Managing Macs With Intune: What Works and What Does Not

Intune can manage a Mac fleet properly. What it cannot do is keep your third-party Mac applications patched, and that single gap is usually what decides whether you need a second tool. Everything else in the Intune macOS story is better than its reputation suggests.

This is written for the business that already pays for Intune inside a Microsoft 365 subscription and would rather not buy and run a second management platform. That instinct is right more often than Apple-first consultants will admit.

The verdict, before the detail

If your Mac fleet is small, your application set is short and predictable, and nobody is auditing you against a control framework, Intune alone is enough. Buying a dedicated Apple MDM alongside it adds cost, a second console, a second set of enrolment records and a second thing to break.

Disclosure, because it is relevant to that verdict: we are a Jamf partner and a Microsoft partner, so we hold a commercial relationship on both sides of this question. We still tell most businesses in the position described above to stay on Intune alone, which is the cheaper answer for them and the smaller one for us.

Our rule of thumb, and it is professional judgement rather than a published benchmark: the trigger is not headcount, it is the application estate. Ten Macs running fifteen specialist creative or engineering applications will break Intune’s app model long before fifty Macs running Microsoft 365, a browser and a video conferencing client. If you can list every non-Apple, non-Microsoft application on your Macs on one hand, stay on Intune.

The trade-off is real: staying on Intune means you own the packaging and versioning of third-party Mac applications yourself, or you accept that they update themselves and you stop pretending you control that. Say which one you are choosing, in writing.

What Intune genuinely does well on macOS

Automated Device Enrolment and zero-touch setup. Intune links to Apple’s business portal, so a Mac bought through a participating reseller enrols itself out of the box and arrives supervised. Note the naming change: Apple replaced Apple Business Manager with a service called Apple Business on 15 April 2026, per Apple’s own announcement. The mechanics are unchanged and Intune’s enrolment token flow still works the same way. If you have not set that up, start with Apple’s business device portal before you touch Intune.

Platform SSO. This is the strongest thing Microsoft has shipped for the Mac. Platform SSO signs users into a managed Mac with their Microsoft Entra ID credentials, and with the Secure Enclave authentication method it is passwordless and hardware bound. Microsoft’s documentation states plainly that Secure Enclave “is considered password-less and meets phish-resistant multifactor (MFA) requirements” and is “conceptually similar to Windows Hello for Business”. It needs macOS 13.0 or newer, Company Portal 5.2404.0 or newer, and it is included with all Intune licensing plans.

One honest caveat from Microsoft’s own page: with Secure Enclave, the local account password is deliberately left alone, because FileVault uses the local password to decrypt the disk at startup. After a reboot the user still types the local password once. Touch ID works after that.

FileVault with escrowed recovery keys. Intune configures FileVault, escrows the personal recovery key, and surfaces it through the built-in encryption report. Key rotation is gated behind an RBAC right, so a help desk operator can retrieve a key without being a global administrator. Microsoft is candid that Intune’s FileVault settings “do not expose every FileVault capability”, so check the specific option you need exists before you promise it.

The settings catalog. Intune’s settings catalog exposes Apple’s declarative and profile settings directly, which means most things Apple publishes a payload for can be configured without hand-writing a mobileconfig file. This is a genuine change from the Intune of a few years ago and a lot of stale advice online predates it.

Compliance policy feeding Conditional Access. A Mac can be assessed for OS version, encryption status, firewall state and Defender health, and that compliance state can gate access to Microsoft 365 through Conditional Access. This is the single best argument for Intune on Macs: the same identity and access decision covers both platforms. It sits at the centre of endpoint security and device management for a mixed fleet.

Defender for Endpoint on Mac. Built on Apple’s system extension architecture, with web threat protection across Safari, Chrome, Firefox and Edge, network protection, and device control for removable storage now generally available. It is a real EDR product on macOS, not a token port.

