Azure Cost Creep: A FinOps Starter Guide for Melbourne SMEs

Azure costs for Melbourne SMEs grow 30 to 50% a year without anyone noticing. Enterprise FinOps assumes a $5 million cloud spend; this is the SME version, sized for the $50k to $500k reality. Eight quick wins, governance guardrails that stick, and the three traps that catch almost every business.

Why SME Azure spend creeps

It is rarely one decision. A pilot tenant becomes a production tenant. A test virtual machine becomes a forgotten orphan with a 1 TB premium SSD attached. Defender for Cloud gets enabled on a free trial, ends up on the Standard tier across every subscription, and nobody can find the off switch by the time the invoice arrives. The dev environment that was ‘just for two weeks’ is still running 18 months later because no one wants to be the person who turned it off.

We see the same pattern across our managed clients. A business signs up for Azure at $3,000 a month. Two years later it is $11,000 a month, the workloads have not materially expanded, and the CFO is asking the right question for the first time. By then the answer is harder than it would have been at $4,000.

FinOps as a published discipline (the FinOps Foundation maintains the framework, Microsoft has published its own opinionated version) assumes you have a cloud platform team, a financial analyst, and an executive sponsor. For a 60-staff Melbourne business with a quarter-million-dollar Azure footprint, that is overkill. The lite version below takes the parts of FinOps that apply at SME scale and ignores the rest. We run this across professional services, manufacturers and not-for-profits as part of our Melbourne cloud services work.

What ‘normal’ SME Azure spend looks like

Some benchmarks from our managed book, useful as sanity checks on whether your number is in the right zone.

If your number is materially above the band for your profile, there is almost certainly waste. If your number is materially below, either you are doing something genuinely clever or you have under-provisioned somewhere that will cause a production incident later.

The eight quick wins

Most SMEs can take 20 to 35% off their Azure bill in a fortnight of focused work, without changing anything about what the business does. The targets in order of effort-to-saving ratio:

1. Rightsize the virtual machines

The Azure Advisor and the Azure Migrate tools both flag VMs running well below their provisioned capacity. The reality is most SMEs have two or three D8s_v5 instances that were sized off a panicked guess at the start of a migration and have been running at 8% CPU ever since. Moving them down two or three sizes typically saves 60 to 75% of the per-VM cost. Validate with seven days of metrics first; do not just take Advisor’s word for it.

A classic example: a 55-staff engineering consultancy running its file server VM as a D16s_v5 because the original migration consultant ‘matched the on-prem CPU count’, when seven days of metrics show 4% average CPU. Rightsizing to a D2s_v5 saved $720 a month with zero user-visible impact.

2. Kill the orphaned disks

Every time someone deletes a VM through the portal, the OS disk and any data disks survive unless deletion was explicitly chosen. Over a few years, an SME tenant will accumulate 20 to 60 orphaned managed disks, often premium SSDs at $0.15 per GB-month. A 1 TB orphaned premium disk is $150 a month for storing absolutely nothing useful.

Run a quick KQL query in Azure Resource Graph to find disks where ManagedBy is empty. Validate that none of them are being held intentionally (some teams keep a disk for a few months as a ‘soft delete’ before truly removing it), then delete the rest. Easy win, usually $400 to $1,200 a month.

3. Reserved instances or savings plans for the steady-state workloads

Anything that runs 24/7 in steady state – production servers, domain controllers, a SQL VM, a file server – is paying full pay-as-you-go pricing by default. A one-year Reserved Instance is roughly 30% cheaper; three years is closer to 50%. The Azure Savings Plan for compute is more flexible (it covers any VM family in any region for the commitment amount) but a slightly lower discount.

The decision rule we use: if the workload is going to run for at least the next 12 months as-is, take the one-year reservation. If it might move, resize, or change family within that window, take the savings plan. Three-year commitments only for genuinely static workloads.

4. Auto-shutdown for dev and test

Dev and test VMs do not need to run on weeknights or weekends. A standard Azure Automation runbook or the built-in Azure DevTest Labs auto-shutdown can cut a non-production VM bill by 65 to 75%. The cost is two hours of configuration and a 30-second wake-up delay when someone needs the box at 7am Monday. We have yet to meet a dev team that genuinely objected once the saving was shown.

5. Azure Hybrid Benefit

If you have Windows Server or SQL Server licences with active Software Assurance, the Azure Hybrid Benefit lets you bring those licences to Azure VMs and stop paying the per-hour Windows or SQL surcharge. The saving on a Windows Server VM is typically 40%; on a SQL VM it can be 60 to 75%. Almost every SME with Software Assurance is leaving this on the table because nobody enabled the toggle at deployment.

Check your existing fleet through Cost Management. Filter by ‘Windows’ or ‘SQL Server’ as a meter category. Anything not marked as Azure Hybrid Benefit is overpaying.

6. Archive cold storage

Storage account blobs default to the Hot tier. Anything older than 30 days that you have not touched should be in Cool ($0.0152 per GB-month versus $0.0184 for Hot) or, for compliance archives, the Archive tier ($0.00099 per GB-month). Lifecycle policies on the storage account do this automatically.

For a healthcare business with a 14 TB compliance archive, moving the long-tail blobs from Hot to Archive saves in the order of $230 a month. A small number per month but a clean, automated saving that compounds as the archive grows.

7. Kill unused public IPs

A standard static public IP is roughly $4.50 a month. Trivial individually, but most SMEs have 15 to 40 of them, half of which are unattached from their original VM or load balancer. Run an Azure Resource Graph query for public IPs with no associated resource, validate, delete.

8. Review egress

Outbound data transfer (egress) from Azure to the internet is roughly $0.087 per GB after the first 100 GB free per month. Backup tools that pull data out of Azure, a misconfigured replication target that goes through public endpoints rather than peering, a video conferencing recording archive that streams out to a local NAS – all of these can quietly produce $400 to $1,500 a month in egress charges that nobody knows about.

The fix is usually a routing change (route the traffic through a private endpoint or service endpoint) or a topology change (move the target into Azure rather than pulling the data out). The win is identifying the source first; Cost Management broken down by Meter Subcategory shows you where the egress lives.

The governance guardrails that actually stick

Quick wins are easy. Stopping the spend from creeping back up over the next 12 months is the hard part. The lightweight controls we recommend for SMEs – the parts of the textbook that work at this scale:

Subscription-level budgets and alerts

One budget per subscription, set to the monthly run rate plus 15%, with alerts at 80%, 100%, and 120%. The alerts should go to a real person (the CFO and the IT lead), not a shared mailbox. The 80% alert is the one that catches the problem before it becomes a quarterly variance discussion.

Do not bother with budgets at the resource group level for an SME; the maintenance overhead is not worth the precision. The subscription is the right granularity.

Tagging that the team will actually do

Enterprise FinOps documents will tell you to enforce 14 mandatory tags. The team will rebel. For SME purposes, three tags are enough: Environment (Prod / Dev / Test), CostCentre (or Department), and Owner (a person, not a generic mailbox). Enforce them with Azure Policy at subscription creation time so any new resource without the three tags is blocked.

Three tags get used. Fourteen tags get ignored, and then nothing gets used.

Quarterly cost review

One hour every three months. The IT lead and the CFO sit down with Cost Management, look at the trend, look at the top ten cost drivers, look at the variance against budget, and decide whether to act. That is the entire process. The output is a one-page note for the leadership team and a list of remediation actions for the next quarter.

This is the rhythm we run with our managed clients. It is also the rhythm where most of the savings actually surface, because it forces someone to look at the data on a cadence that catches problems while they are small.

The three traps

Three patterns catch almost every SME on Azure. Worth understanding them before they catch you.

Trap 1: Lift-and-shift over-provisioning

The most expensive single mistake we see. A business migrates 12 servers from VMware to Azure and tells the migration partner to ‘match the existing VM sizes.’ The existing on-premises VMs were sized for peak load that occurs maybe twice a year, on hardware that was bought five years ago. The Azure VMs run hot for two hours a quarter and idle the other 99% of the time, but are billed at peak capacity every hour. Add up across 12 VMs and you are paying three times what the workload needs.

The fix is to size for Azure metrics, not on-prem habits. Migrate first, then watch the metrics for two to four weeks, then rightsize aggressively. We have done this exercise often enough now that we build the rightsizing step into the migration plan from the start. If the migration partner does not include a post-migration optimisation phase, that is a warning sign.

Trap 2: The dev environment that became production

A developer or contractor spins up a dev environment to test a workload. The business comes to rely on it. Three years later it is processing real production data on a ‘temporary’ subscription with no monitoring, no backup, no DR, and no reserved instances. It is also costing twice what it should because no one ever optimised it.

