Outlook That Works for You: Rules, Focused Inbox and Templates

Outlook rules are the single fastest way to stop drowning in email. They sort, file, flag and forward messages automatically, the moment they arrive, so your inbox shows you what matters and quietly parks the rest. Combine them with Focused Inbox, Quick Steps and templates, and Outlook starts working for you instead of the other way around.

This is a practical guide to the features that genuinely save time across the new Outlook, Outlook on the web and the classic desktop app. No theory, no clearing of throats. The examples come from configuring Microsoft 365 for Melbourne SMEs day in, day out, and there is a short security note near the end that every business owner should read.

Rules: the workhorse

A rule is a simple instruction: when a message meets a condition, do something with it. When it is from your accountant, move it to the Finance folder. When the subject contains “invoice”, flag it. When it is sent to a distribution list you only skim, mark it read and file it. You build them once and they run forever.

Server-side versus client-side rules

This distinction matters more than most people realise. Server-side rules run on the Exchange Online server, so they work whether or not your computer is on. A rule that files newsletters runs at 2am while your laptop is shut. Client-side rules only run while the classic Outlook desktop app is open and connected, because they depend on something only the desktop app can do.

The trigger for the difference is the action. Conditions and actions that Exchange understands on its own — move, copy, delete, forward, flag, mark as read — stay server-side. The moment a rule includes something the server cannot do, such as “display a desktop alert”, “play a sound”, or “move to a folder in a local PST”, the whole rule becomes client-only. In Outlook you will see these flagged with “on this computer only”.

The practical advice: keep your important filing and forwarding rules server-side so they run reliably from any device, including the Outlook mobile app and the web. Save client-side rules for cosmetic things you genuinely only want while sitting at that one machine. If you live across a desktop, a laptop and your phone, server-side is the only way to get consistent behaviour everywhere.

Where to build them

In the new Outlook and Outlook on the web, go to Settings > Mail > Rules and select Add new rule. In classic desktop Outlook, it is File > Manage Rules & Alerts, or right-click a message and choose Rules > Create Rule to pre-fill the conditions from that message. Building from an example message is the quickest way to get a rule right first time.

Rule recipes that earn their keep

• Tame distribution lists. Mail sent to a group you are on but rarely need urgently: move it to a dedicated folder and mark it read. You read it when you choose, not when it pings.
• Surface the important senders. Mail from your top clients or your boss: flag for follow-up and keep it in the inbox so it never gets buried.
• File the predictable stuff. Statements, system notifications, monitoring alerts and receipts: route straight to topic folders so the inbox stays for things that need a human decision.
• Catch the subject keywords. Anything with “PO”, “RFQ” or a project code in the subject into the relevant project folder, so nothing scatters.

One caution: rules run in order, top to bottom, and some can “stop processing more rules”. A common trap is a tidy-up rule near the top quietly swallowing messages a later rule was meant to catch. Review the order when something stops arriving where you expect it.

Focused Inbox, Other and Sweep

Focused Inbox splits your inbox into two tabs: Focused for the mail Outlook judges important, and Other for the rest — newsletters, notifications, bulk mail. It learns from your behaviour. Move something from Other to Focused a couple of times and it gets the message. It is on by default in most Microsoft 365 tenants and you can toggle it under View > Show Focused Inbox.

People either love it or fight it. The honest take: Focused Inbox is machine-guessed and changes daily, whereas a rule is a guarantee you wrote yourself. Use Focused Inbox as a soft first pass for mail you have not categorised, and use rules for anything where you need certainty. If you turn Focused Inbox off, your rules still do their job.

Sweep is the underused companion. Select a sender, hit Sweep, and you can delete all current mail from them, delete everything older than a set number of days, or keep only the latest and auto-delete the rest going forward. It is the fastest way to clear a sender who emails you forty times a week — a standing instruction rather than a one-off delete.

Quick Steps: one click, several actions

Quick Steps (classic desktop and increasingly the new Outlook) bundle a sequence of actions behind a single button. Where a rule runs automatically, a Quick Step runs when you click it — perfect for the repetitive handling you do by hand.

A help desk in Cremorne we set up uses one called “To Project” that, in a single click, moves the selected email to a project folder, marks it read and categorises it. Other useful ones: “Reply & Archive”, “Forward to team and flag”, or a “Done” button that files and clears. You will find them on the Home ribbon, and you can build your own from the Manage Quick Steps option. Five minutes setting up three Quick Steps removes hundreds of repeated clicks a month.

Templates, My Templates and Quick Parts

If you type the same reply more than twice, template it.

• My Templates is an add-in built into Outlook on the web and the new Outlook. Open the My Templates pane while composing, click a saved snippet, and it drops straight into the message body. Ideal for standard responses — opening hours, “received, we’ll be in touch”, booking confirmations.
• Quick Parts in classic desktop Outlook store reusable blocks of formatted text under Insert > Quick Parts. Better than My Templates when you need formatting, tables or images preserved.
• Email templates proper (.oft files) suit a whole pre-built message you send repeatedly — save via Save As > Outlook Template, reopen via New Items > More Items > Choose Form.

For replies that several staff send identically, templates beat everyone improvising. They keep the wording consistent and on-brand, and they spare you retyping the same paragraph for the hundredth time.

Signatures, and why org-wide ones belong centrally

Per-mailbox signatures are set under Settings > Mail > Compose and reply in the new Outlook, or File > Options > Mail > Signatures in classic desktop. Fine for one person.

For a business, leave individual signatures behind. When everyone manages their own, you get mismatched fonts, dead phone numbers, broken logos and the occasional rogue inspirational quote. Worse, signatures set in Outlook desktop do not follow you to the web or the mobile app, so a phone reply goes out bare. The fix is a centrally managed signature applied at the Microsoft 365 service level — typically a transport rule or a dedicated signature platform — so every message from every device carries a consistent, correct, compliant footer your staff cannot break. We set this up as part of a managed Microsoft 365 environment, and it is one of those small things that quietly makes a business look more professional overnight.

Categories and Search Folders

Colour categories are a flexible tagging layer that works across mail, calendar and tasks. Tag by client, by project, by priority — whatever you actually sort by. Rename the default colours to something meaningful (right-click a message > Categorize > All Categories) and you can later filter or search on them in seconds.

Categories pair beautifully with Search Folders (classic desktop). A Search Folder is a saved, live view that gathers every message matching a rule no matter which folder it physically lives in — “all unread”, “flagged for follow-up”, “anything categorised Urgent”. The mail stays put; the Search Folder is just a smart window onto it. Set up two or three and you stop hunting through folders.

Scheduling: Calendar and Bookings

For internal scheduling, the Outlook calendar’s Scheduling Assistant shows colleagues’ free/busy so you stop the back-and-forth of finding a slot. For external scheduling, Microsoft Bookings — included in most Microsoft 365 Business plans — gives clients a public page to book a time against your real availability, with automatic confirmations and reminders. A consultancy in Box Hill we work with replaced a week of email tag with a Bookings page link in their signature; clients self-serve and the calendar fills itself.

Microsoft 365 mailbox hygiene

Rules and folders only help if the mailbox underneath is healthy.

• Archive, do not hoard. Use the Online Archive (auto-expanding in most business plans) and a retention/archive policy so the primary mailbox stays lean. Searching a 90GB mailbox is slow and painful.
• Unsubscribe, do not just delete. If you delete the same newsletter daily, you are doing manual labour a single unsubscribe would end.
• Audit your rules quarterly. Old rules forwarding to a former colleague, or filing into a folder nobody opens, accumulate quietly. Prune them.
• Keep it in folders, not the inbox. A 12,000-message inbox is a search problem waiting to happen. Let rules and Quick Steps do the filing.

A security note on forwarding rules

This one is not optional reading. Auto-forwarding rules — especially ones that quietly send copies of mail to an external address — are a classic indicator of a business email compromise (BEC). When an attacker phishes a mailbox, one of the first things they do is create a hidden rule that forwards finance-related mail out, or deletes the attacker’s own messages so the real user never sees the fraud playing out. Many breaches run for weeks behind a single forwarding rule nobody noticed.

Treat any unexpected forwarding rule, or a rule sending mail straight to Deleted Items or RSS Feeds, as a red flag worth investigating immediately. In a well-run tenant, external auto-forwarding is blocked or alerted on by default, and we monitor for rule changes as part of mailbox security. If you want the detail on how these attacks work and how to defend against them, our guide to business email security, phishing and BEC walks through it. Convenience features and attacker tools share the same plumbing here — which is exactly why the plumbing needs watching.

Frequently asked questions

Do my Outlook rules work when my computer is off?

Only if they are server-side rules. Move, forward, flag, delete and mark-as-read actions run on the Exchange Online server and work around the clock from any device. Rules with desktop-only actions — alerts, sounds, or moving to a local PST — run solely while the classic desktop app is open and are labelled “on this computer only”.

Should I use Focused Inbox or rules?

Both, for different jobs. Focused Inbox is an automatic best-guess that adapts over time and suits mail you have not specifically sorted. Rules are guarantees you write yourself for senders or subjects where you need certainty. Rules keep working whether Focused Inbox is on or off.

How do I save email templates for replies I send constantly?

Use My Templates (the snippet pane in Outlook on the web and new Outlook) for quick text blocks, Quick Parts in classic desktop when you need formatting preserved, or a saved .oft template for an entire pre-built message. For replies several staff send identically, templates keep the wording consistent.

Why should signatures be managed centrally?

Because signatures set in one Outlook app do not follow you to the web or mobile, and self-managed signatures drift into broken logos, dead numbers and inconsistent formatting. A signature applied at the Microsoft 365 service level applies to every message from every device, stays consistent, and cannot be broken by individual users.

Are forwarding rules dangerous?

Legitimate ones are fine, but an unexpected rule that forwards mail to an external address is one of the most common signs of a compromised mailbox. Attackers use them to siphon finance emails or hide their tracks. Review your rules periodically and have external auto-forwarding blocked or alerted on at the tenant level.

Make Outlook earn its keep

None of this needs new software — it is all sitting in the Microsoft 365 you already pay for. An hour spent building a handful of rules, a few Quick Steps and some templates pays itself back every single week. The catch is doing it properly: server-side where it counts, central signatures, sensible retention, and a tenant configured so the convenience features cannot be turned against you.

We are a Melbourne-based MSP with 13 Australian-employed engineers, and getting clients the full value of their Microsoft 365 — configured securely, not just switched on — is core to what we do. If you would like your tenant set up so Outlook genuinely works for your team, get in touch and we will sort it.

Microsoft Purview is Microsoft’s data governance and compliance suite inside Microsoft 365 — the rebranded, expanded successor to what used to be called the Microsoft 365 Compliance Centre. It is how you classify, protect, retain and audit your organisation’s data, and it is the layer that decides what Copilot is allowed to see.

For a Melbourne SME, the practical question is not “what is Purview” but “which bits do I already pay for, and what should I switch on first?” This post answers both, without the marketing gloss.