Declarative software updates. macOS updates are now enforced through Apple’s declarative device management on macOS 14 and later, configured in the settings catalog, targeting a specific OS or build version with an enforced deadline. Apple has deprecated the older MDM software update workload and Microsoft recommends DDM. If you configure both, DDM wins.

Where Intune is genuinely weaker than a dedicated Apple MDM

Third-party application patching. This is the big one. Intune’s Enterprise App Catalog, the feature that discovers, packages and auto-updates non-Microsoft applications, is a Windows Win32 feature. There is no macOS equivalent. On the Mac you upload DMG, PKG or line-of-business packages yourself, and when the vendor ships a new version you upload it again. Nothing tells you a new version exists.

A dedicated Apple MDM either ships a maintained patch feed or plugs into the community tooling that does. Intune does not. In practice, Intune shops either script the gap or let applications self-update and accept the loss of control. Both are defensible. Neither is what a vulnerability scanner report will expect to see.

Scripting and inventory attributes. Intune supports shell scripts on macOS 12.0 and later, but only through the separate Intune management agent, only on devices with a direct internet connection (proxies are not supported), with a 1 MB script size limit and a hard 60-minute execution timeout. Run status is only reported when it changes, which makes troubleshooting slower than it should be.

Custom attributes are thinner still: the script runs every eight hours and the returned value must be 20 KB or less. Compare that with an Apple-first platform where extension attributes feed dynamic device groups that drive policy in near real time. If your operating model depends on “find every Mac where X is true and do Y”, Intune will frustrate you. This is the practical difference that shows up in how Jamf and Intune compare head to head.

Application control. Intune has no application allowlisting for macOS. Windows has Defender Application Control and AppLocker; the Mac has Gatekeeper, notarisation and XProtect, which are Apple’s controls, not yours. If you have a control requirement that says only approved software may execute, Intune will not get you there on the Mac and neither will a different MDM without a third-party product. We deal with that specifically when mapping the Essential Eight onto macOS.

Speed of support for new macOS releases. Microsoft’s published support policy is that Intune supports the three most recent major operating system versions, with older versions allowed to enrol but not guaranteed to work. That is a reasonable policy. What it does not promise is that a new setting Apple introduces at WWDC will be configurable in the settings catalog on the day the new macOS ships. Apple-first vendors compete on exactly that, and it matters if you deploy new hardware early or your users update themselves.

The practical consequence for an Australian business: Apple’s major macOS releases land in our spring, which is the same quarter as end-of-year project pressure. Plan a deferral window rather than assuming your MDM will keep up.

If you are staying on Intune, do these five things

1. Set the software update deferral and deadline through DDM, not through the deprecated MDM policy, and pick a deferral period you can actually support.
2. Decide your third-party patching position and write it down. Either you package and version applications yourself on a schedule, or you enable vendor auto-update and record that as an accepted risk. Undecided is the failure mode.
3. Deploy Platform SSO with Secure Enclave, not the password method, unless you have a specific reason otherwise. It is the phishing-resistant option and it costs nothing extra.
4. Confirm FileVault keys are actually escrowing by pulling a key from the encryption report for a real device. Escrow silently failing is common and only discovered when you need the key.
5. Get compliance policy wired into Conditional Access so a non-compliant Mac loses access to data rather than just showing red in a report.

If you want the full enrolment, policy and failure-mode picture rather than just the Intune slice, we cover the mechanics of running a Mac fleet separately, and the wider question of running Windows, Mac and Google in one business without standardising on one vendor.

Book a review of your existing Intune tenancy and we will tell you whether your Macs are actually managed or just enrolled, and whether a second MDM is worth the licence. Call 1300 028 324 or use the form at https://techassist.au/contact/. We will give you the answer even if the answer is that your current setup is fine.

If a client or an insurer asks where your data lives, the honest answer for most Australian businesses is: the files sit in an Australian data centre, the company that runs it is American, and the people who administer it could be anywhere. Those three facts are separate questions, and most providers answer only the first one and call it sovereignty. Getting the distinction right matters, because the Privacy Act holds you responsible for what happens to personal information after it leaves your hands.