The fix is governance at the subscription creation step. No new subscription without a documented owner and an explicit lifecycle (this is a permanent prod subscription, or this is a 90-day project subscription with an automatic shutdown date). Cleaning up after the fact is harder than preventing it.

Trap 3: Defender for Cloud tier sprawl

Defender for Cloud is genuinely good, and the Standard tier offerings (Defender for Servers, Defender for SQL, Defender for Storage, Defender for Containers, Defender for App Service, and so on) protect real attack surfaces. The trap is that they bill per resource and the tiers are enabled per subscription. Click the wrong toggle and you have Defender for Servers Plan 2 running on every VM across every subscription for $24 each per month.

We have seen SMEs paying $4,000 a month for Defender coverage when their actual security need would be served by $800 of targeted enablement. The fix is to choose the plans deliberately, enable per subscription, and review quarterly. Defender for Servers Plan 2 on the workloads that need it; off everywhere else. Defender for Storage on accounts with sensitive data; off on the public assets bucket. The protections matter; the indiscriminate enablement does not.

For the security-side conversation about what to leave on, our Melbourne cyber security services page outlines the decisions we apply on the managed side. Cost and security are the same conversation in Azure; you cannot optimise one without involving the other.

What the FinOps tooling landscape looks like for SMEs

The third-party FinOps tools (CloudHealth, Cloudability, Apptio Cloudability, Flexera) are excellent but enterprise-priced. For an SME at $50k to $500k annual Azure spend, the native Azure tooling is enough:

If your spend grows past $1 million a year, the third-party tools become defensible. Below that, the native tooling is fine and the discipline matters more than the platform.

A small-business worked example

Take an illustrative 65-staff manufacturing business with an Azure bill of $14,800 per month and a CFO who cannot get a straight answer about why. Two weeks of focused work:

• Rightsized seven over-provisioned VMs, saving $2,100 per month
• Deleted 23 orphaned premium disks, saving $1,400 per month
• Applied Azure Hybrid Benefit to 12 Windows VMs (they had Software Assurance through their CSP and no one had enabled the toggle), saving $1,800 per month
• Switched the steady-state production workloads to one-year savings plans, saving $1,200 per month
• Set up auto-shutdown on the dev and test environments, saving $600 per month
• Identified and re-routed an egress problem through a private endpoint, saving $400 per month
• Trimmed Defender for Cloud tier coverage to the workloads that actually needed Plan 2, saving $700 per month

Total monthly saving: $8,200, or about 55% of the original bill. The new run rate of $6,600 per month is a defensible number for the workload, with no production impact and no reduction in security posture (in fact a more deliberate one). Subscription budgets, three-tag enforcement, and quarterly review cadence are now in place. The job took us about 70 hours across two engineers from our 13-strong Melbourne team and was delivered alongside the regular per-user fixed monthly managed IT engagement.

FinOps and the broader cloud strategy

Cost optimisation is one strand of a wider conversation about whether the cloud architecture is right for the business. Sometimes the answer to a high bill is to optimise; sometimes it is to redesign. A 24/7 SQL workload that processes a fixed batch overnight may be better suited to Azure SQL serverless or even a scheduled VM. A file server that nobody touches for three months at a time might belong in Azure Files cool tier with a small AVD presence on demand. These are not quick wins; they are architecture changes. But once the quick wins are taken, the conversation moves to design.

For Melbourne SMEs that want a second opinion on whether the architecture is right before committing to another year of the existing spend, we run cloud architecture reviews as a discrete piece of work, separate from ongoing managed services. They are useful at the 12-month mark of any non-trivial Azure deployment. Reach us through the contact page if that is the conversation you need.

Frequently Asked Questions

Should we move away from Azure to save money?

Almost never the right answer for a workload that is already in Azure. Egress fees on a full re-platform are punishing, the operational disruption is real, and the cost difference between Azure, AWS and GCP for SME-typical workloads is usually under 15% once both are properly optimised. Optimise what you have before considering a move. The exception is a workload that genuinely fits a different platform’s primitives better (a heavy GCP BigQuery analytics workload, for example).

How often should we revisit our reserved instance commitments?

At the renewal point and at any major workload change. The Azure Savings Plan is more flexible than the older Reserved Instances because it does not lock you to a VM family; if your workloads shift, the savings plan keeps applying. We typically recommend a mix: reservations for the most stable workloads (domain controllers, file servers, the SQL VM that has run unchanged for three years), savings plans for the rest.

What does FinOps mean for our cloud backup and DR spend?

Backup storage tends to live outside the day-to-day cost conversation and grows quietly. Same principles apply: tier the storage (most backup data can live in cool or archive after 30 days), review retention against actual recovery needs, and watch the egress when you do a restore. Our companion piece on backup and disaster recovery for Melbourne businesses goes deeper on the design decisions.

Do we need a dedicated FinOps person?

Not at SME scale. The work is two to four hours a month for an experienced engineer plus a quarterly review with the CFO. We run it as part of the managed engagement for clients on our per-user fixed monthly pricing model. Hiring a dedicated FinOps person is a sensible move at around $2 to $3 million annual cloud spend, not before.

Will the optimisation work introduce risk to production?

It can if it is done carelessly. The discipline is: validate against metrics before any resize, take a backup before any storage change, do the work in a maintenance window, and have a rollback path. Done carefully this does not cause production incidents, but the process matters. A weekend cowboy resize of a production SQL VM is how you cause an incident.

What is the role of the CFO in cloud cost management?

The CFO owns the budget and the variance conversation; the IT lead and the MSP own the technical optimisation. The quarterly review is the meeting where those two functions talk to each other. Most SME cost creep we see comes from a lack of that conversation rather than from any technical failure.

Most Microsoft 365 vs Google Workspace comparisons are written by Microsoft Partners and read like a sales pitch. Here is the straight version. Google wins for sub-15-person startups, design agencies, and web-native teams. Microsoft wins for anything compliance-driven, anything with Windows endpoints, and anything that touches Excel-heavy finance or operations tooling.

That is the headline. The rest of this article shows the working. We will cover the licensing reality in 2026, the Copilot versus Gemini story without the marketing gloss, the security and admin gap that has quietly widened, Australian data residency and Privacy Act considerations, and the genuine cost of switching either direction. Spoiler: it is almost always three to five months of dual-running, and the migration is rarely the expensive part.

TechAssist has been having this conversation with Melbourne SMEs for years. Our managed IT services Melbourne team has migrated firms in both directions, so the bias here is genuinely thin. If anything, our preference leans Microsoft for clients in regulated sectors and Google for clients whose entire workflow lives in a browser, but the answer depends on what you actually do for a living.

The Honest Summary Up Front

If you want the verdict before the detail, here it is. Pick Google Workspace if you are under 15 staff, your team lives in Chrome, you do not run any line-of-business application that requires Windows, and you do not have meaningful compliance obligations beyond the Australian Privacy Act baseline. Pick Microsoft 365 if you have Windows endpoints, finance staff who live in Excel, ISO 27001, Essential Eight or sector-specific compliance ambitions, or any line-of-business application that integrates with Outlook calendars, SharePoint document libraries, or Power BI.

The grey zone is the 15-to-50-staff Melbourne SME with mixed Mac and Windows endpoints, a handful of legacy Office documents, and a desire to use Gmail because the founder likes it. That is the zone where the decision actually matters, and where most of our consulting time goes.

Licensing and Pricing in 2026

The headline SKUs have not changed dramatically, but the value gap inside each plan has. Microsoft has loaded more security and compliance into the mid-tier Business Premium plan, while Google has shifted more of its AI value into the Gemini Business and Enterprise add-ons. The result is that the apples-to-apples comparison is genuinely harder in 2026 than it was two years ago.

Here is the realistic comparison for a 30-person Melbourne SME at current AUD list pricing, rounded for clarity. Your actual prices via a partner will be slightly lower, but the ratios hold.

The numbers look close. They are not. The security-grade tier comparison is the one most decision-makers get wrong. Business Premium on Microsoft includes Intune device management, Defender for Business endpoint protection, conditional access, Azure AD Premium P1 (now Entra ID P1), and Purview data loss prevention. Google Business Plus includes Vault retention, advanced endpoint management, and Drive labels, but it does not include the equivalent of conditional access without stepping up to Enterprise Standard or Plus, which approximately doubles the per-user cost.

For a 30-person firm in Cremorne with Windows laptops, Business Premium replaces three or four separate tools that you would otherwise buy: a mobile device management product, an endpoint security product, a multi-factor enforcement layer, and a data loss prevention tool. That is the bundle value that has widened. It is not visible in the headline SKU price.