What Microsoft Purview actually is

Purview is an umbrella brand. Under it sit a set of tools that used to be scattered across separate portals. They are now grouped at purview.microsoft.com and broadly cover two jobs: knowing where your sensitive data is, and controlling what happens to it.

The capabilities that matter to most small and mid-sized businesses are:

• Sensitivity labels — tags like Confidential or Internal that travel with a file or email and can enforce encryption and access rules.
• Data Loss Prevention (DLP) — rules that stop sensitive data, such as credit card or Tax File Numbers, from leaving the organisation by email, Teams or to USB.
• Retention policies and labels — rules that keep records for a set period and delete them when they expire, which is how you meet records-keeping obligations without hoarding everything forever.
• eDiscovery — the ability to search across mailboxes, SharePoint and Teams to find content for a legal matter, dispute or regulator request.
• Audit — a searchable log of who did what: who opened a file, who deleted a mailbox item, who changed a permission.
• Insider risk management — analytics that flag risky behaviour, such as a departing employee mass-downloading client files.
• Communication compliance — monitoring of internal messaging for harassment, code-of-conduct breaches or regulated-industry conduct rules.

You will not use all of these on day one, and you should not try to. The point is that Purview is where data governance lives once you decide to take it seriously.

What you get with Business Premium, and what needs E5

This is where most decisions get made, because the licensing split is real and it is easy to overspend or assume you have features you do not.

Microsoft 365 Business Premium — the plan most Melbourne SMEs land on — includes a genuinely useful slice of Purview. You get manual sensitivity labels, basic DLP for Exchange, SharePoint, OneDrive and Teams, basic retention policies, standard audit logging, and basic eDiscovery (search and export). For a business under 300 seats, that is enough to make a real difference.

The advanced tier sits behind Microsoft 365 E5, the E5 Compliance add-on, or standalone Purview add-ons. That is where you find automatic labelling, DLP that extends to endpoints and browsers, communication compliance, insider risk management, eDiscovery (Premium) with legal hold and review sets, and longer audit retention.

The honest advice: do not buy E5 because the feature list looks impressive. Buy it when you have a specific obligation — a regulator, an insurer, a contract — that needs automatic labelling, endpoint DLP or insider risk. Most SMEs get years of value out of the Business Premium tier first. If you are weighing up the plans, our guide to what is included with Microsoft 365 support in Melbourne sets out where the lines fall.

What to do first: labels and DLP

If you take one thing from this post, take this. Start with sensitivity labels and DLP. They give you the most protection for the least effort, and everything else builds on them.

Sensitivity labels

A sensitivity label is a tag a user applies to a document or email. A typical SME set is three or four labels: Public, Internal, Confidential, and perhaps Highly Confidential. The label can be cosmetic (a footer marking) or it can enforce real controls — encryption, a watermark, blocking external sharing.

Start cosmetic, get people used to choosing a label, then add enforcement to the top one or two. A label that encrypts Confidential files means a document forwarded to the wrong address is unreadable to the recipient. That single control has saved more SMEs than any firewall rule.

Data Loss Prevention

DLP inspects content against patterns and conditions you set, then acts. The patterns Australian businesses care about are built in or easy to define: Tax File Numbers, Medicare numbers, credit card numbers, ABNs, driver licence details. A starter DLP policy might warn a user — or block outright — when they try to email a spreadsheet containing more than a handful of TFNs to an external address.

Begin every DLP rule in audit-only mode. Let it run for a fortnight, see what it would have flagged, and tune out the false positives before you switch to blocking. Turn DLP straight to block on day one and you will have the finance team locked out of legitimate work by Tuesday. DLP sits naturally alongside the rest of your cyber security services stack — it is the data-layer complement to identity controls like conditional access.

Retention, eDiscovery and audit: the records side

The governance half of Purview is about keeping the right things for the right length of time, and being able to find them.

Retention answers a question every business eventually faces: how long do we keep this? Some records have legal minimums — employee records under the Fair Work Act, financial records under the Corporations Act, health records under state health-records legislation. Retention policies enforce those minimums automatically and, just as importantly, delete data once the obligation lapses so you are not holding a decade of client files that are now pure liability.

eDiscovery earns its keep the day you receive a subpoena, a Fair Work claim or an OAIC enquiry. Instead of an engineer manually trawling mailboxes, you run a content search across Exchange, SharePoint and Teams and export exactly what is in scope. Standard eDiscovery in Business Premium handles most SME needs.

Audit is the quiet hero. When something goes wrong — a deleted file, a mailbox rule someone did not set, a permissions change — the audit log tells you who and when. It is also frequently the first thing a cyber insurer or incident responder asks for. If you are thinking about coverage, audit logging is part of what makes a claim defensible; our cyber insurance guide for Australian SMEs covers the broader picture.

Governance before AI: Purview and Copilot

This is the use case pushing Purview up the priority list for 2026. Microsoft 365 Copilot answers questions using your organisation’s data — every file, email and chat the asking user already has permission to see. That is the catch. Copilot does not break permissions; it surfaces what loose permissions already expose.

If your SharePoint has a “Company” site everyone can read, and someone parked the payroll spreadsheet there three years ago, Copilot will happily summarise salaries when an employee asks. The file was always accessible — nobody ever browsed to it. Copilot removes that friction.

This is why governance comes before AI, not after. Sensitivity labels let you mark and encrypt the data Copilot should never reuse. DLP and retention reduce the volume of stale, mislabelled data sitting in shared locations. Auditing tells you what Copilot has been asked. Switching on Copilot without doing this first is how a tidy-looking rollout becomes a quiet data-exposure incident.

The same logic applies to the Privacy Act 1988. Under the Australian Privacy Principles, you are obliged to take reasonable steps to protect personal information and to not keep it longer than needed. Reforms now working through Parliament are tightening those expectations, including around automated decision-making and data minimisation. Purview’s labelling, DLP and retention are precisely the “reasonable steps” the Office of the Australian Information Commissioner (OAIC) expects you to be able to demonstrate.

A Hawthorn scenario

A professional services firm in Hawthorn we work with wanted to roll out Copilot across forty staff. Before flicking it on, we ran a labelling and permissions review. We found three SharePoint sites with broad read access holding client financials and a folder of scanned passports from an old onboarding process. We applied Confidential labels with encryption to the sensitive sites, tightened the permissions, set a DLP rule on TFNs and Medicare numbers, and added a retention policy that purged the passport scans that should have been deleted years earlier. Copilot went live two weeks later — on data that was actually governed. The firm now has something concrete to show their professional indemnity insurer.

That sequence — govern, then enable — is the whole game. TechAssist has run Microsoft 365 for Melbourne SMEs since 2014, with thirteen Australian-employed engineers and a 24/7 NOC in Tecoma, and the Purview-before-Copilot review has become one of the more common pieces of work we do.

Frequently asked questions

Is Microsoft Purview a separate product I have to buy?

No. Purview is the brand for governance and compliance tools built into Microsoft 365. A meaningful set is already included with Business Premium. You only pay extra — through E5 or the E5 Compliance add-on — for advanced features such as automatic labelling, endpoint DLP and insider risk management.

What is the difference between sensitivity labels and retention labels?

Sensitivity labels control protection — encryption, access and markings on a file. Retention labels control lifecycle — how long an item is kept and when it is deleted. They solve different problems and you typically use both: sensitivity to protect, retention to keep or dispose.

Do I need Purview before turning on Copilot?

You should. Copilot surfaces anything the asking user can already access, so existing over-permissioned data becomes far easier to stumble across. Sorting out labels, permissions and DLP first stops Copilot turning a hidden exposure into an obvious one.

Does Purview help with the Privacy Act?

It helps you demonstrate compliance. The Australian Privacy Principles require reasonable steps to protect personal information and to not retain it beyond need. Purview’s DLP, sensitivity labels and retention policies are practical, auditable controls that show the OAIC you have taken those steps.

Where to start

Do not boil the ocean. Pick three or four sensitivity labels, switch on a couple of DLP rules in audit mode, and set retention on your one or two most regulated record types. That alone puts you ahead of most SMEs and gives you a defensible governance baseline — and the foundation you need before any AI tool touches your data.

If you would like a hand scoping a Purview rollout, sorting your Microsoft 365 licensing, or running a governance review before you enable Copilot, get in touch with TechAssist. We will tell you plainly what you already have, what is worth turning on, and what you can safely leave alone.

For most Australian SMEs the honest answer to Microsoft 365 vs Google Workspace comes down to how your team actually works. Google suits lean, cloud-native businesses that live in a browser. Microsoft suits desktop-heavy, Windows-fleet, compliance-driven operations. Both are mature, secure platforms — the wrong fit just costs you in friction.

We’re a Microsoft-centric MSP, so I’ll declare that bias up front. But there are plenty of Melbourne businesses where I’d point a client to Google without hesitation. This is a fair comparison, not a sales pitch, and below there’s a table to cut through the marketing on both sides.

The quick comparison

Pricing changes regularly and varies by term and reseller, so treat those figures as a guide rather than a quote. The real cost difference between the two is usually rounding error compared with the cost of choosing the platform that fights your workflow.

Apps: desktop power vs web speed

This is the clearest fork in the road. Microsoft gives you the full desktop Office suite — the real Excel, with the pivot tables, Power Query, macros and add-ins that finance teams and engineers depend on. If your business runs complex spreadsheets, branded Word templates, or PowerPoint decks that have to look identical every time, desktop Office still has no equal.

Google Workspace is web-first and proud of it. Docs, Sheets and Slides load instantly, autosave constantly, and make real-time co-editing feel effortless. For a marketing agency or a startup where two people are in the same document at once all day, that collaboration model is genuinely better. The trade-off is depth: heavy Excel users hit Sheets’ ceiling quickly, and complex formatting can drift.

Where Google clearly wins: if your team already does everything in a browser and nobody opens a desktop app from one week to the next, paying for desktop Office you’ll never install is waste.

Email: Outlook vs Gmail

Exchange Online with Outlook is the workhorse of Australian business email. Shared mailboxes, delegate access, distribution groups, calendar scheduling across a team — it’s all mature and granular. For a law firm in Hawthorn juggling shared client inboxes and rigid retention rules, Exchange and Microsoft Purview make that straightforward.

Gmail’s strength is search and filtering. Its spam and phishing detection is excellent, the interface is clean, and conversation threading is hard to beat. Smaller teams often find Gmail simply gets out of the way. Either way, email is your single biggest attack surface — we cover that in our guide to business email security and BEC, and the controls matter more than the brand.

Storage: OneDrive/SharePoint vs Drive

Microsoft splits storage into OneDrive (your personal files) and SharePoint (team document libraries). Done well, SharePoint is a proper intranet and document-management system with versioning, metadata and permissions. Done badly, it’s a sprawl of sites nobody can navigate. It rewards structure.