Data residency is where your data is physically stored. Data sovereignty is whose laws apply to it. Jurisdiction is which courts and agencies can compel its production. A data centre in Sydney settles residency. It does not settle the other two.

Residency, sovereignty and jurisdiction are three different questions

Residency is a fact about geography. Microsoft or Google can tell you which metropolitan area holds your mailboxes and files, and both publish that information.

Sovereignty is a question about law. A US-headquartered provider remains subject to US law wherever its servers sit, and an Australian subsidiary does not change the parent company’s obligations. A local region does not create a legal firewall.

Jurisdiction is the practical version of the sovereignty question: who can lawfully order the data to be handed over, and under what process. That question is answered by the provider’s corporate structure and the contract, not by the postcode of the building.

Providers who blur these three are usually selling a data centre tour. Ask which of the three they are actually addressing.

APP 8 makes you accountable for what your overseas provider does

Australian Privacy Principle 8 governs cross-border disclosure. Before an APP entity discloses personal information to an overseas recipient, it must take such steps as are reasonable in the circumstances to ensure that the recipient does not breach the APPs. Section 16C then makes the disclosing entity accountable for acts or practices of the overseas recipient that would breach the APPs. In plain terms: if your offshore provider mishandles the information, you are treated as having breached the APPs yourself.

The OAIC’s expectation is that “reasonable steps” normally means an enforceable contract requiring the recipient to handle the information in accordance with the APPs, requiring the same terms to flow down to subcontractors, setting out complaint handling, and requiring the recipient to notify you of suspected breaches so you can meet your obligations under the Notifiable Data Breaches scheme.

There is an important wrinkle that changes the analysis for cloud storage. The OAIC’s APP Guidelines say that providing personal information to an overseas contractor may be a use rather than a disclosure where you do not release the information from your effective control. The example given is a cloud provider engaged for the limited purpose of storing the information and making it available to you, where a binding contract limits the provider to those purposes, binds subcontractors to the same obligations, and leaves you with effective control over access, security and deletion. In that case APP 8 does not apply.

That is not a free pass. The Guidelines are equally clear that where the arrangement is a use, you still hold the information, so you can still breach APP 11 and the other APPs if the provider mishandles it. You have changed which principle you are judged under, not whether you are responsible.

There are also two exceptions worth knowing. APP 8.2(a) applies where you reasonably believe the recipient is subject to a law or binding scheme substantially similar to the APPs with an accessible enforcement mechanism. APP 8.2(b) applies where the individual consents after being expressly told that if they consent, you will not be accountable and they will not be able to seek redress under the Privacy Act. Consent-based offshoring is legally available and commercially unattractive, because you have to say that sentence out loud to the customer.

Before any of this is workable you need to know what you actually hold. That is why we ask clients to classify your data first and to keep a documented record of where each system stores data. Without it, the APP 8 question cannot be answered honestly for any given system.

Microsoft 365 in Australia: what the commitment actually covers

Microsoft treats Australia as a Local Region Geography, with Microsoft 365 data centre locations in Melbourne and Sydney. For a tenant whose Default Geography is Australia, Microsoft’s Privacy and Security Product Terms provide a durable data residency commitment for Exchange Online, SharePoint and OneDrive, Microsoft Teams, and Microsoft 365 Copilot and Copilot Chat.

Four things about that commitment are routinely misunderstood.

The Default Geography is set when the Microsoft Entra ID tenant is created and cannot be changed afterwards. If someone signed your business up for a trial with the wrong country years ago, that decision is still governing your data location today.

The commitment covers a defined list of services, not everything with a Microsoft logo. Coverage for Microsoft Defender for Office P1, the Microsoft 365 web apps, Viva Connections and selected Microsoft Purview services requires the Advanced Data Residency add-on, which must be applied to 100 per cent of paid licences in the tenant. Services outside the covered list follow their own provisioning logic.

Where there is no durable commitment for a service, Microsoft’s own documentation states that the data is not committed to reside in any particular data centre and that the storage location is subject to change without notice.