Where Google Wins, Honestly

Google Workspace genuinely wins in three scenarios, and we recommend it for all three.

The first is the sub-15-person startup. If you are five to twelve people, you live in a browser, you collaborate constantly in shared documents, and your security threat model is mostly phishing and credential theft, Google Workspace is faster to deploy, easier to administer without an IT team, and the collaboration UX is better. Docs and Sheets real-time editing remains a notch ahead of Word and Excel on the web, and the unified search across Drive, Gmail, and Calendar is excellent.

The second is the design or creative agency. If your team is on Macs, you use Figma, Adobe Creative Cloud, and Slack, and your finance person is the only one who touches a spreadsheet seriously, the Microsoft stack is overkill. Google Workspace plus a third-party MDM like Kandji or Jamf will serve you well. A 22-person creative agency running exactly this stack usually has zero appetite to switch, and it is usually right.

The third is genuinely web-first businesses. SaaS companies, marketing agencies, online publishers, e-commerce operators. Teams whose entire workflow is browser tabs and where Microsoft’s deep desktop integration provides no value. Google is leaner here, and Gemini’s integration with Search and YouTube is genuinely useful for these workflows in ways that Copilot’s Office integration is not.

Where Microsoft Wins, Also Honestly

Microsoft 365 wins in more scenarios than Google fans like to admit, and the gap has widened in 2024 and 2025.

The first and biggest is compliance. If you are pursuing ISO 27001, aligning with the Essential Eight, or operating in a sector with specific data handling requirements (legal, health, financial services, government supply chain), Microsoft Purview, Defender, and Entra ID together give you the audit trail, the controls, and the certifications evidence that auditors expect. Google can technically achieve much of this, but the auditor-readiness gap is real, and it costs businesses time during certification.

The second is Windows endpoint reality. Most Australian SMEs run Windows. Intune is now genuinely good. Autopilot deployment for a new laptop is a fifteen-minute experience for the user, and the device arrives at the desk pre-enrolled and pre-configured. Google’s endpoint management story for Windows is workable, but it is not in the same league. If your fleet is Windows, this matters every single week.

The third is finance and operations integration. Power Query, Power Pivot, Power BI, and the broader Power Platform tie into Excel and Outlook in ways that have no Google equivalent. If your finance manager is building cashflow models, your operations team is reconciling job costing across two systems, or your sales lead lives in pipeline spreadsheets, the Microsoft ecosystem is genuinely more productive.

The fourth is line-of-business application integration. Practice management systems in Melbourne law firms, patient management in healthcare practices, ERP and MRP systems in manufacturing, and most Australian accounting and payroll platforms integrate more deeply with Microsoft than Google. The Outlook calendar plug-in, the SharePoint document repository, the Teams meeting integration. These are table stakes for serious vertical software.

Copilot vs Gemini: The Honest Take

Both AI assistants are useful. Both are overhyped by their vendors. Both will be markedly better in twelve months than they are today. Here is what we are seeing in actual SME use in 2026.

Copilot in Microsoft 365 is genuinely useful when it can see across your tenant. Drafting emails from meeting notes, summarising long Teams threads, generating first-draft PowerPoint from a Word brief, and pulling figures from Excel into commentary. The killer use case for SMEs is Teams meeting summaries with action items. Once finance and operations staff have used this for a month, taking it away is painful. The weak spot is reliability on numerical reasoning in complex spreadsheets, and the occasional confident hallucination when pulling data from SharePoint sites it should not be searching.

Gemini in Workspace is strong on text generation in Docs, summarising Gmail threads, and the integration with Google Search for research is genuinely useful. The meeting note-taking in Meet is good. The weak spot is that Gemini in Sheets is not yet at Copilot in Excel parity for serious analytical work, and the Drive search story is less mature than SharePoint plus Copilot for document-heavy organisations.

The honest answer on cost-benefit: at $46 per user per month for Copilot, you need each user to save roughly 45 minutes a week to break even on a $100k salary. We are seeing that achieved in about 60 percent of seats in client deployments, with marketing, sales, and executive assistants getting the highest return, and field-based staff getting the lowest. Gemini at $34 per user per month has a slightly easier payback maths but a slightly narrower set of killer workflows. If you are deciding whether to buy AI for your suite at all, the answer in 2026 is yes for office-based staff and no for field, retail, or shop-floor staff.

The Security and Admin Gap

This is the section where we annoy Google fans. The security and administration gap between Microsoft 365 Business Premium and Google Workspace Business Plus has widened, and pretending otherwise is not helpful to clients.

Conditional access is the clearest example. On Microsoft, you can write a policy that says “users in the finance group can only access the payroll system from a managed device, on a trusted network, with a fresh MFA challenge, between business hours, from Australia.” That policy is enforced at the identity layer for any application using Entra ID for sign-in. On Google, the equivalent context-aware access requires Enterprise tier, and the policy expressiveness is meaningfully thinner.

Endpoint management is the second example. Intune with Defender for Business gives you device compliance evaluation, attack surface reduction rules, controlled folder access, web content filtering, and integration with conditional access in one stack. Google’s endpoint management is fine for Chromebooks, workable for Mac, and basic for Windows.

The third is data loss prevention. Purview DLP can scan content in SharePoint, OneDrive, Exchange, Teams, and increasingly third-party SaaS via Defender for Cloud Apps. Google DLP works well within Drive and Gmail but does not extend as broadly.

None of this means Google is insecure. It is not. It means that if your cybersecurity services Melbourne requirements include detailed conditional access policies, device-based access controls, or aligning to Essential Eight Maturity Level Two, Microsoft gets you there with less bolting-on. Read our zero trust security model explained guide for the framework view.

Australian Data Residency and the Privacy Act

Both Microsoft and Google host Australian customer data in Australian data centres for the core services. Microsoft uses the Australia East and Australia Southeast regions for Exchange Online, SharePoint Online, OneDrive, and Teams. Google uses Australian data centres for Workspace core data at rest. So far, so similar.

The differences appear at the edges. Microsoft publishes detailed data location commitments for each workload, and the Advanced Data Residency add-on lets you pin certain services more strictly. Google’s data residency commitments are good but less granular below the core service level. For most SMEs, this does not matter. For businesses in the government supply chain or in regulated sectors where data sovereignty questionnaires come up, it matters significantly.

Both vendors comply with the Australian Privacy Act and the Notifiable Data Breaches scheme as data processors. Your obligations as a data controller do not go away by choosing either. If you handle personal information at scale, read our Australian Privacy Act for SMBs guide for the practical checklist.

The Real Cost of Switching

This is where most articles lie to you. They quote the migration tooling cost, which is small, and ignore the dual-running cost, the retraining cost, and the lost-productivity tail, which are large.

Here is the realistic switching cost for a 50-person Melbourne SME moving from Google Workspace to Microsoft 365 or vice versa. Take an illustrative worked example: a 50-person property services firm moving from Google to Microsoft because it has taken on a client who requires vendor security questionnaires it cannot answer cleanly.

That is the real cost. The migration project line is the only one most quotes show you. The dual-licensing, the productivity dip, and the change management are usually invisible until you are deep in the project. We had this client back to full productivity by week eight, and the ROI is positive within the second year because they retained the client whose questionnaire triggered the move. But if you switch suites without that kind of trigger, the payback is much harder to justify.

The honest test: if you cannot articulate a specific business reason for the switch that is worth at least 1,500 dollars per user, do not switch. Stick with what you have and make it better.

Melbourne Examples: When We Recommend Each

A 12-person digital marketing agency in Collingwood. All Macs, Slack, Figma, web analytics tools, two finance staff using Xero. We recommended Google Workspace Business Plus plus Kandji for Mac MDM. Total stack cost roughly $850 per month. They are happy, audit-clean for their compliance needs, and the founder loves the Gmail UX.

A 35-person mechanical engineering consultancy in Box Hill. Windows fleet, AutoCAD and Revit, project management in a Microsoft-integrated platform, finance team building project costing models in Excel. We recommended Microsoft 365 Business Premium, Intune-managed Windows 11 devices delivered via Autopilot, Defender for Business, and Copilot for the senior engineers and finance team only. Total stack cost roughly $2,800 per month for the M365 layer. They cleared an ISO 27001 surveillance audit cleanly last quarter.

A 28-person allied health practice in Camberwell. Mixed Mac and Windows, patient management system that integrates deeply with Outlook calendars, NDIS and Medicare claiming. We recommended Microsoft 365 Business Premium for the integration reasons, Intune for device management, Defender for endpoint protection, and a structured Purview information protection deployment because patient information requires strict handling. Total cost slightly higher than Google would have been, but the integration requirements ruled Google out at the discovery stage.