Google Drive with Shared Drives is more intuitive out of the box. Files live where you’d expect, sharing is a couple of clicks, and there’s less to misconfigure. For a business that just wants files in folders without a SharePoint information-architecture project, Drive is the gentler path.

Meetings: Teams vs Meet and Chat

Teams is the centre of gravity in the Microsoft world — meetings, calls, persistent chat, channels and an app platform all in one. For organisations already on Microsoft, that integration is a real advantage; for ones that aren’t, Teams can feel like a lot. Plenty of people find it heavy.

Google Meet and Google Chat are deliberately lighter. Meet is reliable, browser-based and quick to join with no client to install. If your meetings are mostly external and you value “click the link and you’re in”, Meet’s simplicity is a genuine plus. Microsoft’s edge shows up in internal collaboration depth, calling features and telephony integration.

Identity, admin and security

This is where Microsoft pulls ahead for businesses that need it. Microsoft Entra ID (the identity platform formerly known as Azure AD) offers some of the most granular access controls available — you can require multi-factor authentication only from unmanaged devices, block sign-ins from outside Australia, or enforce compliant-device checks. We walk through this in our piece on conditional access policies in Microsoft 365. Defender and Purview add threat protection and data-loss prevention that map neatly onto frameworks like the Essential Eight.

Google’s admin console is more approachable. Fewer settings means less to get wrong, which for a small team without dedicated IT is a real benefit. Google’s identity and security are strong — context-aware access and solid MFA — but Microsoft’s controls go deeper for complex, regulated or hybrid environments where on-premises Active Directory is still in the mix.

Compliance and data residency

For Australian businesses bound by the Privacy Act and the OAIC’s Notifiable Data Breaches scheme, data residency and auditability matter. Microsoft offers Australian data centres for core data at rest and gives detailed control over retention, legal hold and audit logging through Purview — useful for sectors under AHPRA, ASIC or similar oversight.

Google Workspace provides regional storage options and strong compliance certifications, though some processing still happens across its global infrastructure. For most SMEs that’s perfectly acceptable. For a healthcare practice or a firm with strict data-handling obligations, Microsoft’s granular controls usually make the compliance conversation easier — see our notes on healthcare IT and OAIC obligations.

Migration effort

Moving platforms is rarely trivial. Email migrates reasonably well in both directions, but the friction lives in the details: shared mailboxes, calendar permissions, distribution lists, and re-training people on a new interface. Document migration is messier — Google formats don’t always survive a clean trip into Office, and complex Excel or SharePoint structures don’t always land neatly in Sheets and Drive.

The practical rule is to migrate once, deliberately, and stay put. Bouncing between platforms because of a price tweak costs far more in lost time than it saves. Whichever way you go, plan the cutover properly and run the two systems in parallel briefly so nothing falls through the cracks.

A Melbourne example

A construction firm in Box Hill we work with came to us split down the middle — the site teams lived in Gmail on their phones, while the office ran Excel-heavy estimating and project schedules that Sheets simply couldn’t handle. They’d been arguing about it for a year. We standardised them on Microsoft 365 because the desktop Office dependency was non-negotiable for their estimators, then used Teams to pull the field and office staff onto one platform. Had their work been browser-only, we’d have recommended Google and meant it.

That’s the point. TechAssist is a Melbourne-based MSP founded in 2014 with 13 Australian-employed engineers, and most of our client base runs Microsoft because that’s where desktop-heavy, compliance-driven Australian businesses tend to land. But the right answer is the one that fits how your people actually work, not the one your MSP is most comfortable supporting.

Frequently asked questions

Is Microsoft 365 more secure than Google Workspace?

Neither is inherently more secure — both are mature, well-defended platforms. The difference is control depth. Microsoft Entra ID and Defender offer more granular configuration, which helps in regulated or complex environments. Google’s simpler model means fewer settings to misconfigure, which suits smaller teams. Security comes from how you configure either platform, not the logo.

Can I run both Microsoft 365 and Google Workspace?

You can, and some businesses do — for example, Microsoft for email and Office, Google for a specific cloud tool. But running both means two sets of licences, two admin consoles and two security surfaces to manage. For most SMEs the overhead outweighs the benefit. Pick one as your primary platform.

Which is cheaper for a small Australian business?

Entry tiers are close — Microsoft 365 Business Basic and Google Business Starter sit within a few dollars of each other per user per month. The bigger cost is fit: paying for desktop Office you never use, or wrestling with Sheets when you need real Excel, costs far more than the licence-price gap.

How hard is it to migrate from Google to Microsoft?

Email migrates fairly cleanly; documents and shared-drive structures are where the work lives. Expect format conversion, permission rebuilding and user re-training. With a planned cutover and a short parallel-run period it’s very manageable — the mistake is doing it ad hoc without a migration plan.

Getting the decision right

If your business is lean, cloud-native and browser-first, Google Workspace is a strong, often better choice — and we’ll tell you so. If you’re desktop-heavy, running a Windows fleet, or carrying real compliance obligations, Microsoft 365 usually wins, and it’s where our Microsoft 365 support is built to add the most value with security and identity configured properly rather than left on defaults.

Not sure which way to jump? Get in touch and we’ll look at how your team actually works before recommending anything. No pressure to switch, and an honest answer either way.

Windows Autopilot is a Microsoft service that lets a brand-new laptop set itself up automatically the first time a staff member turns it on. The device ships from the vendor straight to the user, connects to your Microsoft tenant over the internet, and configures itself — no imaging, no SOE, no IT hands on it.

If onboarding a new hire still means a laptop landing on an engineer’s desk for a day of imaging, this is the fix. Below: what Autopilot does, how a device self-provisions, the moving parts, the deployment modes, the licensing, and where an MSP fits in.

What Windows Autopilot actually is

Autopilot is not an imaging tool — there is no gold image and no USB stick. It takes the standard Windows installation the manufacturer already put on the device and transforms it into your corporate build during the out-of-box experience (the setup screens a user sees on first boot). It runs on two Microsoft cloud services: Microsoft Entra ID (formerly Azure AD) handles identity and joins the device to your directory, and Microsoft Intune — the mobile device management (MDM) platform inside Microsoft 365 — pushes down your policies, apps, baselines and configuration. A machine the user has never touched arrives configured exactly like every other device in the business, enrolled, encrypted and ready to work.

The problem it solves: no more manual imaging or SOE

The traditional approach was the Standard Operating Environment: you built a master image, captured it, and re-applied it to every new or rebuilt machine. The costs add up. Devices have to be shipped to IT first, imaged, then re-shipped to the user — adding days and double the freight. The image goes stale the moment it is captured and needs constant rebuilding. And it does not scale: imaging a laptop for someone starting in a Dandenong warehouse means shipping it to your office or sending an engineer out.

Autopilot removes the imaging step entirely. The configuration lives in the cloud and is applied at first boot, so the same provisioning works whether the user is in your CBD office or at home in Ringwood.

How a device self-provisions on first login

The sequence when an Autopilot-registered device is unboxed:

1. The user powers on the laptop and connects to Wi-Fi or ethernet — internet access is the only prerequisite.
2. Windows checks in with Autopilot, recognises the device by its hardware identity, and pulls down the assigned profile, which customises the setup screens and applies your branding.
3. The user signs in with their Microsoft 365 work account; Entra ID authenticates them and joins the device to your directory.
4. Intune enrolment kicks off automatically, pulling down your configuration profiles, security baseline, certificates, Wi-Fi settings and assigned apps.
5. The Enrollment Status Page blocks the user from reaching the desktop until the mandatory apps and policies have landed.

When it finishes, the first person to log into that machine is the staff member it was bought for — not an engineer — at a fully managed, encrypted desktop.

The moving parts

Autopilot profiles

A profile is the deployment template you assign to a group of devices in Intune. It controls the out-of-box experience: which setup screens are hidden, whether the user becomes a local administrator or standard user, the deployment mode, the naming convention and your branding. Most businesses run one or two — a user-driven profile for staff laptops, sometimes a separate one for shared devices.

The Enrollment Status Page

The Enrollment Status Page (ESP) shows setup progress and gates access to the desktop until the apps and policies you mark mandatory have installed — so a new starter cannot begin work on a half-configured machine. Block on a slow or flaky app, though, and you leave users staring at a spinner; tuning it well is one of the fiddlier parts of the job.

Hardware hash and device registration

Autopilot identifies each device by a hardware hash — a unique fingerprint of its components — which must be registered against your tenant before first boot. With OEM / CSP registration, the hardware vendor or Cloud Solution Provider partner registers the hash to your tenant at purchase, so the device is Autopilot-ready before it leaves the warehouse — the clean path for volume orders. For devices you already own, manual hash collection exports the hash into Intune with a PowerShell script, but that means handling the device once. Build OEM or CSP registration into your procurement so hardware arrives pre-registered; that is what makes true drop-ship onboarding possible.

Deployment modes: user-driven vs self-deploying and kiosk

Autopilot supports several modes, depending on how the device will be used:

User-driven is what most growing teams use. Self-deploying and kiosk modes suit devices no single staff member owns — a reception terminal in a Hawthorn clinic, a warehouse scanning station — and need a TPM 2.0 chip, which any recent business device has.

Prerequisites: what you need before you start

Autopilot is not a standalone product — it is a capability on top of Microsoft 365. You need:

• Microsoft Entra ID for identity and device join — the standard directory in a Microsoft 365 business or enterprise subscription covers this, though some advanced enrolment options want Entra ID P1.
• Microsoft Intune licensing for the MDM management — included in Microsoft 365 Business Premium and the E3/E5 plans. On a cheaper plan you will need to add Intune first.
• Devices that ship with Windows 11 Pro or Enterprise — the Home edition cannot be managed this way.
• A configured tenant — your Intune profiles, security baselines, app deployments and ESP set up before the first device ships.

That last point is the one businesses underestimate: Autopilot delivers whatever you have built in Intune, so the value is in the policies and app packaging, not the provisioning trick itself. If you are reviewing your licensing, our Microsoft 365 support team can tell you whether your plan already covers what Autopilot needs.

Why this matters: fast onboarding and consistent security baselines

Two things drive most businesses to Autopilot. The first is onboarding speed: a drop-shipped self-provisioning laptop takes the engineer, the queue and the freight out of every hire. The second, and arguably more important, is consistent security baselines. Because every device is built from the same Intune configuration, every machine gets BitLocker encryption, the same firewall and account-protection policies, Defender, conditional access and patching automatically — no engineer remembering to tick a box. An enforced baseline across the fleet is exactly what the Essential Eight mitigation strategies expect, and the same Intune layer lets you wipe a lost device remotely the moment a laptop goes missing on a train at Box Hill — it pairs naturally with conditional access policies in Microsoft 365.

A Melbourne scenario

An engineering consultancy in Camberwell we work with was hiring two or three people a month and rebuilding laptops by hand each time — a machine couriered to their office, half a day of imaging, and a checklist someone occasionally skipped, so no two laptops were quite the same and a couple shipped without disk encryption on.

