steps:

1. Confirm your Microsoft 365 licensing tier. Log into the admin centre, look at the subscription page, and check whether you’re on commercial or nonprofit SKUs. If commercial, you’re probably overpaying.
2. Audit your active user accounts against your current paid staff list and current volunteer roster. Anyone in the directory who isn’t on either list is a risk and a cost.
3. Check who can export your donor database. If the answer is “anyone in fundraising” or you’re not sure, that’s the first control to tighten.

None of those need an MSP to do. They need 90 minutes and a willingness to look. What an MSP brings is the execution capacity to fix what you find, and the ongoing discipline to keep it fixed.

For broader context on how the day-to-day support model works, our managed IT services overview covers the operational side, and the IT support page covers helpdesk specifics.

FAQ

Do you offer NFP discounts?

Yes. Eligible NFPs — ACNC-endorsed charities, DGR-status organisations, and recognised community organisations — receive reduced per-user rates on our managed plans. Volunteer accounts are billed at a further reduced rate that reflects the lighter support profile. We’ll quote transparently against your user mix and you can defend the spend to the board line by line.

How do we qualify for Microsoft 365 nonprofit licensing?

You’ll need ACNC charity endorsement, DGR status, or recognition as an NFP under one of Microsoft’s accepted categories, plus a mission that meets their anti-discrimination policy. Validation runs through TechSoup Australia and is typically required every two years. We handle the registration, tenant configuration, and re-validation reminders so it doesn’t lapse.

What about ACNC reporting requirements for IT spend?

The ACNC Annual Information Statement doesn’t break IT out as a separate line, but your audited financials will, and your board expects justification. We produce a quarterly IT governance report covering spend against budget, risk register status, privacy controls, and mission alignment. It’s two pages plus appendices and it’s designed to drop straight into board papers.

Can volunteers safely use Microsoft 365 without compromising donor data?

Yes, with the right configuration. The model we use is a tiered identity setup — volunteers get accounts with restricted permissions, no access to donor databases or finance, conditional access policies that enforce MFA, and time-boxed access that auto-disables after defined periods. Done properly, volunteers can collaborate effectively without ever touching regulated data.

What if we already have an MSP but suspect they’re not NFP-aware?

Ask three questions. One, are we on Microsoft 365 nonprofit SKUs and when does the validation renew. Two, can you show me the last access review for our CRM. Three, can you produce a one-page IT report I can take to the board. If any of those land badly, it’s worth a second conversation. Reach out via our contact page or call 1300 028 324 — happy to talk through it without pressure.

NFP IT done well is quiet, predictable, and defensible at the board table. It’s not magic. It’s just attention to the things that genuinely differ — licensing, identity, donor data, governance — and the discipline to keep them right year after year. If you’d like a sanity check on where your organisation sits, get in touch.