For our broader take on choosing partners and platforms, see how to choose an MSP Melbourne and our top managed service providers Melbourne overview.

How TechAssist Approaches the Decision

We are platform-agnostic for genuine reasons. We have 13 Melbourne-employed staff between our Tecoma office and our Bourke Street CBD office, run our NOC out of Tecoma, and provide 24/7 on-call and emergency support. We migrate clients in both directions every quarter. Our per-user fixed monthly pricing does not change based on which suite you choose, so we have no commercial incentive to push either.

For new clients in our MSP Melbourne programme, we run a one-day platform assessment. We look at your endpoint fleet, your line-of-business applications, your compliance trajectory, your team’s working style, and your current pain points. We recommend Microsoft or Google based on the answer, not based on the margin. We run same-business-day on-site visits across Melbourne metro when something needs hands on hardware. The platform under the hood matters less than the discipline around it.

Our cloud services Melbourne team can scope a migration in either direction with a realistic dual-running budget and a change management plan, not just a tooling quote. Our co-managed IT support model also works if you have an internal IT lead who wants to keep the strategic decisions in-house and outsource the operational lift.

Frequently Asked Questions

Can a small business get away with just the entry-level plan?

For a five-to-ten-person business with low compliance requirements, the entry-level plan plus a third-party MFA enforcement layer and a basic backup tool will work. For anything more, the security and management gap between the entry tier and the security-grade tier is large enough that the entry tier is a false economy. Businesses routinely spend more remediating after a security incident than they saved over three years of running on the entry tier.

What about Outlook on Mac with Google Workspace?

It works, but it is not great. If your team is on Mac and your founder wants Gmail, lean into the Google ecosystem fully rather than trying to bridge Outlook to Gmail. The hybrid setup creates calendar invitation issues, contacts sync issues, and frustrating support tickets. Pick one ecosystem.

Is Copilot worth it for a 20-person business?

For ten of those twenty people, yes. For the other ten, probably not. Buy Copilot for the seats where it will see daily use: executive assistants, sales, marketing, finance leads, and anyone whose job involves drafting documents, summarising meetings, or building reports. Do not buy it for field staff, warehouse staff, or part-time admin staff. The per-seat economics only work when actually used.

How long does a Microsoft to Google or Google to Microsoft migration actually take?

The migration tooling runs over a weekend. The dual-running window is three to five months. The team is at full productivity on the new platform by week eight to twelve. The cleanup of the old tenant takes another month or two. Anyone who tells you it is a one-month project is selling you a migration, not a successful outcome.

What about hybrid: some users on Microsoft and some on Google?

Avoid it unless you have a genuinely good reason, like a recent acquisition you are integrating. Hybrid creates shared calendar friction, email signature inconsistency, document collaboration confusion, and double the admin workload. Some businesses run hybrid for legitimate transitional reasons. None of them are happy about it.

How do I get an honest scoping conversation?

Talk to us. We will tell you which platform fits your business and which one does not, and we will do that regardless of what you end up choosing. Reach our team via the contact page or call the office. The conversation is free and the recommendation will be straight.

For Australian SMEs under 200 seats, the four real cloud phone options in 2026 are Microsoft Teams Phone, 3CX, RingCentral, and Aircall. Each one is the right answer for a specific business profile and the wrong answer for others. This buyer’s guide compares them honestly on cost, fit, number porting, and resilience for Australian conditions.

Why this guide exists

Most Australian buyer’s guides for cloud phone systems read like a vendor brochure with a different cover. The advice is generic, the comparisons are shallow, and the local detail (porting timelines with TPG or Aussie Broadband, ACMA implications, what happens during an outage on the NBN) is missing. We have deployed and supported all four of these platforms inside our managed IT engagements, and the local detail is where most of the cost and risk hides.

This guide is opinionated. We will tell you which platform we recommend by default for which profile, and where we have seen each one go wrong. The goal is not to sell you on a particular vendor; it is to help you make a defensible choice that you will still be happy with in three years.

The four real options

Microsoft Teams Phone

The right answer for businesses that already run Microsoft 365 E3 or E5, want one platform for chat, video, and voice, and have a relatively standard office and remote staff mix without heavy call centre or sales dialler requirements.

Strengths:

• Single identity, single client, single admin centre with the rest of your Microsoft estate
• Native Teams app on every device people already have
• Tight integration with calendar, presence, and meeting recording
• Operator Connect or Direct Routing options give flexibility on the carrier side
• Compliance and call recording aligned to the broader Microsoft 365 compliance stack

Weaknesses:

• Native call queueing and IVR are basic compared to a dedicated UCaaS or contact centre platform
• Real call centre features (skill-based routing, advanced wallboards, supervisor monitoring) require add-ons or a third-party contact centre integration
• Sales-dialler workflows are clunky; no native power dialler
• Voice quality depends heavily on the network and the device; soft phones on personal Wi-Fi can be unreliable

Best fit: professional services, accounting, legal, healthcare admin, and any organisation where the phone is a normal-volume business tool rather than the primary production system. For a typical 38-staff law firm already on M365 Business Premium with about 40 inbound calls per partner per day, Teams Phone with Operator Connect through an Australian carrier is the obvious answer.

3CX

The right answer for businesses that want maximum control, are comfortable with a more technical platform, and either want to self-host or run on a tightly managed instance. Also the right answer for businesses migrating from a legacy on-premises PBX who want a familiar feature set.

Strengths:

• Strong feature parity with traditional PBX systems (call queues, ring groups, advanced IVR, hot desking)
• Can be self-hosted in Azure, AWS, or on-premises; or run on a 3CX-hosted instance
• Per-system pricing rather than per-user pricing, which can be significantly cheaper at scale
• Strong third-party SIP trunk support, so you can choose your Australian carrier
• Good softphone and mobile apps; reasonable Teams integration if needed

Weaknesses:

• Requires technical administration; not a ‘set and forget’ platform
• Self-hosted instances need patching, monitoring, and backup (real infrastructure work)
• UI is functional rather than polished; staff onboarding is harder than Teams
• 3CX itself has had security incidents in recent years (the 2023 supply chain compromise) which raised concerns; subsequent response has been adequate but worth noting

Best fit: businesses that already have IT capacity (internal or co-managed), value control over the platform, and have specific feature requirements that consumer-grade UCaaS platforms do not meet. We run 3CX in our own environment and deploy it where the cost model and the feature set are right. For a 65-staff manufacturing business in Dandenong South, 3CX with SIP trunks from an Australian carrier and a redundant pair of instances in Azure was the right call because the on-premises requirement (a few hundred handsets across two sites with paging integration) ruled out the pure-cloud UCaaS options.

RingCentral

The right answer for businesses that want a full unified communications-as-a-service experience with a polished UI, strong analytics, and built-in contact centre options for when the business grows into them.

Strengths:

• Polished, consumer-grade user experience across mobile, desktop, and web
• Built-in video, messaging, fax, SMS, and voice in one platform
• Strong analytics and reporting out of the box
• Contact centre add-on (RingCX) is mature and integrates natively when needed
• Strong CRM integrations (Salesforce, HubSpot, Zoho) without third-party connectors

Weaknesses:

• Per-user pricing is at the higher end of the market
• Australian carrier and number porting flexibility is more limited than 3CX
• Bundle includes features many SMEs do not use, which inflates the per-seat cost
• Account management can be inconsistent; SMEs sometimes feel underserved

Best fit: customer-facing businesses with 30 to 150 staff that have outgrown a basic phone system, want a single platform across all communication channels, and have a clear customer service or sales operation. For a 72-staff e-commerce business whose customer service team needs proper queueing, wallboards and supervisor monitoring, RingCentral with the contact centre module is usually the right call, because Teams Phone cannot match it there.

Aircall

The right answer when sales or customer experience is the dominant phone use case, when CRM integration is the highest priority, and when you are willing to add another tool to your stack to get a sales-optimised experience.

Strengths:

• Built specifically for sales and CX teams; the workflows reflect that
• Excellent CRM integration (Salesforce, HubSpot, Pipedrive, Zendesk) with screen pops and automatic logging
• Power dialler, click-to-call, and call coaching features are native
• Fast to deploy; user onboarding is friendly
• Good analytics for call outcomes and rep performance

Weaknesses:

• Not designed as a general business phone system; not the right tool for receptionist or main-line scenarios
• Australian number availability and porting can be slower; mostly serves international and metropolitan use cases
• Per-user pricing is competitive but stacks with whatever else you use for general office calling
• Voice quality is heavily dependent on the user’s network

Best fit: dedicated sales or customer success teams within a larger business that already has a general phone system. A common pattern is Aircall for the sales team with Teams Phone left in place as the general business platform. The two run side by side, the sales team gets the dialler experience they need, and the cost is contained to the 12 sales seats.