We stood up their Intune configuration, built a user-driven Autopilot profile with a tuned Enrollment Status Page, and arranged for new hardware to be registered at purchase. Now a laptop is drop-shipped to the new hire; they open the box, sign in, and an hour later are working on a fully configured, encrypted device identical to everyone else’s. Their office manager handles onboarding without touching a technical step, and the fleet has a uniform baseline at last.

The MSP role in setting it up

The provisioning is the easy part to demonstrate and the hard part to build well. The work an MSP does sits underneath what the user sees:

• Designing and hardening the Intune configuration — the compliance policies, configuration profiles, security baselines and app deployments every machine inherits — and packaging line-of-business apps to install silently during enrolment.
• Setting up the procurement pipeline so devices arrive Autopilot-ready, tuning the ESP, and integrating Autopilot with conditional access, encryption and your broader MDM strategy so device management is one coherent system.

TechAssist is a Melbourne MSP, founded in 2014, with thirteen Australian-employed engineers — so the people building your Intune environment are local, not offshore. We bundle this into our managed IT services, so device provisioning, patching and security baselines sit inside the fixed monthly per-user fee, not a per-device charge each time you hire.

Frequently asked questions

Do I need to wipe a new laptop before using Autopilot?

No. Autopilot works with the standard Windows installation the manufacturer ships and transforms it into your corporate configuration during first boot — there is no wiping or imaging step. Devices you already own can be reset and will provision on the next boot once registered.

What happens if there is no internet during setup?

Autopilot needs internet to reach Entra ID and Intune, so the device must connect to Wi-Fi or ethernet during the out-of-box experience. Until it does, the laptop sits at the network screen — which is why drop-ship onboarding assumes the user has working internet.

Is Autopilot the same as Intune?

No, but they work together. Intune is the management platform that holds your policies, apps and baselines; Autopilot hands a new device over to Intune at first boot. You need Intune licensing for Autopilot to do anything.

Where TechAssist fits

Autopilot looks like magic in a demo and falls over in practice if the Intune configuration behind it is thin — the provisioning is the visible part, but the policies, baselines and procurement pipeline are what make the fleet secure and consistent. If manual device setup is slowing your onboarding, get in touch and we will scope what your tenant needs.

Microsoft Defender for Business is Microsoft’s endpoint detection and response (EDR) product built specifically for small and mid-sized businesses. It bundles next-generation antivirus, EDR, threat and vulnerability management, attack surface reduction and automated investigation into one licence — enterprise-grade endpoint security at a price an SME can actually justify.

It is not the same as the free Defender that ships with Windows

This is the confusion we untangle most often. Every Windows 10 and Windows 11 machine already includes Microsoft Defender Antivirus — the free, built-in scanner that replaced the old Windows Defender. It is genuinely good antivirus. It catches known malware, runs real-time scanning, and for a home PC it is fine.

Microsoft Defender for Business is a different product that sits on top of that engine. The free antivirus protects a single device and tells that device about a threat. Defender for Business adds the layer enterprises pay for: it collects telemetry from every endpoint into a central portal, correlates suspicious behaviour across your fleet, hunts for attacker activity that signature-based antivirus never sees, and gives someone a console to investigate and respond. Antivirus asks “is this file bad?”. EDR asks “is something bad happening on this network right now, and how did it get in?”.

A small construction firm in Ringwood we onboarded last year had Defender Antivirus on every laptop and assumed they were covered. They were covered against commodity malware. They had no visibility into lateral movement, no record of what a compromised account did after a phishing click, and no way to isolate an infected machine remotely. That gap is exactly what Defender for Business fills.

How you get it: Business Premium or standalone

There are two ways to licence it. The first, and the one most Melbourne SMEs land on, is Microsoft 365 Business Premium. Defender for Business is included in that plan at no extra cost, alongside the Office apps, Exchange Online, Intune device management and conditional access. If you are already paying for Business Premium, you own Defender for Business whether or not anyone has switched it on — which, frustratingly often, nobody has.

The second is the standalone Defender for Business licence, sold per user per month for organisations that do not want the full Business Premium stack. It is capped at 300 users, in line with Microsoft’s SMB licensing ceiling. Above that you move into the enterprise Defender for Endpoint Plan 1 or Plan 2 tiers.

For most businesses under 300 staff, Business Premium is the better value because you get the security plus Intune, conditional access and the rest of the productivity suite for not much more than the standalone security licence alone. We cover what that plan actually includes in our guide to Microsoft 365 support in Melbourne, and we deploy it through our Microsoft 365 service.

What it actually does

Defender for Business is not a single feature — it is five capabilities working together. Here is what each one buys you in practice.

Next-generation antivirus

The same cloud-delivered protection as the enterprise product: behaviour-based detection, machine-learning models and near-instant cloud lookups, rather than just a local signature file. It blocks fileless attacks and never-before-seen malware that traditional antivirus misses, and it updates protection across your fleet from the cloud in minutes.

Endpoint detection and response (EDR)

This is the heart of it. Every endpoint reports process activity, network connections and file changes back to the Microsoft 365 Defender portal. When something looks like an attack — credential dumping, suspicious PowerShell, a process spawning where it shouldn’t — it raises an alert with the full chain of what happened. You can remotely isolate a device from the network, collect an investigation package, or stop and quarantine a file across every machine at once.

Threat and vulnerability management

It continuously inventories the software on your devices and flags known vulnerabilities and misconfigurations, ranked by real-world risk. Instead of guessing which of 40 outstanding updates matters, you get a prioritised list: this unpatched browser is being actively exploited, fix it first. This feeds directly into Essential Eight patching discipline.

Attack surface reduction

A set of rules that close the doors attackers walk through — blocking Office apps from spawning child processes, stopping credential theft from the Windows credential store, controlling which USB devices can mount, and filtering web content. These map almost one-to-one to the application control and macro restrictions in the Essential Eight.

Automated investigation and remediation

When an alert fires, Defender can automatically investigate it the way a junior analyst would — examining the affected device, determining whether the threat is real, and remediating low-risk detections without a human touching it. For a small team with no overnight security staff, this quietly handles a lot of the noise so the genuine incidents are the ones that reach a person.

Onboarding devices: Windows, macOS and mobile

Coverage is not Windows-only, which matters because most Melbourne SMEs run a mix. Windows 10 and 11 onboard cleanly through Intune or a local script and need no extra agent — the sensor is already in the operating system. macOS is supported with a downloadable agent, so the designer’s MacBook in the same office gets EDR too. iOS and Android are covered through the Defender app via Intune, mainly for web protection and phishing defence on phones that touch company email.

In a typical rollout we push the Windows configuration through Intune policy, deploy the macOS agent to the handful of Macs, and enrol mobiles through the company portal. Servers are worth noting: Defender for Business includes a server add-on (Defender for Business servers) licensed per server per month, so the Windows Server running your file shares or line-of-business app gets the same EDR coverage. We handle this fleet-wide as part of managed cybersecurity and managed IT services.

How it maps to the Essential Eight

The Australian Cyber Security Centre (ACSC) Essential Eight is the baseline most Australian SMEs are measured against, especially for cyber-insurance and government-adjacent work. Defender for Business does not deliver all eight on its own, but it directly supports several and gives you the evidence to prove it.

It does not cover multi-factor authentication, restricting administrative privileges, application allow-listing in full, or regular backups — those need Entra ID conditional access, Intune policy and a separate backup platform. For the full picture, see our Essential Eight compliance work. Defender for Business is a strong contributor to maturity, not a one-click compliance button.

The honest question: is it enough, or do you still need a SOC?

Here is the part most vendors skip. Defender for Business is excellent technology. It is also only as good as the person reading the alerts. The product will detect the ransomware operator moving through your network at 2am on a Sunday — but if nobody is watching the portal at 2am on a Sunday, the alert sits unread until Monday, by which point the damage is done.

This is the difference between having an EDR tool and having managed detection and response. The licence gives you the sensor and the console. It does not give you a human who triages alerts around the clock, escalates the real ones, and actually responds. For a 15-person firm, expecting your one IT-savvy staff member to monitor a security console alongside their day job is wishful thinking.

You have three realistic options. Watch it yourself, which works only if you have someone genuinely capable and available. Accept that alerts get reviewed during business hours and live with the overnight gap — defensible for lower-risk businesses, not for anyone holding sensitive client data. Or put it under managed detection and response, where a team monitors the telemetry 24/7. We dig into the distinctions between SIEM, MDR and EDR in our piece on managed cybersecurity services, and our security operations centre is how we close that monitoring gap for clients who need eyes on the alerts at all hours.

The blunt version: buying Defender for Business and switching it on is the right move for almost every SME. Believing that alone means you are protected is the mistake. A smoke detector that nobody can hear is decoration.

Frequently asked questions

Do I need Defender for Business if I already have Microsoft Defender Antivirus?

Yes, if you want real endpoint detection and response. The built-in antivirus protects individual devices against malware but gives you no central visibility, no investigation tools, no vulnerability management and no way to respond across your fleet. Defender for Business adds all of that. They work together — the antivirus is the foundation, Defender for Business is the security operations layer on top.

Is Defender for Business included in Microsoft 365 Business Premium?

Yes, at no additional cost. If you pay for Business Premium you already own it, even if it has never been configured. It is also sold as a standalone per-user licence for businesses that do not want the full Business Premium suite, capped at 300 users.

Will Defender for Business make me Essential Eight compliant?

No single product does that. It strongly supports patching, application control, macro settings and user application hardening, and it produces evidence for assessments. But you still need multi-factor authentication, restricted admin privileges and tested backups from other tools to reach a defensible Essential Eight maturity level.

Can it protect Macs and phones, not just Windows?

Yes. macOS is supported with a dedicated agent, and iOS and Android are covered through the Defender mobile app deployed via Intune, mainly for web and phishing protection. There is also a per-server add-on for Windows Server. A mixed fleet can be fully covered under one approach.

Do I still need a managed SOC if I have Defender for Business?

It depends on who watches the alerts. The tool detects threats brilliantly but does nothing on its own about an alert raised overnight or on a weekend. If you do not have someone monitoring the console around the clock, managed detection and response fills that gap. For most SMEs with sensitive data, that monitoring is what turns the licence into actual protection.

The short version

Microsoft Defender for Business gives Melbourne SMEs the same class of endpoint security that large enterprises run — next-gen antivirus, EDR, vulnerability management, attack surface reduction and automated investigation — included free with Microsoft 365 Business Premium or available standalone. It is a genuinely strong product and an easy decision to deploy. The catch is that the technology only protects you if someone acts on what it finds. As a Melbourne-based MSP with 13 Australian-employed engineers and a 24/7 NOC in Tecoma, that is the half we handle. If you are paying for Business Premium and have never switched the security on, or you are not sure anyone is watching the alerts, get in touch and we will tell you straight where you stand.