Finally, Microsoft’s documentation notes that a customer request may be handled by servers in a region other than the one where the data is stored at rest. Processing paths and storage location are not the same thing.

On access, Microsoft states that engineers have no standing administrative privileges and no standing access to customer data, that any access is limited, logged and approved by senior management, and that customers licensed for Customer Lockbox also approve it themselves. That is a meaningful control and it is worth turning on. It is not the same as saying nobody outside Australia can ever see the data.

You can check your own position in the Microsoft 365 admin center under Settings, Org settings, Organization profile, Data location.

Google Workspace does not offer an Australian data region

This one surprises people, so state it plainly. Google Workspace data regions let an administrator pin covered data to the United States or to Europe. The third option is “No preference”. Australia is not a choice.

The coverage is otherwise reasonably good where it applies. Data regions cover data at rest, including backups, and data processing for core services including Gmail, Calendar, Drive, Docs, Chat, Meet, Contacts and Vault, subject to edition. Google’s documentation is explicit that data regions cannot be applied to data types not listed, such as logs or cached content, and that users on an unsupported edition are not covered even if a policy is applied to their organisational unit.

Google Cloud, which is a different product, does operate Australian regions. If a vendor tells you their Workspace data is held in Australia, they are either describing something built on Google Cloud rather than Workspace, or they have not read the documentation.

Storage is local. Support and administration usually are not.

This is the gap that catches businesses in a client security review. Your tenant can be pinned to Melbourne and your support model can still involve people outside Australia.

Three things to check. First, the vendor’s own support model: follow-the-sun support desks routinely mean an engineer in another country holds a privileged account in your tenant. Second, subcontractors: a vendor with an Australian front office and an offshore development or support partner has an APP 8 question of its own to answer, and the OAIC expects the obligations to flow down. Third, your own provider: if your MSP uses offshore staff for after-hours triage, that is a disclosure decision you have made whether or not you were told about it.

TechAssist runs an Australian team from our Tecoma head office and Melbourne CBD office, so this is an easy question for us to answer. The point is that it is a question you should be asking of every provider with administrative access, including the ones you have used for years.

Foreign government access, stated factually

The United States enacted the Clarifying Lawful Overseas Use of Data (CLOUD) Act in March 2018. It confirms that US providers can be compelled to produce data in their possession, custody or control regardless of where that data is stored, and it authorises bilateral agreements allowing partner countries to serve orders directly on US providers. The United States and Australia signed a CLOUD Act agreement on 15 December 2021.

Two things follow. Data stored in Sydney by a US-headquartered provider is still within reach of US legal process. And Australian agencies have their own compulsory powers, so the alternative is not an absence of government access, it is a different government’s access.

Both Microsoft and Google publish periodic transparency reports on government requests. If this risk is genuinely material to your business, read those rather than the marketing page, and treat customer-managed encryption keys and Customer Lockbox as the controls that actually change the analysis.

The trade-off is worth naming. Moving to a wholly Australian-owned provider removes the foreign jurisdiction exposure and usually costs you the security engineering, availability and feature velocity of a hyperscaler. For most SMBs that is a bad trade. For a defence supplier it may not be.

When sovereignty is a legal requirement, and when it is a procurement preference

Genuine legal requirements exist, and they are narrower than the sales conversation suggests. Commonwealth and state government contracts commonly impose hosting and data location conditions, and those are contractual obligations you can read. APRA-regulated entities have their own prudential standards on information security and outsourcing.

Health is the example everyone reaches for, and it is the one most often stated wrongly. There is a real Commonwealth localisation rule, and it is section 77 of the My Health Records Act 2012 (Cth). It provides that the System Operator, a registered repository operator, a registered portal operator or a registered contracted service provider that holds records for the purposes of the My Health Record system, or has access to information relating to those records, must not hold or take the records outside Australia, must not process or handle the information relating to those records outside Australia, and must not cause or permit another person to do either. The only carve-out is for the System Operator itself, for operating or administering the system, and only where the records and information contain no personal information about a healthcare recipient or participant and no identifying information. Contravention is a fault-based offence carrying imprisonment for 5 years or 300 penalty units or both, with a civil penalty of 1,500 penalty units.