Side-by-side cost comparison

The table below assumes a 50-user Australian SME with a standard mix of office calling. Prices are 2026 Australian list, GST exclusive, and assume an annual commitment. Real negotiated prices for SMEs are often 10% to 20% below list.

The cost comparison hides important differences. Teams Phone looks cheap on this view because much of the platform cost is already paid for in your Microsoft 365 licence. 3CX looks cheaper still on a pure platform basis, but the operational cost of running and maintaining the platform is real and not captured in the per-user price. Aircall is the most expensive per seat, but in practice you only deploy it to a sales team subset, not the whole business.

Number porting timelines and carriers

Number porting in Australia is the most underestimated risk in a phone system change. Promised porting timelines and actual porting timelines often diverge by weeks. The factors that matter:

Carrier of the losing number

Porting away from Telstra is typically 4 to 8 weeks for a complex port (multiple numbers on a hunt group) and 1 to 3 weeks for a simple port (single number). Porting away from Optus or TPG is similar. Smaller wholesale carriers can be faster (1 to 2 weeks) but the process is also more dependent on the human being on the other side.

Carrier of the gaining number

For Teams Phone, you can use Operator Connect carriers (multiple Australian options including TPG, Vonage, and several smaller providers) or Direct Routing through your own carrier. Operator Connect is faster to provision but you trade flexibility. Direct Routing requires a session border controller setup but gives you choice of carrier.

For 3CX, you choose your SIP trunk carrier independently. Aussie Broadband, Maxotel, and TPG Wholesale are common choices for Australian SMEs. Maxotel in particular has a reputation for responsive porting support among smaller deployments.

For RingCentral and Aircall, the carrier is bundled. You do not choose; you accept the carrier the platform uses. This simplifies the buying decision but reduces flexibility.

The porting risk plan

Whichever platform you choose, plan the port itself as a discrete project with its own risk management. Recommended practice:

• Submit port requests at least 30 days before go-live
• Keep the old service active and paid until 7 days after port completion
• Test inbound calls from at least three external networks (mobile, landline from a different carrier, international if relevant) before decommissioning the old service
• Plan a fallback path: divert old numbers to mobile during the cutover window in case of disputed port
• Have a written escalation path with both carriers; know who to call when something stalls

For complex multi-site deployments, factor in 6 to 8 weeks of porting lead time. Trying to compress this is a frequent source of go-live failures.

ACMA and ATO implications

ACMA

The Australian Communications and Media Authority regulates how Australian businesses can use phone numbers and what carriers must do. The relevant points for a cloud phone deployment:

• You must use Australian-registered numbers for Australian business operations (you cannot just use a US-issued RingCentral or Aircall number for your Australian customers)
• Emergency calling (Triple Zero) must work and must report a usable location. Many cloud phone systems require explicit configuration of E000 location data per device or per user
• Lawful intercept obligations apply to carriers, not to you directly, but your carrier must be compliant

The E000 location requirement is the one most often missed. If your staff are working from home with a softphone, the system needs to know their location at sufficient detail that emergency services can be dispatched correctly. RingCentral and Teams Phone both handle this; 3CX requires explicit configuration; Aircall is more limited.

ATO and record keeping

The ATO requires businesses to maintain records of business transactions, which can include call records for sales and customer service interactions. Cloud phone systems typically retain call records and recordings for a default period (30 to 90 days), which is shorter than the typical ATO retention requirement of 5 years.

If you record calls, you need to store the recordings somewhere durable for the retention period. Most platforms offer extended retention as an add-on or via export to your own storage. Build this into the deployment design.

Fallback plans for outages

Cloud phone systems fail. They fail less often than on-premises PBXs, but when they fail they fail completely. Your fallback plan needs to be:

• Documented in writing and tested at least annually
• Triggerable by a non-IT staff member if needed
• Capable of routing inbound calls to mobiles within 5 minutes

The standard fallback is a carrier-level call forwarding rule that activates on platform unreachable. Most Australian carriers support this for inbound DID numbers. The rule sends all inbound calls to a designated mobile (usually the reception manager) when the cloud platform stops responding. When the platform recovers, the rule deactivates.

For businesses where the phone is mission-critical (medical practices, professional services with tight client SLAs, customer service operations), consider running two carriers in active-passive configuration. The cost is meaningful but the resilience is the highest you can achieve outside of a dedicated contact centre platform.

For a healthcare practice that cannot afford to lose inbound calls, the pattern is Teams Phone with Operator Connect through one carrier and a secondary direct route through a different carrier as failover. The cost premium is about $400 a month for the secondary path. They have used it twice in 18 months and both times the failover saved the day.

How to decide

The decision tree we use with clients is:

1. Do you already have Microsoft 365 E3 or E5, or Business Premium with Teams Phone add-on? If yes, start with Teams Phone unless there is a specific reason not to.
2. Is your call volume primarily sales-driven, with CRM integration as a top requirement? If yes, evaluate Aircall as a sales-team overlay on top of a general phone system.
3. Do you have a customer service team of 5 or more that needs proper queueing, wallboards, and supervisor features? If yes, evaluate RingCentral or RingCX.
4. Do you have specific feature requirements (paging integration, dense IVR, hot desking) that consumer-grade platforms do not meet, and do you have or want technical control over the phone platform? If yes, evaluate 3CX.
5. If none of the above clearly dominates, default to Teams Phone for the Microsoft 365 integration alone.

Implementation realities

Cloud phone deployments fail more often than they should, almost always for the same reasons. The four to plan against:

• Underestimating the porting timeline. Already covered above. Treat it as the critical path.
• Underestimating user training. Phone behaviour is muscle memory. Switching staff to a new system without dedicated training results in two months of awkward calls and lost business.
• Underestimating the network impact. Voice traffic competes with Teams meetings, file syncs, and everything else on the network. QoS is essential; on a typical NBN connection, prioritising voice traffic prevents call quality degradation during peak hours.
• Underestimating the headset standard. A $35 headset is not the same as a $180 business headset. Voice quality complaints are 50% headset and 50% network in our experience. Standardise on a known-good business headset and budget for it.

This kind of deployment work sits naturally inside a managed IT services arrangement with per-user fixed monthly pricing. Our 13 Melbourne-employed staff handle cloud phone deployments out of our Tecoma NOC and our Bourke Street CBD office, with 24/7 on-call and emergency support when something goes wrong after go-live. The same-business-day on-site capability for Melbourne metro matters when you have 40 desk phones to physically replace.

If you want a sharper conversation about which of the four platforms is the right fit for your specific business, get in touch. The right answer depends on context that a buyer’s guide cannot fully cover.

Frequently Asked Questions

Can we keep our existing PBX and just add cloud features?

Yes, with hybrid models. 3CX in particular supports a hybrid mode where some users are on the cloud client and others remain on legacy SIP handsets. This is a sensible transition path for businesses with significant existing handset investment. Teams Phone also supports a hybrid model through Direct Routing, where your existing PBX can serve as the gateway during migration. The hybrid period typically lasts 3 to 6 months.

What about Zoom Phone?

Zoom Phone is a legitimate fifth option that we deliberately excluded from the main comparison because in our experience it sits awkwardly between Teams Phone and RingCentral without clearly winning on either dimension for Australian SMEs. If your business is Zoom-first for meetings (which is unusual in Australian SMEs but happens), Zoom Phone is worth evaluating. For most Australian SMEs already on Microsoft 365, the simpler answer is Teams Phone.

How do we handle remote and hybrid staff with the chosen platform?

All four platforms support remote work natively through softphone clients. The practical issues are home network reliability, headset quality, and emergency calling location data. The home network reliability question often pushes businesses toward providing a mobile data backup option for staff who do customer-facing calls from home.

What is the typical implementation timeline?

For a 50-seat deployment, expect 6 to 10 weeks end to end. Two weeks for design and procurement, two weeks for tenant configuration and pilot user testing, four to six weeks for porting (often the long pole), and one week for cutover and immediate post-cutover support. Rushed implementations are the single largest source of go-live failures.

How does the choice of cloud phone system intersect with cybersecurity?

Cloud phone systems are an identity surface and a data surface. Voicemail recordings, call recordings, and contact lists are all sensitive data subject to the Privacy Act. The platform’s identity model should integrate with your existing identity provider (Microsoft Entra ID in most cases), and the call recording retention and encryption should align with your broader data protection posture. This is why we evaluate cloud phone choices as part of a broader cybersecurity conversation rather than as a standalone procurement.