Microsoft Entra ID is Microsoft’s cloud identity and access management service — the system that decides who can sign in to your Microsoft 365 tenant and what they can reach once they do. It is the new name for Azure Active Directory, renamed in 2023. The technology underneath did not change; the label did.

If you run a business on Microsoft 365, you already use Entra ID every day, whether you know the name or not. Every login to Outlook, Teams, SharePoint and OneDrive is authenticated by it. It is also, increasingly, the single most important security control you own. This post explains what it actually is, what the licensing tiers unlock, and why identity has quietly become the perimeter you most need to defend.

The rename: Azure AD became Microsoft Entra ID in 2023

In July 2023, Microsoft renamed Azure Active Directory to Microsoft Entra ID. The product, the APIs, the sign-in URLs, the licences — all of it kept working. Service plan names like “Azure Active Directory Premium P1” were rebadged as “Microsoft Entra ID P1”, but your existing subscriptions carried across without action. Microsoft folded the identity product into a broader family called Microsoft Entra, which also covers Entra Permissions Management, Entra Verified ID and Entra Internet Access.

One point of confusion worth clearing up: Entra ID is not the same thing as the on-premises Active Directory you might run on a Windows Server domain controller. On-prem AD (the one with domains, organisational units and Group Policy) still exists and still carries the Active Directory name. Entra ID is the cloud directory behind Microsoft 365. Many businesses run both and synchronise between them using Entra Connect. So when someone says “we got rid of AD”, ask which one they mean — they almost certainly still have Entra ID.

What Microsoft Entra ID actually is

At its core, Entra ID is a directory and an authentication engine. It holds the identities for your organisation and brokers access to applications. Strip away the marketing and there are a few building blocks worth understanding.

Users and groups

Every staff member has a user object — their account, their email, their licence assignments, their sign-in history. Groups bundle users together so you can assign licences, app access and policies in bulk rather than one person at a time. Security groups control access; Microsoft 365 groups also create a shared mailbox, calendar and SharePoint site. Getting your group structure right early saves a lot of pain later, because almost everything else hangs off it.

App registrations and single sign-on

Entra ID is also where third-party applications connect to your tenant. When you sign in to Xero, Canva or a line-of-business app using your Microsoft account, that app is registered against Entra ID and trusts it to verify who you are. This is single sign-on (SSO): one identity, one set of credentials, one place to enforce policy. SSO is not just convenient — it is a security win, because it means staff are not inventing weak passwords across a dozen separate logins, and you can cut access to everything by disabling one account when someone leaves.

Conditional Access and MFA

This is where Entra ID stops being plumbing and becomes a genuine security tool. Multi-factor authentication (MFA) requires a second proof of identity — typically an approval in the Microsoft Authenticator app — on top of the password. Conditional Access is the policy engine that decides when to demand it. You can require MFA for all users, block sign-ins from outside Australia, force a compliant device for admin accounts, or step up authentication when a login looks risky.

We have written a full walkthrough on Conditional Access policies in Microsoft 365, so we will not repeat it all here. The short version: Conditional Access is the difference between MFA being a blanket annoyance and being a targeted, risk-aware control. It is the single highest-value thing most Melbourne SMEs can turn on.

Security defaults versus Conditional Access

Microsoft offers two ways to enforce baseline identity security, and the distinction matters.

Security defaults are a free, all-or-nothing switch available to every tenant. Turn them on and Microsoft enforces MFA for all users, requires it for admins, and blocks legacy authentication protocols that bypass MFA entirely. For a very small business with no internal IT, security defaults are far better than nothing and should be enabled if you have nothing else.

The catch is that they are rigid. You cannot exclude a service account, you cannot vary policy by location or device, and you cannot tune the risk thresholds. The moment you need that flexibility — and most businesses do once they grow past a handful of staff — you move to Conditional Access, which requires Entra ID P1 or higher. You cannot run both at once: enabling Conditional Access means switching security defaults off.

Entra ID P1 and P2 licensing

Most of the security value lives behind paid licences. Entra ID comes in a free tier (bundled with any Microsoft 365 subscription), plus two paid plans: P1 and P2. P1 is included in Microsoft 365 Business Premium, which is the plan we steer most clients towards. P2 is included in the larger enterprise E5 suites or can be bought as an add-on.

What P1 unlocks

P1 is the workhorse tier. It gives you Conditional Access, self-service password reset that writes back to on-prem AD, group-based licence assignment, and the ability to enforce device compliance. For the overwhelming majority of Melbourne SMEs, P1 — via Business Premium — is the right baseline.

What P2 adds

P2 includes everything in P1 and layers on the more advanced controls:

• Identity Protection — machine-learning detection of risky sign-ins and compromised accounts, feeding risk signals into Conditional Access so you can automatically force a password reset or block a suspicious login.
• Privileged Identity Management (PIM) — just-in-time, time-limited access to admin roles. Instead of leaving five people as permanent Global Administrators, they request elevation when needed, it expires automatically, and every activation is logged and approvable.
• Access reviews — scheduled recertification so access does not quietly accumulate over years.

PIM alone is a strong reason for any business with multiple administrators to consider P2. Standing admin rights are one of the most common findings we see in security assessments.

Why identity is the new perimeter for SMEs

The old model of security assumed a hard outer wall — a firewall at the office, with everything inside it trusted. That model died when work moved to the cloud and to homes across the metro. Your data now lives in Microsoft 365, accessed from laptops, phones and home networks that your firewall never sees. The only thing standing between an attacker and your email, files and finance system is whether they can prove they are an authorised user. That proof is identity, and Entra ID is where it is enforced.

This is why attackers no longer bother breaking through walls — they log in. Credential theft, phishing and token replay are the dominant intrusion methods against Australian SMEs precisely because a valid login bypasses everything else. The Australian Cyber Security Centre (ACSC) puts multi-factor authentication front and centre in its guidance for exactly this reason.

A real-world shape of the problem: a manufacturing business in Dandenong we work with had MFA switched on for office staff but had quietly left it off for a shared accounts-payable mailbox, because “it was easier”. That mailbox was the one an attacker phished, and from it they sat reading invoice threads for a fortnight before attempting a payment redirection. Nothing was breached at the network layer. The gap was an identity exception nobody had reviewed. Conditional Access with no carve-outs, plus PIM on the admin accounts, would have closed it.

How Entra ID maps to the Essential Eight

The Essential Eight is the ACSC’s baseline of eight mitigation strategies, and two of them are pure identity controls that Entra ID delivers directly.

Multi-factor authentication is one of the eight outright. Entra ID with Conditional Access is the standard way Australian businesses meet it for Microsoft 365 and connected apps. Restrict administrative privileges is another, and this is where PIM earns its keep — just-in-time elevation and access reviews are precisely what the maturity levels ask for as you move up from Maturity Level One. Entra ID also contributes to the broader picture through sign-in logging and audit trails that support detection and response.

If Essential Eight alignment is on your radar — and for any business touching government contracts or cyber insurance it should be — Entra ID configuration is a large part of the work. Our Essential Eight compliance service treats identity hardening as the first thing to fix, because it is the cheapest, fastest control with the largest blast-radius reduction.

Getting it right

Entra ID ships with sane-ish defaults, but “switched on” and “configured properly” are different things. The common failures we see across Melbourne tenants are predictable: MFA with too many exclusions, legacy authentication still enabled, no Conditional Access despite paying for P1, Global Administrator handed out like sweets, and break-glass accounts that either do not exist or are not protected. Each of these is a quiet open door.

TechAssist is a Melbourne-based MSP, founded in 2014, with thirteen Australian-employed engineers and a 24/7 NOC in Tecoma. We run Microsoft 365 and Entra ID hardening as standard onboarding for managed clients, because identity is the control that prevents the largest category of incidents we are called to clean up. Per-user fixed monthly pricing means this work is in scope, not a surprise invoice.

Frequently asked questions

Is Microsoft Entra ID free?

There is a free tier bundled with every Microsoft 365 subscription, which covers basic users, groups and SSO. The security controls most businesses need — Conditional Access (P1), and Identity Protection and PIM (P2) — require paid licences. P1 is included in Microsoft 365 Business Premium, which is what we recommend for most SMEs.

Do I still need on-premises Active Directory?

It depends. Many businesses have moved entirely to the cloud and run Entra ID alone. Others keep on-prem AD for legacy applications or file servers and synchronise it to Entra ID with Entra Connect. There is no requirement to keep on-prem AD if nothing depends on it, and removing it can simplify management considerably.

What happened to my Azure AD settings after the rename?

Nothing broke. The rename in 2023 was cosmetic at the product level — your policies, users, app registrations and licences all carried across. The portal now refers to Microsoft Entra ID and some menus moved, but no reconfiguration was required.

Should I use security defaults or Conditional Access?

If you have no internal IT and no Entra ID P1 licences, enable security defaults today — it is far better than nothing. Once you have P1 (via Business Premium) and need to handle service accounts, location rules or device compliance, move to Conditional Access. You cannot run both simultaneously.

Talk to us about identity

Identity is the control most worth getting right and the one most commonly left half-configured. If you are not sure what your tenant is actually enforcing, our Microsoft 365 and cybersecurity teams can audit your Entra ID setup, close the gaps and align it to the Essential Eight. Get in touch and we will tell you plainly where you stand.

A SharePoint intranet is a set of SharePoint Online sites — built on the licence you already pay for in Microsoft 365 — that gives staff one place for news, policies, documents and people. Build it around how people actually work and they use it daily. Build it as a digital filing cabinet and it dies.

Most Melbourne businesses already own SharePoint and don’t realise it. If you have Microsoft 365 Business Standard or Business Premium, the intranet platform is sitting there, unused, while staff email each other PDFs and hunt through a network drive nobody has tidied since 2019. The technology is rarely the problem. The decisions you make before you build it are.

What a modern SharePoint Online intranet actually is

Forget the old picture of a clunky 2010-era SharePoint server. The modern version runs entirely in the cloud, looks like a clean website, works on a phone, and is made of three building blocks: communication sites, team sites and hub sites. You assemble those into an intranet rather than installing a single “intranet product”.

The point of the thing is to answer the questions staff ask all day: where’s the current leave policy, who do I call in accounts, what’s the new client onboarding process, has anything changed this week. When those answers live in one searchable place that people trust, you stop losing hours to “do you know where the…” messages.

Communication sites versus team sites

This is the first decision that trips people up, so get it straight early. The two site types do different jobs.

In plain terms: your intranet’s front door and its polished, company-wide pages are communication sites. The messy day-to-day work — drafts, working documents, a project’s files — happens in team sites, which are the same thing that gets created every time someone makes a new team in Microsoft Teams. Most organisations need a handful of communication sites and a growing number of team sites.

Hub sites tie it together

On their own, a dozen separate sites are just a dozen separate sites. A hub site is what makes them feel like one intranet. You designate a site as a hub, then associate other sites with it, and they inherit shared navigation, a consistent look, and rolled-up news and search across everything connected.