Now read the list of who that binds, because that is the part clinics get wrong in both directions. Section 77 applies to the operators of the My Health Record system and their contracted service providers. It is not a rule that all Australian health data must stay onshore. A medical, dental or allied health practice is a registered healthcare provider organisation, and registered healthcare provider organisations are not in the section 77 list. So section 77 does not, by itself, prohibit a clinic from using an offshore-hosted practice management system for its own clinical records. If your software vendor or your hosting sits inside the My Health Record system as a repository, portal or contracted service provider, section 77 binds that role directly and you should ask them to say so in writing. If it does not, your offshore hosting question is answered by the Privacy Act, your state health records legislation and your contracts, not by section 77. Getting this backwards means either buying sovereignty you are not required to have, or assuming a protection that does not apply to you.

Everything else is usually a procurement preference: a large customer’s security questionnaire, an insurer’s checklist, or a board that would prefer the answer to be “Australia”. Preferences are legitimate, and they cost money. Meeting them can mean an Advanced Data Residency add-on, an edition upgrade, or leaving a product you otherwise like.

The Privacy Act itself does not require personal information to stay in Australia. It requires you to take reasonable steps and holds you accountable if the recipient mishandles it. A business under the $3 million small business turnover threshold in section 6D may be exempt from the Privacy Act altogether, though the exemptions are narrower than most owners assume. It is worth understanding what the Privacy Act asks of a small Australian business before deciding you are outside it.

Where privacy reform has actually got to

Do not build a data strategy on the small business exemption surviving, and do not assume the second tranche has already landed. Both mistakes are common.

The first tranche is law. The Privacy and Other Legislation Amendment Act 2024 passed Parliament on 29 November 2024 and progressed 23 proposals from the government’s response to the Privacy Act Review Report, including a framework for a Children’s Online Privacy Code. Two of its changes reach ordinary businesses. The statutory tort of serious invasion of privacy commenced on 10 June 2025, and the OAIC notes that it is broader in application than the Privacy Act, extending to individuals and entities that are not APP entities, which means it can reach a business the Privacy Act does not. Separately, from 10 December 2026, an APP entity that has arranged for a computer program to use personal information to make a decision that could reasonably be expected to significantly affect a person’s rights or interests must say so in its privacy policy, including the kinds of information used and the kinds of decisions made. The OAIC has consulted on guidance and said it intends to publish it before that date.

The second tranche is not law, and that is where the bigger changes sit, including removal of the small business exemption. At the time of writing the Attorney-General’s Department’s own privacy page still describes the work as developing draft provisions and engaging on the detail to inform the government’s decisions on next steps, and no second tranche Bill has passed. Treat the exemption as a temporary position, check the position again before you rely on it, and note that it was never a shield against the statutory tort, which does not depend on being an APP entity at all.

The questions to put to a SaaS vendor

Send these in writing and keep the answers with the contract.

1. In which country is customer data stored at rest, and is that a contractual commitment or a current arrangement you may change?
2. Which specific services or modules are covered by that commitment, and which are not?
3. Where are backups, replicas, logs and cached content stored?
4. From which countries can your staff and subcontractors access customer data, and under what approval process?
5. Who are your sub-processors, where are they, and do your contracts require them to meet the same obligations?
6. Under APP 8, do you regard your handling of our customers’ personal information as a use or a disclosure, and why?
7. Will you notify us of a suspected data breach, within what timeframe, and in what form?
8. On termination, how is our data returned and destroyed, and will you provide evidence that destruction occurred?

Question seven is the one that determines whether you can meet your obligations under the Notifiable Data Breaches scheme, which require you to notify the OAIC and affected individuals when a breach is likely to result in serious harm. Question eight is the one everyone forgets until an exit, and it connects directly to secure device disposal and the APP 11.2 obligation to destroy personal information you no longer need. If you want the configuration side handled properly as well, start with cloud security controls that matter for an SME.