What is the right number of carriers to use?

For most SMEs, one carrier with carrier-level failover (call divert on unreachable) is sufficient. For mission-critical phone use cases, two carriers in active-passive configuration. Three or more is over-engineered for sub-200-seat businesses. The marginal resilience past two carriers does not justify the cost or complexity.

SMS-based MFA is now treated as a failed control by ASD’s Essential Eight guidance and by every major cyber insurer. If your Melbourne business still relies on text-message codes for accounts that matter, you are running a security control your insurer will dispute on claim day. Here is the practical fix.

What “phishing-resistant” actually means

The term gets thrown around loosely. The technical definition is sharper than people realise. A phishing-resistant authenticator is one where the secret used to prove identity cannot be replayed, phished or intercepted between the user and the legitimate service, and where the authentication is cryptographically bound to the actual domain being authenticated to.

In practice that means the authenticator checks the relying party, the actual domain the browser is connecting to, and refuses to release credentials to an attacker’s lookalike site. SMS does not do this. TOTP authenticator apps that spit out six-digit codes do not do this. Push notifications that show “approve or deny” without binding to a domain do not do this either, which is why attackers spent 2022-2024 perfecting MFA fatigue attacks.

The three things that actually qualify as phishing-resistant in 2026:

• FIDO2 security keys, physical hardware tokens like YubiKey 5, Google Titan, or Feitian devices that perform cryptographic challenge-response against the verified origin.
• Platform passkeys, credentials stored in Windows Hello, Touch ID, Face ID or Android’s keystore, syncing through iCloud Keychain or Google Password Manager, using the same FIDO2 protocol.
• Microsoft Authenticator with number matching and Authenticator-based passkeys, the modern Microsoft Authenticator experience now supports both number-matching push (a meaningful improvement) and full FIDO2 passkeys (the actual fix).

Notice what is missing. SMS, voice calls, email codes, TOTP apps like Google Authenticator or Authy, and old-school push notifications without number matching. All of those are second-factor controls, but none of them is phishing-resistant in the technical sense. Your insurer’s renewal questionnaire is going to ask very specifically.

Why SMS failed

SMS as a second factor has four structural problems that no configuration can fix.

SIM swapping. An attacker convinces your telco to port your number to their SIM. This is not theoretical. In a typical SIM-swap case the entire attack runs from “ported number” to “Microsoft 365 inbox compromised” in under ninety minutes, often on a weekend, with no malware involved. The MFA code went straight to the attacker.

SS7 interception. The signalling protocol that routes SMS messages between carriers has known weaknesses that allow message interception without touching the victim’s phone. Less common than SIM swapping, but documented in the wild against high-value targets.

Phishing kits with relay. Modern phishing kits (Evilginx, Modlishka, EvilProxy and their successors) act as transparent proxies between the user and the real Microsoft login page. The user types their password and SMS code into the attacker’s lookalike, the attacker relays both to Microsoft in real time, and walks away with a valid session cookie. SMS does not stop this attack at all. The user is genuinely authenticating; the attacker is just sitting in the middle.

User behaviour. SMS codes get forwarded, screenshotted, read out loud in open-plan offices, and pasted into chat windows. They are six-digit numbers transmitted in plain text. They were never designed to be a hard security control.

The ASD’s Essential Eight maturity model now explicitly requires phishing-resistant MFA at Maturity Level 2 for privileged users and Maturity Level 3 for all users. If you are aiming for ML2 or higher, SMS does not count. Essential Eight alignment is becoming a procurement prerequisite for state government work and an increasing number of private contracts, so this is not just a security debate.

YubiKey 5 vs platform passkeys: the cost comparison

Once you accept that SMS has to go, the next question is which phishing-resistant option to standardise on. The honest answer is “both, for different purposes”. Here is the comparison we walk Melbourne clients through.

For most Melbourne SMEs, the right answer is platform passkeys or Authenticator passkeys for the general staff population, plus YubiKey 5 (in pairs, primary and backup) for the privileged admin accounts and the break-glass emergency account. Total hardware spend for a 50-person business is usually in the $800-$1,500 range, not the eye-watering number people imagine.

TechAssist’s rollout order: privileged first, then finance/exec, then all staff

Doing this in the wrong order is how rollouts get stuck. The sequencing matters more than the technology choice. Here is the order that actually works.

Phase 1: privileged accounts (week 1-2)

Every global admin, every Exchange admin, every SharePoint admin, every Azure subscription owner. Two YubiKeys each (one carried, one in a safe). FIDO2 enforced via Conditional Access. Old MFA methods removed for those accounts entirely. This is the population an attacker actually wants, and it is small enough to do in a fortnight.

For a typical 45-person business this phase covers perhaps seven accounts: a few IT admins, the CEO, the CFO, and the office manager who has been a global admin since 2017 for reasons nobody remembers. Three of those seven had their admin rights stripped during the phase, because they did not need them.

Phase 2: finance and executive (week 3-4)

Anyone who can authorise a payment, anyone who can sign a contract, anyone whose inbox compromise would lead to a business email compromise wire fraud incident. Platform passkeys or Authenticator passkeys are usually the right tool here, with YubiKeys offered for users who travel internationally or work across multiple devices.

This phase is the one the CEO cares about, because it is also the population most likely to be socially engineered. BEC against the CFO’s inbox is the single most common direct-loss incident we see in Melbourne SMEs. The phishing-resistant control is the actual fix.

Phase 3: all remaining staff (week 5-8)

Roll passkeys out by department, in waves of fifteen to twenty users. Set a hard date by which SMS-based MFA is removed as an option in Conditional Access. Provide hands-on registration in the office for anyone who needs it. We typically allocate one engineer-hour for every five users for the registration push.

By week eight, your Conditional Access policies should be enforcing phishing-resistant MFA for all user sign-ins, with SMS removed from the available authentication methods list. That is the point you can tell the insurer the work is done.

The three traps that derail most rollouts

Even with the right order, three things consistently trip up MFA migration projects. We have learned to address these up front, not as afterthoughts.

Trap 1: shared mailboxes

Shared mailboxes in Microsoft 365 do not have their own sign-in credentials. They cannot have MFA in the traditional sense. The trap is that people forget about the user accounts behind them, the “reception”, “accounts”, “support” mailboxes that started life as full licensed users and got converted to shared at some point, but where the underlying user object is still active and signable-in.

We did a sweep at a Box Hill manufacturer last quarter and found four accounts converted to shared mailboxes years earlier where the user object still had a password, no MFA, and was a member of the global admin group. That is a real incident waiting to happen, and Conditional Access alone will not catch it unless the accounts are properly disabled.

Trap 2: service accounts

Service accounts, for the scan-to-email function on the photocopier, for the integration with the line-of-business app, for the legacy reporting tool that runs at 2am, were typically created without MFA because “you can’t put MFA on a service account”. This is partially true and entirely solvable.

The fix is a combination of: moving to certificate-based auth or app registrations with managed identities where possible, applying conditional access policies that restrict service accounts to specific source IPs or compliant device states, and putting compensating controls (privileged access workstations, vaulted credentials) around the genuinely legacy ones that cannot be modernised. Our managed IT services team treats this as a separate workstream because it always takes longer than the human user migration.

Trap 3: break-glass admin accounts

You need at least one global admin account that is excluded from your Conditional Access policies, so that if your tenant configuration somehow locks everyone out you can still log in and fix it. This account is by definition not protected by your normal controls, which makes it the single highest-value target in the tenant.

The correct setup is two break-glass accounts, each with a long random password stored in two separate physical safes, each requiring a FIDO2 security key (also stored separately), with sign-in alerts configured to notify multiple senior people if either account is ever used. The accounts should be tested quarterly to make sure they still work, and the test should be logged. Most Melbourne SMEs we audit have either no break-glass account, a break-glass account that is also a daily-driver, or a break-glass account whose password is in a sticky note in the IT manager’s desk. All three are wrong.

Conditional Access: the policy that makes it real

You can buy all the YubiKeys you like, but if your Conditional Access policies still allow SMS as a fallback, users will fall back to SMS. The policy work is what turns the rollout from “available” to “enforced”.

The minimum viable policy set for a Melbourne SME running Entra ID (formerly Azure AD) looks like this:

• All users (excluding break-glass) require phishing-resistant MFA for all cloud apps.
• Privileged role activations require FIDO2 security key specifically, not just any MFA method.
• Legacy authentication protocols (POP, IMAP, SMTP AUTH, legacy ActiveSync) are blocked entirely.
• Sign-ins from outside Australia require either compliant device state or additional verification.
• Risky sign-ins (per Microsoft Entra ID Protection signals) require password reset.