A practical structure for a mid-sized business: one hub as the company intranet home, with the HR, IT, Operations and Sales sites associated to it. Staff get one top navigation bar across the lot, news from any connected site surfaces on the home page, and search spans the whole hub. You can re-associate sites later, so the structure isn’t a one-way door — but planning it up front saves a painful reorganisation six months in.

The pieces staff care about

An intranet earns its keep through a few core features. None of them are exotic; the difference is whether they’re set up deliberately or thrown together.

• News — SharePoint News posts are how you communicate. A short post about a policy change or a new starter beats an all-staff email nobody reads, and it stays findable afterwards.
• Document libraries — where files live, with version history, check-out, and metadata so you can filter and sort rather than scroll. This is what replaces the network drive.
• Policies — a single authoritative home for the employee handbook, the leave policy, the WHS documents. One current version, not eleven copies in eleven inboxes.
• Staff directory — pulled from your Microsoft 365 user accounts, so people can find who does what and how to reach them.

Integration with Teams and Viva Connections

This is where SharePoint stops being a website you have to remember to visit. Every Microsoft Teams team is already backed by a SharePoint team site — the Files tab in any channel is a SharePoint document library. So your collaboration sites are reachable without leaving Teams, where most staff already spend their day.

Viva Connections takes it further: it surfaces your intranet home page, news and resources directly inside Teams as an app, on desktop and mobile. For frontline and on-the-go staff who never open a browser, that’s often the difference between an intranet they see and one they forget exists. If you’re already invested in the Microsoft stack, our Microsoft 365 support covers wiring these pieces together so the intranet meets staff where they work rather than asking them to come to it. For a fuller picture of what the platform includes, our rundown of what Microsoft 365 support covers is a useful companion read.

The decisions that make or break adoption

Information architecture is the unglamorous part everyone skips, and it’s the part that decides whether the intranet works. Information architecture means how you structure and name things so people find them without thinking.

The mistakes are predictable. Folder structures fifteen levels deep that mirror the old network drive. Navigation built around your org chart instead of around tasks — staff don’t think “I need the People & Culture division’s content”, they think “where’s the leave form”. Twenty different document libraries with no naming convention. Search left to fend for itself with no metadata to work with.

Get the architecture right and the platform does the rest. The questions worth arguing about before you build anything are: what are the ten things staff look for most, what should the top navigation be, what’s a hub and what’s associated to it, and how do you name and tag documents consistently. An hour of disagreement in a planning meeting saves a rebuild later.

Permissions and governance

The fastest way to ruin a SharePoint intranet is to let permissions sprawl. Out of the box it’s easy to share a file or site with one person, then another, until nobody can tell who can see what — and a staff directory or HR site with leaky permissions is a privacy problem, not just a tidiness one.

The disciplined approach is to manage access through Microsoft 365 Groups and security groups rather than one-off shares, keep company-wide content readable by everyone and editable by few, and set a clear policy on who can create new sites. Left unchecked, “anyone can spin up a team” produces hundreds of orphaned sites within a year. Governance also means deciding retention, external sharing rules, and a content owner for each site so pages don’t go stale. Conditional access policies sit underneath all of this, controlling who can reach the intranet, from which devices, and under what conditions — important when the same platform holds your policies and your client files. This kind of structure is part of broader cybersecurity hygiene, not an optional extra.

Migrating off file servers and network drives

Most intranet projects are also a migration off an ageing file server or a mapped network drive, and that’s where the real effort lives. You don’t just copy files across — you decide what comes, what gets archived, and how it’s structured on the other side.

A law firm in Hawthorn we work with had a 600GB shared drive built up over a decade, with matter folders, duplicates, and files three people swore were the master copy. The temptation is to lift-and-shift the whole thing into SharePoint and call it done. That just moves the mess to a new address. We sorted what was still live, archived closed matters, agreed a folder and metadata structure that matched how the firm actually worked, then migrated in stages so nobody lost access mid-week. The migration tooling matters — SharePoint has document size and path-length limits the old drive didn’t — and so does timing it around the firm’s quieter periods.

If your file server is also your backup and disaster-recovery weak point, moving to SharePoint changes that equation too — though “it’s in the cloud” still isn’t a backup strategy, which is why our backup and recovery approach covers Microsoft 365 data as well.

Why “build it and they won’t come” happens

The most common SharePoint outcome in Australian SMEs is an intranet that was built with enthusiasm, launched with an email, and abandoned within two months. It happens for clear reasons: nobody owned the content so it went stale, the structure mirrored the org chart instead of staff tasks, the launch was a one-off announcement with no follow-through, and leadership didn’t use it themselves.

Driving adoption is mostly non-technical. Put the things people need daily — the leave form, the phone list, this week’s news — on the front page so there’s a reason to visit. Move a real workflow onto it, like leave requests or IT support requests, so people have to use it. Surface it in Teams via Viva Connections so they don’t have to remember a URL. Name content owners who keep their corner current. And get the leadership team posting news, because staff follow what management actually uses. An intranet that’s the easiest path to the answer wins; one that’s a chore loses.

Realistic effort

Setting up a basic intranet — a home site, a few hub-connected sites, news and document libraries — is days, not months, for someone who knows the platform. The work that takes time is the thinking: the information architecture, the permissions model, the migration off the old drive, and the change management to get people using it. A sensible mid-sized rollout runs over several weeks, with a planning phase, a build, a staged migration, and a launch backed by training rather than an email. Trying to compress all of that into a weekend is exactly how you end up with the abandoned version.

Frequently asked questions

Do we need extra licences to build a SharePoint intranet?

Usually no. SharePoint Online is included in Microsoft 365 Business Standard, Business Premium and most enterprise plans, and Viva Connections is included as well. If you already run Microsoft 365 for email and Teams, you almost certainly have everything you need to build the intranet on your existing licences.

What’s the difference between SharePoint and Teams?

They’re two views of the same data. Teams is where you chat and meet; SharePoint stores the files and pages behind it. Every Teams team has a SharePoint site underneath, and the Files tab in a channel is a SharePoint document library. An intranet adds the company-wide communication sites and hubs on top.

How do we stop the intranet becoming a mess of duplicate files?

Agree a structure and naming convention before you migrate, use metadata and search rather than deep folders, manage permissions through groups, and control who can create new sites. The discipline is in governance and information architecture, not in the platform itself.

Can staff access the intranet on their phones?

Yes. SharePoint sites are mobile-responsive, and Viva Connections puts your intranet home page, news and resources inside the Teams mobile app — which is how frontline and on-the-go staff actually reach it, since most never open a browser at work.

Getting it built properly

A SharePoint intranet is one of the best-value things you can do with Microsoft 365, because the licence is already paid for and the payoff — less time hunting for documents, one source of truth for policies, cleaner communication — compounds. The risk is doing it without the architecture, permissions and adoption work, and ending up with abandoned space. TechAssist is a Melbourne-based MSP, founded in 2014, with 13 Australian-employed engineers — no offshore helpdesk — and per-user fixed pricing, so a project like this is scoped properly rather than billed by the hour. If you’d like to turn the SharePoint you already own into something staff actually use, explore our cloud services or get in touch for a straight conversation about it.

Microsoft Planner is the shared task tool for small teams: visual boards, buckets and assignments that live inside Teams. Microsoft To Do is for your personal list. Project is for proper project management with dependencies and Gantt charts. Most small teams need the first two and rarely the third.

If your team has outgrown email-and-spreadsheets but isn’t running multi-month projects with critical paths, Microsoft Planner and To Do are almost certainly already in your Microsoft 365 licence — you just aren’t using them properly. Here’s what each tool is for, how the 2024-2025 unification changed things, and how to roll it out without creating a sprawling mess.

Planner vs To Do vs Project: what each is actually for

These three tools overlap enough to confuse people, but they solve different problems. The simplest framing is scope: To Do is one person, Planner is one team, Project is one complex programme of work.

The practical test: if a job has a deadline and an owner but no real dependency chain, it belongs in Planner. If you genuinely need “task B can’t start until task A finishes, and that shifts the whole timeline”, that’s where Project earns its licence. Most Melbourne SMEs we work with never cross that line.

The 2024-2025 unification: one Planner app in Teams

Microsoft spent 2024 and into 2025 folding three separate experiences into one. The old “Tasks by Planner and To Do” app in Teams, the classic Planner web app, and the Project web experience have been consolidated into a single product called Planner, surfaced inside Microsoft Teams and on the web.

In practice, the new Planner app brings your personal To Do tasks, your shared team plans, and — if you hold a Project licence — your Project for the web plans into one place, so you stop hopping between apps. The basic features (buckets, boards, assignments, due dates) stay free with your normal Microsoft 365 licence; the Premium layer — goals, sprints, dependencies, timeline and Copilot — only lights up with a Project/Planner Plan licence. To Do still exists standalone, but its tasks now also appear in the My Tasks view inside the new Planner.

How Planner is structured: boards, buckets, assignments and charts

Planner uses a Kanban-style board, which is why teams pick it up quickly. The building blocks are worth understanding first, because the structure you choose on day one is the one you live with.

Plans and buckets

A plan is the container for a piece of shared work — usually tied to a team or a recurring function. Inside a plan, buckets are columns you define however you like: by stage (To Do / Doing / Done), by client, by team member, or by work type. A logistics operator might bucket by “Awaiting pickup”, “In transit” and “Delivered”. Pick one logic per plan and keep to it.

Tasks, assignments and labels

Each card is a task with an assignee (or several), a due date, a priority, a checklist of sub-steps, attachments, and coloured labels for filtering. The discipline that separates a useful board from an abandoned one is simple: every task has an owner and a due date. Unassigned, undated cards are where boards go to die.

Board, Grid, Schedule and Charts views

The same tasks can be viewed several ways without re-entering anything. Board is the Kanban columns; Grid is a spreadsheet-style list for fast editing; Schedule drops tasks onto a calendar by due date. Charts gives a status dashboard — how many tasks are not started, in progress, late or complete, split across people and buckets. For a team lead it answers “are we on top of this?” in three seconds, and it’s the most underused feature here.

Using Planner inside Teams channels

Planner is at its best when it lives where the work conversation already happens. Add a Planner tab to any Teams channel and the team discusses the work in the Posts tab and tracks it on the Planner tab beside it — no separate tool and no “where did we agree that was due?”.

Create the plan from inside the channel so it’s owned by that team’s Microsoft 365 Group — membership and permissions then follow the team automatically, so people who join get the board and people who leave lose it. Use one plan per channel rather than one giant plan for everything. Assignments notify people in their Teams activity feed and roll up into their My Tasks view, so nobody has to remember to “check the board”.

This is also why Planner suits teams already standardised on Microsoft 365. Our Microsoft 365 services page covers what’s included, and our post on what Microsoft 365 support in Melbourne actually covers goes deeper.