If you are filling in a client security questionnaire or a cyber insurance form and cannot answer these questions about your own tenant, we can audit it and give you the documented answers. Call us on 1300 028 324 or get in touch at https://techassist.au/contact/. We will tell you where your data actually sits, not where you would like it to be.

A mixed fleet is a business running more than one desktop platform and more than one productivity suite at the same time, most commonly Windows with Microsoft 365 alongside Macs and Google Workspace. Almost every Melbourne business over about thirty staff is one, whether anyone planned it or not. The design team bought Macs, the accounts team runs Windows because the practice software demands it, and the founder set up Google Workspace in 2016 and never looked back.

Most providers respond to this by proposing a migration. That is usually a sales position rather than a technical one. A mixed fleet is entirely runnable, but only if you are honest about which layer must be unified and which layers should be left alone.

Identity is the only thing you genuinely must unify

Everything else in a mixed environment can be tolerated. Two identity stores cannot.

The moment a person exists as a separate account in Microsoft 365, in Google Workspace and again in Apple’s ecosystem, you have three joiner processes, three leaver processes and three places to enforce multi-factor authentication. When someone resigns on a Friday afternoon, the account you forget is the one that gets used. This is the single most common failure we see in businesses that grew into a mixed fleet rather than designing one.

Unified identity does not mean one vendor. It means one authoritative directory that every other system trusts, and one onboarding and offboarding checklist that closes every door at once.

Make Entra ID the anchor and Google the relying party

If you are running both suites, the direction of federation is not a matter of taste. It is determined by what the two vendors actually support.

Microsoft publishes a first-party integration for using Microsoft Entra ID as the identity provider for Google Workspace, listed in the Entra gallery as the Google Cloud / G Suite Connector by Microsoft, with SCIM provisioning alongside it. Google documents the other half from its side, confirming that Workspace supports single sign-on from third-party identity providers over both SAML and OIDC, and ships a pre-built Microsoft Entra OIDC profile.

The reverse is not a supported architecture. Microsoft’s Google federation feature is scoped to business-to-business guest users, and Microsoft states plainly that it no longer performs validation testing of independent identity providers for compatibility with Entra ID. Anyone proposing Google Workspace as the primary identity provider for a Microsoft 365 tenancy is proposing something neither vendor documents.

One caveat worth writing into your runbook: Google restricts single sign-on for super administrators, and super admins signing in to the admin console must use their Google password rather than federated credentials. Keep at least one break-glass Google super admin outside single sign-on, store the credential properly, and test it. If you skip this, read what happens when you are locked out of your Google Workspace admin account before you find out the hard way.

Apple will federate with one identity provider, not two

Apple Business, the portal formerly known as Apple Business Manager, can federate with Google Workspace, with Microsoft Entra ID, or with a generic provider over OIDC or SCIM. Apple’s documentation is explicit that you can link to one of these at a time, not several.

That single sentence settles a lot of architectural arguments. If your Macs and iPhones are going to draw their Managed Apple Accounts from a directory, you must choose which directory, and in a Microsoft-anchored environment that is Entra ID.

There is a second trap here that catches people badly. Before Apple will federate a domain it must be verified and captured, and turning on Domain Capture gives every staff member with a personal Apple Account on your company domain a fixed thirty days to move their personal data off it. Apple states the date cannot be extended and that turning on Domain Capture cannot be undone. Staff with a decade of personal photos and App Store purchases attached to a work email address will not take this well if it lands unannounced. Communicate before you press the button, not after. The full sequence is covered in the guide to Apple Business, the portal formerly called Apple Business Manager.

Device management does not consolidate, and that is fine

Identity converges. Device management does not, and chasing a single pane of glass here usually costs more than it saves.