This policy stack costs nothing extra if you already have Microsoft 365 Business Premium, which includes the relevant Entra ID P1 features. If you are on Business Standard, the gap is about $9 per user per month for the Entra ID P1 add-on. For a 30-person business that is roughly $3,200 a year, cheaper than a single business email compromise incident excess on most cyber policies.

Cyber insurance: the elephant in the room

Every Australian cyber insurance renewal questionnaire we have seen in the last twelve months asks the phishing-resistant MFA question directly, in some form. The wording varies, but the intent is identical: “Do all privileged accounts use phishing-resistant MFA? Yes/No.” A “No” answer either triggers a steep premium increase, a coverage exclusion for BEC-related losses, or in some cases a refusal to quote.

We had a Hawthorn law firm client whose 2025 renewal came back with a 60% premium increase plus a $50,000 BEC sub-limit, specifically because they were still on SMS MFA for the partners. We did the rollout in three weeks, got the underwriter the updated configuration evidence, and the renewal was repriced to the previous year’s level with the sub-limit removed. The phishing-resistant MFA work paid for itself in one premium cycle.

This is now the most cost-effective security investment a Melbourne SME can make on an ROI basis, full stop. The technology cost is modest, the configuration time is measurable in days not weeks, and the insurance saving is direct and immediate. There is no better-value security project on the table in 2026.

What this looks like at TechAssist

We run phishing-resistant MFA rollouts as a structured project, not an ad hoc ticket. A typical engagement runs four to eight weeks elapsed, depending on the size of the user base and the state of the existing Conditional Access policies. We do the discovery, the policy design, the YubiKey procurement and shipping, the user registration sessions (on-site for Melbourne metro clients with same-business-day response if anything goes wrong), and the cutover.

Because our practice is Essential Eight aligned, the documentation pack is structured to give your insurer or auditor exactly what they ask for. That matters more than it sounds. Businesses that do MFA rollouts internally often struggle to produce the evidence the underwriter wants at renewal. The rollout was fine; the paperwork was the problem.

The same approach works for construction firms, manufacturers, law firms and healthcare providers. The technical work is similar across industries; the change management is what varies. A law firm partnership is a different conversation from a warehouse-floor manufacturer, and the rollout plan has to reflect that.

Frequently Asked Questions

Will my staff actually use FIDO2 keys or will they revolt?

Genuine objections drop fast once people use the keys for a week. The sign-in experience with a YubiKey is faster than typing a six-digit SMS code, touch the key, done. Platform passkeys are even faster because they use the biometric the user is already using to unlock the laptop. The main grumbling tends to come from executives who travel and need to use multiple devices, which is a real concern that pairs of YubiKeys solve.

What happens if a user loses their YubiKey?

This is why we issue two per privileged user. The user uses the primary, the backup is in a safe (often a home safe for senior staff who travel, or a locked drawer in the office). If both are lost simultaneously, the admin can reset the user’s authentication methods via a separate verified process. The point is to design the recovery path before it is needed, not after.

Can we just use Microsoft Authenticator and skip the hardware keys?

For general staff, yes. Microsoft Authenticator with passkey support is genuinely phishing-resistant and meets the bar. For privileged admin accounts and break-glass accounts, we still recommend hardware keys because they are not tied to a phone that can be lost, stolen, broken or compromised. The privileged accounts justify the extra cost.

Do we need to upgrade our Microsoft 365 licences for this?

If you are on Microsoft 365 Business Premium, no, you already have the Entra ID P1 features needed for Conditional Access. If you are on Business Standard or Business Basic, you need either to upgrade to Premium or add Entra ID P1 as an add-on. The cost is usually in the order of $5-$10 per user per month depending on the path.

How does this interact with our existing TOTP authenticator app?

TOTP (the six-digit code apps like Google Authenticator) is not phishing-resistant and should be retired alongside SMS. The migration usually runs in parallel, users register their passkey or YubiKey, verify it works, then remove TOTP as a registered method. Conditional Access policies should explicitly require phishing-resistant authentication strength, which excludes TOTP from being a valid method.

How long does the whole project take?

For a typical 40-person Melbourne SME on Microsoft 365, four to six weeks from kickoff to fully enforced. The first fortnight covers discovery, policy design and privileged accounts. Weeks three and four cover finance and executive. Weeks five and six cover the broader staff base. Faster is possible but rarely advisable, the change management is what determines whether the rollout sticks.

What to do this week

If you take nothing else from this article, do three things this week. First, find out what authentication methods your Microsoft 365 tenant currently allows, the “Authentication methods” blade in the Entra admin centre tells you. Second, identify how many of your global admin accounts could be compromised by an SMS-based phishing attack today. Third, get a quote for FIDO2 security keys in pairs for that admin population.

That is a half-day of work that gives you the starting position. From there, the rollout is a structured project with measurable milestones. The Melbourne SMEs that have done this in 2025 are now paying lower insurance premiums, sleeping better, and not having the awkward “yes we still use SMS” conversation with their auditors.

If you would like a hand running this for your business, discovery through cutover, talk to us. We know where the traps are.

Most Melbourne SMEs bought Copilot licences last year, used them for a fortnight, then stopped opening the sidebar. The $530-per-user-per-year price tag pays back for specific roles in specific conditions, and almost never for “everyone on the team”. This is the blunt version of what we tell clients before they sign.

The licence-tier trap nobody explains properly

The first problem is that “Copilot” is now a brand that covers at least three completely different products, and Microsoft’s marketing makes them sound interchangeable. They are not. We have lost count of how many Melbourne businesses bought the wrong tier for what they actually wanted to do.

Microsoft 365 Copilot is the enterprise product. It sits inside Word, Excel, Outlook, Teams, PowerPoint and your SharePoint tenant. It can read your organisation’s data, summarise meetings, draft emails grounded in actual project files, and do real work against your tenant. It costs roughly $44.90 per user per month, billed annually, and it requires an existing Microsoft 365 Business Standard or Premium licence underneath. This is the one most people are arguing about.

Copilot Pro is a consumer-tier upgrade at about $33 per user per month. It bolts onto personal Microsoft accounts and gives you Copilot in the desktop apps, but it does not connect to your business tenant data in any meaningful way. We have seen finance teams buy this thinking it was the business version. It is not.

Microsoft 365 Copilot Chat is the free tier. It is essentially a web-grounded chatbot with enterprise data protection if you sign in with your work account. It does not touch your SharePoint files, your Exchange mail or your Teams chat history. It is a perfectly reasonable replacement for staff who were already typing into ChatGPT, but it is not what the sales deck was selling.

If you are a 30-person construction firm in Hawthorn and you bought “Copilot” for ten people, the question we always ask first is: which Copilot, and what does the back-office actually need it to read? About a third of the time the answer reveals that they bought Pro when they meant M365 Copilot, or M365 Copilot when Chat would have done the job for free.

Who Copilot actually pays back for

After eighteen months of rolling Copilot out across our Melbourne client base, the pattern is clear. There are three or four roles where the maths is obvious, and a much larger group where the licence is dead weight. Let’s start with the winners.

Sales and business development

Salespeople write the same email forty times a week with minor variations. They draft proposals, follow-ups, meeting recaps, and discovery notes. Every one of those is a Copilot task. Picture a business development manager at a professional services firm who, once the SharePoint structure is clean enough for Copilot to find the right case studies, saves several hours a week of writing time. That is the realistic upper end. At an internal cost of around $90 an hour loaded, that licence pays back in under a fortnight per month.

Finance and accounting

Excel Copilot is genuinely useful for finance once you train people to ask it the right questions. Variance analysis, formula explanation, pivoting a messy export from MYOB or Xero, drafting board commentary on a P&L are all real time savers. The catch is that the data needs to be in a table format Copilot can actually parse, which is a separate fight. A CFO who spends eight hours a month on board pack commentary can realistically get that down to about three.

Executive assistants and chiefs of staff

This is the single highest-ROI role for M365 Copilot. EAs spend their day in inbox triage, meeting prep, document summarisation and minute-taking. Every one of those is a native Copilot task with measurable time savings. If you only buy Copilot for one person in your business, buy it for the EA.

HR and recruitment

Drafting job ads, summarising candidate responses, generating interview questions tied to actual position descriptions stored in SharePoint, writing policy updates, useful, repeatable, and quantifiable. Less dramatic than sales ROI but reliably positive.

Who Copilot does not pay back for

This is the part the Microsoft account manager will not lead with. The honest answer is that for most general office staff, operations coordinators, project administrators, junior accountants doing transactional work, anyone who spends most of their day inside one specific line-of-business app rather than Office, Copilot is a curiosity, not a productivity tool.