To Do, flagged emails and how tasks roll up

To Do is the personal counterpart — where an individual manages their own day with a “My Day” list, custom lists, reminders and recurring tasks. Two integrations make it more than a notepad. First, flagged emails: flag an email in Outlook and it appears automatically as a task in To Do’s “Flagged email” list, linked back to the message, turning the inbox-as-task-list habit into something you can plan around. Second, assigned tasks roll up: any Planner task assigned to you appears in To Do (and the My Tasks view) under “Assigned to me”.

So an individual sees their reminders, flagged emails and their share of the team’s boards in one consolidated list — the quiet benefit of staying inside the Microsoft stack.

When a small team has outgrown email and spreadsheets

The signal that you’ve outgrown email-and-spreadsheets is usually one of these: work falls through the cracks because it only lived in someone’s inbox; the shared spreadsheet has six versions and no one trusts it; or “who’s doing what by when” takes a meeting to answer. That’s Planner’s sweet spot — structured enough to give visibility, light enough that people will actually use it.

It’s equally important to know when you haven’t crossed into Project territory. You don’t need Project just because the work matters — you need it when timelines genuinely cascade or a client wants a formal Gantt chart. Short of that, Planner plus disciplined ownership does the job.

A Ringwood example

A construction fit-out business in Ringwood we work with was running its job pipeline across a shared Excel file on a network drive and a tangle of email threads. Site supervisors couldn’t see updates from the office, the spreadsheet was routinely locked because someone had it open, and a couple of jobs slipped because a task lived only in one estimator’s inbox. They needed a single source of truth their team would actually open.

We set them up with one Planner board per active project, surfaced as a tab in each job’s Teams channel, with buckets for site stages and every task assigned to a named person with a date. The Charts view became the Monday status check. Supervisors get their tasks in the Teams app on their phones and the office sees the same board live — all already in their Microsoft 365 plan, so no new licence cost.

Governance: don’t let plans sprawl

The failure mode with Planner isn’t the tool — it’s letting it breed. Because anyone can spin up a plan (and creating one quietly creates a Microsoft 365 Group behind it), you can end up with forty half-used boards, three plans called “Projects”, and no idea which is current — worse than the spreadsheet you replaced.

A few governance rules keep it sane:

• One plan per team or function, not per whim. Tie plans to existing Teams channels so they inherit a clear owner and membership.
• Name plans consistently and archive dead ones. A retired plan left lying around is clutter and a data-hygiene issue.
• Control who can create Microsoft 365 Groups. Because each new plan spawns a Group, ungoverned plan creation inflates your Group count and your security surface. Most SMEs should restrict Group creation and govern it centrally.

We bake Planner and Microsoft 365 Group governance into our managed IT services so the collaboration tools stay useful rather than turning into digital landfill.

Frequently asked questions

Is Microsoft Planner free with Microsoft 365?

The core Planner features — boards, buckets, task assignments, due dates, labels and the Charts view — are included with Microsoft 365 Business and Enterprise plans at no extra cost. The Premium layer (goals, sprints, dependencies, timeline and Copilot) requires a separate Project Plan licence that most small teams never need.

What’s the difference between Planner and To Do?

To Do is for one person — your private list, flagged emails and reminders. Planner is for a team — shared boards several people work from, with tasks assigned to named owners. They connect: any Planner task assigned to you appears in your To Do “Assigned to me” list, so you get one personal view of everything on your plate.

Do I still need Microsoft Project?

Only if your work has real task dependencies — where finishing one task is meant to shift the timeline of others — or you need formal Gantt charts and resource levelling. For tracking shared work with owners and due dates, Planner is enough and is already in your licence. Don’t pay for Project to manage a to-do list.

Getting it set up properly

Planner and To Do are quietly capable tools most Melbourne businesses already pay for and barely touch. The value isn’t in the software — it’s in setting it up with sensible structure, keeping tasks owned and dated, and governing plan creation so it doesn’t sprawl. TechAssist is a Melbourne-based MSP, founded in 2014, with 13 Australian-employed engineers and a 24/7 NOC in Tecoma, and we help teams across Melbourne metro get real value out of the Microsoft 365 they already own on per-user fixed monthly pricing. If your team has outgrown the shared spreadsheet, get in touch and we’ll set the boards up to fit how you work.

Microsoft Bookings is the online scheduling app built into most business Microsoft 365 plans. It gives you a public booking page where customers pick a service, choose a time, and book themselves in — with reminders, Teams meeting links and two-way calendar sync handled automatically. If you already pay for Microsoft 365, you almost certainly already own it.

Plenty of Melbourne SMEs pay a separate monthly subscription to Calendly or Acuity while a perfectly capable scheduling tool sits unused inside their existing Microsoft 365 licence. This post explains what Bookings does, which plans include it, how to set it up sensibly, how it stacks up against the standalone tools, and where the privacy and admin pitfalls are.

What Microsoft Bookings actually is

Bookings is a self-service appointment scheduling app. You define your services and your staff, publish a booking page, and customers book themselves into available slots without a single email back-and-forth. Behind the scenes it writes the appointment into the relevant staff calendar in Outlook, sends confirmation and reminder emails to the customer, and — if you want — spins up a Microsoft Teams meeting link for virtual appointments.

It lives at bookings.microsoft.com and inside the Microsoft 365 app launcher. There is also a Bookings mobile app for managing appointments on the move. The whole thing runs on the same identity, calendar and mail infrastructure you already use, which is the main reason it is worth a look before you sign up for anything else.

Which Microsoft 365 plans include it

Bookings is included in the common business and enterprise subscriptions, not the cheapest tiers. As a rule of thumb:

• Included: Microsoft 365 Business Standard, Business Premium, and the Office 365 / Microsoft 365 E3 and E5 enterprise plans.
• Not included: Microsoft 365 Business Basic does not include the Bookings app, and Microsoft 365 Apps for business (the apps-only plan with no hosted services) does not either.

Licensing details shift over time, so confirm against your own tenant rather than taking a blog’s word for it. An admin can check whether Bookings is switched on, and which users can create booking pages, in the Microsoft 365 admin centre. If you want a hand auditing what your current licences actually entitle you to, that is bread-and-butter work for our Microsoft 365 support team.

How a booking page is built

A booking page — Microsoft calls it a “booking calendar” or “booking mailbox” — is the customer-facing front end. You can run more than one, which matters if different parts of the business need separate pages. Each one is assembled from a few building blocks.

Services

A service is whatever a customer can book: a 30-minute consultation, a 60-minute strategy session, a product demo, a support call. For each service you set the duration, the price (or leave it blank), a description, and which staff can deliver it. You can add buffer times before and after — say ten minutes after every appointment to write notes or reset a room — and Bookings blocks that time out automatically so back-to-back bookings do not run you into the ground.

Staff

Staff are the people who deliver services. You add them, set their role, and — this is the important part — connect their Outlook calendar so Bookings can see when they are genuinely free. Staff do not all need a Bookings licence themselves; they can be added as guests, though licensed staff get the full calendar-sync behaviour. Each staff member can have their own working hours, so a part-timer who only works Tuesdays and Thursdays will never be offered for a Wednesday slot.

Business hours and availability

You set business hours at the page level and can override them per service or per staff member. This is where Bookings earns its keep: it cross-references your published hours, each staff member’s working hours, their existing Outlook calendar, and the buffer times, then only offers slots that survive all four filters. A customer can never book you into a slot you are already busy in, because the calendar sync is live.

Customer self-service, reminders and confirmations

From the customer’s side the experience is simple. They open your booking page link, choose a service, see real availability, pick a slot, enter their details, and confirm. They immediately receive a confirmation email with the appointment details and, for virtual appointments, the meeting join link. Bookings then sends automated reminder emails ahead of the appointment — you control how far in advance — which is the single biggest lever on reducing no-shows. Customers can reschedule or cancel through links in those emails without phoning you, which keeps your inbox clear.

Teams meeting integration for virtual appointments

If a service is flagged as an online meeting, Bookings automatically generates a Microsoft Teams meeting link and includes it in the confirmation and reminder emails for both the customer and the staff member. Nobody has to create a meeting, copy a link, or chase it up. For a Melbourne business running consultations or demos with clients across the metro area — or interstate — this removes the most tedious step in scheduling a virtual meeting. The customer joins through the link in their browser or the Teams app; they do not need a Microsoft 365 account of their own.

Calendar sync that actually works

The calendar sync is two-way and this is the feature that separates Bookings from a bolt-on tool. When a customer books, the appointment lands in the staff member’s Outlook calendar. When a staff member blocks out time in Outlook — a dentist appointment, a site visit, annual leave — Bookings sees it and stops offering that slot. There is no manual blocking, no double data entry, and no risk of someone booking a slot you quietly filled an hour ago. Because it is all the same Microsoft 365 calendar, it works across Outlook on the desktop, the web and the phone without any extra configuration.

Use cases for Melbourne SMEs

Bookings suits any business where customers or staff need to lock in a time. The patterns we see most across Melbourne metro clients:

• Professional services consultations — accountants, financial advisers and law firms offering an initial 30-minute call without the email tennis.
• Product demos and sales calls — a software or equipment supplier letting prospects self-book a demo straight off the website.
• Support sessions — booking a customer into a troubleshooting or onboarding slot with the right specialist.
• Recruitment interviews — sending a shortlist of candidates a link and letting them pick an interview slot that suits, with a Teams link auto-attached.

A Hawthorn accounting practice we work with switched their “book a tax appointment” flow over to Bookings during the run-up to end of financial year. Clients self-book consultations against each accountant’s real availability, get an SMS-style reminder by email two days out, and a Teams link if they would rather not drive into the office. The practice manager stopped spending the first hour of every morning playing calendar Tetris, and the no-show rate dropped because the reminders do the chasing.

How it compares to Calendly and Acuity

Calendly and Acuity Scheduling are polished, popular standalone scheduling tools. They are genuinely good products with slicker public pages and deeper integrations into third-party CRMs and payment processors. The honest comparison comes down to what you already pay for and how much scheduling sophistication you actually need.

The cost angle is the one most Melbourne SMEs overlook. If you are running Business Standard or Business Premium across your team, Bookings is already paid for. Paying a second per-seat subscription for scheduling, when the tool you own does the job, is money leaking out the side of the IT budget. We see this constantly when we review a new client’s software spend — the standalone scheduler is often the easiest line to cut. Where Calendly or Acuity earn their fee is deep CRM and payment integration, or a sales team that lives and dies by routing logic. If your needs are “let customers book a time and put it in Outlook with a Teams link,” Bookings covers it.

Privacy of customer data

Because Bookings runs inside your Microsoft 365 tenant, the personal information customers enter — name, email, phone, the reason for the appointment — is stored in your environment under the same data protection, retention and access controls as the rest of your Microsoft 365 data, rather than handed to a separate third-party platform. For an Australian business, that is a meaningful point in its favour. Under the Privacy Act 1988 and the Australian Privacy Principles you are responsible for personal information you collect, and keeping booking data inside a tenant you already govern is simpler to reason about than spreading it across an extra vendor.