The reason is simple. Copilot saves time on writing, summarising and analysis. Staff whose role is mostly data entry, scheduling inside a vertical app, or processing tickets in a queue do not write enough to recover $44.90 a month. Active usage among “general office staff” who were given Copilot in a blanket rollout drops below 10% by week six.

If your justification for buying Copilot for everyone is “fairness” or “future-proofing”, that is fine, but call it what it is, a cultural investment, not an ROI decision. Do not let the CFO believe the spreadsheet.

The three pre-conditions, without which you are burning money

Even for the roles where Copilot should work, it routinely does not, because the underlying tenant is a mess. There are three pre-conditions, and we will not roll Copilot out at scale for a client without them in place.

1. Clean SharePoint permissions

This is the big one. M365 Copilot respects whatever permissions a user already has. If your SharePoint is a sprawl of legacy sites where everyone has access to everything because nobody ever cleaned it up, Copilot will happily surface the CEO’s salary review, the legal exposure memo, and the redundancy list to a graduate accountant who asked a polite question about expense policy.

We did a Copilot readiness audit for a Box Hill logistics business last year and found 412 SharePoint sites where the “Everyone except external users” group had read access to confidential folders. They thought they were ready to deploy. They were not. Two weeks of remediation followed, and it would have been a serious incident if Copilot had gone live first. This is why our cybersecurity services team now runs a permissions sweep as a standard pre-deployment step.

2. Decent data hygiene

Copilot is only as useful as the data it can find. If your project files are scattered across three OneDrives, two SharePoint sites, a shared Dropbox and a “Common Drive” mapped to a file server in the corner, Copilot will retrieve a confident-sounding answer based on a 2019 version of the document. Garbage in, garbage out, with extra polish.

You do not need perfect data hygiene. You need “good enough that the current version of the thing is in the place Copilot will look for it”. Usually that means picking one canonical location per content type and enforcing it for three months.

3. A use-case champion

Every successful Copilot rollout we have done has a person, usually a department head, sometimes an EA, who actively evangelises specific use cases inside their team. “Here is how I used Copilot to write that board paper. Here is the prompt I used.” Without that person, the licence sits idle.

This is not optional. We now refuse to quote a Copilot rollout that does not identify a champion per department up front. If the client cannot name one, the answer is to delay the rollout, not to push through.

Back-of-envelope payback model

Here is the rough model we use with clients. It is deliberately simple. You can argue with the loaded hourly cost number, but the structure holds.

The pattern is obvious. The licence pays back inside a fortnight for the high-value writing-heavy roles, and stretches to “marginal” or “never” for everyone else. The right purchase decision is almost always targeted, not blanket.

Kill it, keep it, expand it: the decision matrix

Three months into a Copilot deployment is the right time to run a sober review. We use this matrix with clients. Pull the actual usage telemetry from the Microsoft 365 admin centre and put each user in one of the buckets.

This sounds harsh, but Microsoft will happily let you keep paying for unused licences forever. The only person watching the meter is you. This review belongs in the quarterly licence optimisation cycle, not in an annual renewal scramble.

The bit nobody talks about: information security exposure

Beyond ROI, there is a security conversation that has to happen before any meaningful Copilot rollout. Copilot indexes a lot of your tenant. If you have not addressed sensitivity labels, retention policies and DLP, you are increasing the blast radius of any future credential compromise.

A compromised user account is bad. A compromised user account with Copilot is worse, because an attacker can now ask “summarise all emails about acquisitions in the last six months” and get an instant briefing. This is not theoretical. Microsoft published guidance on it. Zero trust principles matter here, Copilot is exactly the kind of capability that benefits from least-privilege and conditional access.

For Melbourne SMEs subject to the Australian Privacy Act, including the 2024-25 amendments, there is also a real question about whether Copilot’s indexing creates new obligations around the personal information you hold. The short answer is yes, the longer answer is “talk to your privacy officer before deployment, not after”.

What a sensible Copilot rollout actually looks like

This is the playbook we run for clients. It is unglamorous and deliberately slow.

Month one: Permissions audit on the SharePoint tenant. Fix anything where “Everyone except external users” has access to confidential content. Establish sensitivity labels for at least the three most critical content categories. Identify use-case champions per department.

Month two: Targeted pilot with five to ten high-ROI users, typically the EA, two senior salespeople, the CFO, and an HR manager. Weekly check-ins to capture actual prompts and use cases that work.

Month three: Capture telemetry, run the kill-keep-expand matrix, document the use cases that landed, and write a one-page internal guide. Expand to adjacent roles where champions have asked for it.

Month six: Sober review. Reclaim licences. Decide whether to expand further or hold.

For a 40-person Melbourne business that does this properly, the answer is often that 12 to 15 licences are highly productive and the other 25 should never have been purchased. That is fine. The cost of three months of restraint is small. The cost of an enthusiastic blanket rollout that nobody uses is roughly $20,000 a year, every year, until somebody notices.

How TechAssist approaches Copilot rollouts

We run Microsoft 365 environments for Melbourne businesses with 13 Melbourne-employed staff across our Tecoma head office and our Bourke Street CBD office. Copilot landed in the middle of our existing M365 practice, so we treat it as a configuration and adoption project, not a magic product. Our standard approach starts with a tenant readiness assessment, permissions, data classification, DLP, conditional access, before we let a single Copilot licence go live.

Because we work under a per-user fixed monthly model, we do not have any commercial incentive to push you into licences you will not use. The opposite, actually, licence sprawl in a managed tenant just creates support overhead for us with no upside. When we tell a client “buy five Copilot licences, not fifty”, that is genuinely what we think will work best.

Our Tecoma NOC handles the day-to-day tenant monitoring, with 24/7 on-call and emergency support for P1 incidents. If a Copilot rollout creates a sensitive data exposure incident at 11pm on a Tuesday, somebody picks up the phone. That matters for any AI deployment touching production data.

Frequently Asked Questions

Is Microsoft 365 Copilot worth it for a 20-person business?

Probably for two or three specific roles, almost certainly not for all 20. The roles where it pays back fastest are EA, senior sales, finance leadership and HR. We would suggest piloting with those people for three months before any wider rollout. The fixed cost per licence is the same whether you are 20 people or 2,000, so the per-role economics do not change with company size.

Will Copilot read my emails and tell my competitors?

No. Microsoft 365 Copilot operates inside your tenant boundary and your data is not used to train the foundation models. The genuine risks are internal, over-permissive SharePoint access, accidental data exposure to staff who should not see something, and the increased blast radius if an account is compromised. These are configuration problems you can solve.

What is the difference between Copilot and ChatGPT for business?

ChatGPT Team and ChatGPT Enterprise are general-purpose AI assistants that do not connect to your Microsoft tenant data. M365 Copilot is a Microsoft-tenant-aware assistant that can read your files, mail and chat with appropriate permissions. They are not really competitors, many businesses use both. The choice is about whether you need the AI to operate against your own organisational content, or whether web-grounded general intelligence is enough.

How long does a Copilot rollout actually take?

For a small Melbourne business with reasonable Microsoft 365 hygiene, three months from kickoff to a stable, measurable steady state. For a business with a neglected SharePoint estate, six months including remediation. The remediation work is valuable independent of Copilot, so it is not wasted effort.

Can I get Copilot to summarise Teams meetings without paying $44.90 per user?

Teams Premium ($14 per user per month) gives you AI-generated meeting recaps and intelligent recap features without the full Copilot licence. For organisations that mostly want meeting summarisation rather than tenant-wide AI, Teams Premium is a much cheaper answer. We often recommend it as a stepping stone.

What happens if we cancel Copilot after three months?

If you bought annual licences, you are on the hook for the rest of the term. If you bought monthly, you can cancel at the end of the next billing cycle. This is why we push hard on monthly billing for the pilot phase and only move to annual for users who have proven their ROI. Microsoft will discount annual heavily, but the flexibility premium is worth paying during the trial period.

The honest summary

Copilot is a real tool with real ROI for the right people. It is not a productivity revolution for everyone. The Melbourne SMEs getting value from it are the ones who picked their pilot users carefully, fixed their SharePoint mess first, named a champion per department, and ran a sober review at three months. The ones who bought 50 licences in a wave of enthusiasm and never followed up are quietly burning $26,000 a year on a feature most of their staff have not opened since February.

If you would like a frank conversation about whether Copilot is paying back in your tenant, or whether it could, with the right rollout, get in touch. We will tell you the truth, including the times when the answer is “cancel half of them and run the rest properly”.