That said, a public booking page is exactly that — public. Be deliberate about which fields you make mandatory, do not ask for more than the appointment needs, and decide who in the business can see booking details. If you handle sensitive information, fold the booking page into your broader access and retention thinking. This is the kind of detail our cybersecurity services team looks at when hardening a Microsoft 365 environment.

Admin and setup tips

A few things worth getting right before you publish a page to the world:

• Decide who can create booking pages. An admin can restrict Bookings creation to specific users in the Microsoft 365 admin centre, so you do not end up with a dozen unmanaged public pages.
• Connect every staff member’s calendar. The whole value proposition depends on live availability. A staff member whose calendar is not connected will be offered for slots they are not actually free in.
• Set realistic buffer times and minimum lead time. Stop customers booking a slot for ten minutes from now, and give yourself breathing room between appointments.
• Use a custom domain on the page where possible so the booking link reflects your brand rather than a generic Microsoft URL.
• Test the full customer journey yourself — book a slot, check the confirmation, the reminder timing and the Teams link — before you put the link on your website.

None of this is hard, but it benefits from being set up once, properly, by someone who understands how it interacts with the rest of your tenant. Getting the licensing, the permissions and the calendar connections right is exactly the sort of thing we handle for clients as part of managed IT services, alongside the rest of their Microsoft 365 environment.

Frequently asked questions

Is Microsoft Bookings free?

It is not a separate paid product — it is included in Microsoft 365 Business Standard, Business Premium, and the E3 and E5 enterprise plans at no extra cost. It is not included in Business Basic or the apps-only plans. So it is “free” in the sense that if you have the right plan, you already own it.

Does Bookings work with Microsoft Teams?

Yes. If you mark a service as an online meeting, Bookings automatically creates a Microsoft Teams meeting link and includes it in the confirmation and reminder emails for both the customer and staff. Customers can join through a browser without needing their own Microsoft 365 account.

Where is customer booking data stored?

Inside your own Microsoft 365 tenant, under the same controls as your other Microsoft 365 data. That keeps the personal information customers enter within an environment you already govern, rather than in a separate third-party scheduling platform — which is simpler to manage against your Privacy Act obligations.

Can multiple staff share one booking page?

Yes. You add multiple staff to a booking page, assign them to the relevant services, and connect each person’s Outlook calendar. Bookings then offers customers whichever staff are genuinely available for the service and time they choose, and you can run several separate booking pages if different teams need their own.

Where TechAssist fits

We are a Melbourne MSP, founded in 2014, with thirteen Australian-employed engineers — not an offshore queue. Helping clients get full value out of the Microsoft 365 licences they already pay for is a routine part of what we do, and Bookings is a textbook example: a capable tool sitting unused while a separate subscription does the same job. If you want someone to set Bookings up properly, audit your Microsoft 365 spend for duplication, or sort out the permissions and calendar plumbing behind it, get in touch and we will take a look.

Microsoft Forms is the lightweight survey, quiz and data-capture tool included with virtually every Microsoft 365 Business plan. If you pay for Business Basic, Standard or Premium, you already have it — no extra licence. For most Melbourne SMEs it handles client intake, staff feedback and event RSVPs without touching SurveyMonkey or Typeform.

It is not a heavyweight platform, and it is not trying to be. The value is that it is already in your tenant, lands responses straight into Excel, and keeps data inside your Microsoft 365 environment rather than scattered across a free third-party account nobody owns.

What Microsoft Forms is, and what you already pay for

Forms is a browser-based tool for building online forms, surveys and quizzes. You build it at forms.office.com or in the Forms app, share a link, and responses flow back in real time. It works on any device with a browser, and respondents do not need a Microsoft account to fill in a public form.

Beyond the Business plans, it is bundled into the Microsoft 365 Enterprise (E) plans and most education and non-profit plans. If you are unsure what your subscription includes, our breakdown of what is included with Microsoft 365 support in Melbourne lays it out. The practical point: you are almost certainly already paying for Forms and not using it.

Form versus quiz: pick the right type

When you create something new, Forms asks whether you want a form or a quiz, and the difference matters.

• Form — for collecting information where there are no right or wrong answers: client intake, feedback surveys, RSVPs, incident reports, booking requests. This is what most businesses need.
• Quiz — for assessment. You set correct answers and point values, and Forms marks responses automatically and shows scores. Useful for staff training checks, onboarding tests, or compliance refreshers where you need to prove someone passed.

You cannot cleanly convert one to the other afterwards, so choose deliberately. If in doubt, a form is the safer default.

Question types and branching logic

Forms gives you a sensible spread of question types: choice (single or multiple), text (short or long), rating, date, ranking, Likert scales, file upload, and Net Promoter Score. Each question can be marked required, and text questions can enforce validation such as number ranges or email format.

Branching logic

The feature that lifts Forms above a flat questionnaire is branching. You can route a respondent to different questions based on their answers — answer “yes” to “Have you used our service before?” and they skip the new-client section entirely. To set it up, build all your questions first, then open the question menu, choose Add branching, and map each answer to the question it should jump to. Branching keeps forms short and relevant, the single biggest driver of completion rates.

A short how-to: building a client intake form

The end-to-end for a typical intake form:

1. Go to forms.office.com, sign in, and select New Form.
2. Give it a clear title and short description — respondents see both.
3. Add your questions. Use Choice for fixed options, Text for free responses, and mark essentials as Required.
4. Add branching where questions only apply to certain answers.
5. Click Settings (the three dots) to control who can respond, whether responses are anonymous, and whether to send a receipt.
6. Hit Preview to test it on desktop and mobile, then Collect responses, choose your sharing method, and copy the link.
7. Watch responses arrive under the Responses tab, and click Open in Excel to export.

The whole thing takes ten minutes once you know the layout.

Sharing: internal, external and the tenant setting that controls it

This is where businesses get caught out. How you share a form decides who can fill it in, and whether their data is captured securely.

The critical detail: the “Anyone can respond” option is controlled at the tenant level by your administrators. In the Microsoft 365 admin centre, under the Forms settings, there is a toggle for external sharing. If it is switched off — and in security-conscious tenants it often is — staff will not see the “Anyone” option at all, and every form is locked to internal-only.

That is a sensible default, but it bites when someone genuinely needs to collect responses from clients or the public and cannot work out why the option has vanished. Enabling external collection is a deliberate decision, weighing convenience against the fact that an open link can be forwarded to anyone. We treat it as part of broader tenant hardening, alongside our work on conditional access policies for Microsoft 365.

Collecting responses into Excel

Every form has a Responses tab with a live summary — charts for choice questions, individual responses, aggregate counts. For real analysis, click Open in Excel.

For forms created inside a SharePoint or Teams group — which is how business forms should be set up — you get a live workbook in the group’s SharePoint library that updates as responses arrive. The data lives in a shared, owned location rather than tied to one person’s profile, so it survives that person leaving. Getting Forms created in the right place is a small governance decision we set up as part of a managed Microsoft 365 environment.

Real SME use cases

A few patterns we see work well:

• Client intake — a new-client form capturing contact details, requirements and consent before the first meeting, replacing the email chase.
• Staff feedback — anonymous internal pulse surveys where honesty depends on people trusting it is genuinely anonymous (set “Record name” to off and tell them).
• Event RSVPs — a public link for a client function or open day, with branching for dietary needs and plus-ones.
• Incident reporting — an internal form for staff to log near-misses, IT issues or workplace incidents into a tracked Excel list someone reviews.

A professional services firm in Hawthorn we work with replaced a tangle of Word-document intake sheets with a single branching Forms intake. New enquiries now land structured and complete in a SharePoint-backed spreadsheet their reception team works from each morning — no retyping, no chasing missing fields, no cost beyond licences they already held.

Data residency and privacy

Because Forms is part of Microsoft 365, response data sits within your tenant’s cloud storage, governed by the same agreements as the rest of your environment. Commercial tenants provisioned for Australia store core customer data in Australian data centres, which matters where clients or regulators have data residency expectations.

That said, a tool being inside Microsoft 365 does not make your collection compliant by itself. If you are gathering personal information, the Privacy Act and the Australian Privacy Principles still apply — you need a lawful reason to collect it, you should tell people what you are collecting and why, and you must store and dispose of it responsibly. For health information the OAIC’s expectations are stricter again. Keep forms to the minimum data you need.

Limits, and when to step up

Forms is deliberately simple, and you will hit its ceiling if you push it. Worth knowing the edges:

• It is built for straightforward surveys and capture, not multi-stage workflows, approvals, or apps with stored logic and dashboards.
• Styling and branding are limited — you get themes, not full design control.
• No built-in payment collection, no complex conditional calculations, no relational data model.
• Response and question counts are generous for SME use but capped; very high-volume surveys can hit limits.

When you outgrow it, the upgrade path is clear. Microsoft Dynamics 365 Customer Voice (the successor to the old “Forms Pro”) adds richer survey distribution, follow-up automation and CRM integration. Power Apps is the answer when you need a genuine application — stored data, business logic, role-based access, dashboards — rather than a flat survey, often paired with Power Automate to trigger workflows off submissions. Both are bigger commitments, so use Forms until it genuinely stops fitting.

Frequently asked questions

Is Microsoft Forms free?

It is included at no extra cost with Microsoft 365 Business Basic, Standard and Premium, the Enterprise plans, and most education and non-profit plans. There is a limited version tied to free personal accounts, but business use should run through your paid tenant so data stays governed and owned.

Can people outside my organisation fill in a form?

Yes, if you share it with the “Anyone can respond” option — but that option is controlled at the tenant level by your administrators. If external sharing is switched off in your admin settings, staff can only share forms internally. Enabling external responses is a deliberate administrative decision.

Are responses to a Microsoft Form really anonymous?

Only if you set them up that way. Internal forms can record the respondent’s name unless you turn that off. Public forms are anonymous by default unless you add a question asking for identifying details. If you promise staff anonymity on a feedback survey, confirm the “Record name” setting is off first.

When should we move off Forms?

When you need workflows, approvals, stored business logic, payments or a proper application rather than a survey. At that point Dynamics 365 Customer Voice or Power Apps with Power Automate is the right step up — both bigger commitments worth scoping properly.

Getting it set up right

Forms is one of the most under-used tools in a typical Microsoft 365 subscription. The setup that matters is the bit most businesses skip: forms created in shared SharePoint-backed locations so data is owned not orphaned, the external-sharing and anonymity settings configured correctly, and collection kept within your privacy obligations. We are a Melbourne-based MSP with 13 Australian-employed engineers, and getting clients full value from the Microsoft 365 they already pay for is core to what we do. If you want your tenant configured so tools like Forms are safe and useful out of the box, get in touch and we will sort it.