Windows provisioning through Autopilot, macOS enrolment through Apple’s Automated Device Enrolment, and Chrome or Android enrolment through the Google admin console are three genuinely different pipelines with three different trust models. One console can hold all three records, but the underlying work is still platform-specific. What matters is that every device is enrolled in something, that the something reports compliance back to your identity provider, and that nothing is unmanaged.

If you already pay for Microsoft 365 Business Premium or E3, you already own Intune, and Intune will manage Macs. Whether it manages them well enough is a real question with a real answer, covered in what Intune can and cannot do on a Mac and in the head-to-head on Jamf and Intune compared honestly. The practical mechanics of enrolling and managing a Mac fleet are a separate discipline again, and it is the one most generalist providers quietly skip. We have written separately about why most Melbourne MSPs cannot support Macs properly, because the gap is structural rather than a matter of effort.

On the Google side, the equivalent baseline work is in the Google Workspace admin console settings that matter, and the day-to-day device story sits alongside your broader approach to mobile device management.

Running both suites costs more than two subscriptions

The licence line is the visible cost. It is rarely the largest one.

Only one system can own your mail. Your domain has one set of MX records. Google documents split delivery and dual delivery as the two ways to run a second mail platform alongside Gmail, and in both cases the second system receives forwarded copies rather than authoritative delivery. You pay for two mail platforms and get one authoritative mailbox store, plus permanent complexity in SPF, DKIM and DMARC alignment on forwarded messages.

Storage entitlements do not travel. Google’s pooled storage is pooled within Google. Microsoft’s mailbox and OneDrive quotas are entitlements within Microsoft. Buying more of one never offsets the other, and staff will keep the same files in both, so you pay twice to store the same bytes. Neither vendor is backing that data up for you either, which is the subject of Google is not backing up your Workspace data.

Policy parity requires an edition uplift on both sides. Conditional Access on the Microsoft side requires Entra ID P1, which is included in Microsoft 365 Business Premium and E3. The nearest Google equivalent, Context-Aware Access, is restricted to the Enterprise, Education and Frontline editions or to Cloud Identity Premium, and Google states that users without a supported edition are simply not subject to Context-Aware Access policies at all. That Google-side uplift is the cost most businesses miss, because it is not a security add-on you buy for a handful of people. It is an edition change across every user.

We are not going to publish a dollar figure here, because the honest answer depends on your exact mix of editions. What we will say is that the second suite is almost never as cheap as the second subscription line suggests.

Your security baseline does not translate across platforms

This is where mixed fleets quietly fail audits and cyber insurance questionnaires.

The Essential Eight is the framework Australian businesses are measured against, and read closely it is shaped around Microsoft products. The current maturity model, last updated in November 2023, contains no mention of macOS, Apple, iOS, Chrome or Google anywhere in the document. One of the eight strategies is restrict Microsoft Office macros, and at Maturity Level Two and above it requires blocking macros from making Win32 API calls, which is Windows-only by definition. Application control at Maturity Level Two and above requires implementing Microsoft’s recommended application blocklist. User application hardening names Internet Explorer 11 and PowerShell logging.

ASD’s own hardening library reflects the same shape. It publishes hardening guides for Windows 10, Windows 11 and Linux workstations. There is no enterprise macOS hardening publication at all, and the only Apple configuration guide covers iOS 14. Its Blueprint for Secure Cloud is described by ASD as having a current focus on Microsoft 365, with no Google Workspace equivalent.

None of that means a Mac fleet cannot be secured to an equivalent standard. It means the equivalence has to be argued and documented rather than assumed, using the model’s own allowance for vendor hardening guidance and its exceptions process. Do that work before an assessor asks, not during. The detail sits in mapping the Essential Eight onto macOS and whether you can meet the Essential Eight on Google Workspace, and the underlying platform hardening in hardening Google Workspace.

One more thing worth knowing if you are planning a multi-year uplift: ASD ran a consultation on the evolution of the Essential Eight that closed on 12 July 2026, proposing a new Essentials series with the current guidance becoming a chapter called Essentials for enterprise IT. ASD says existing adopters can expect strong alignment with their current controls. Build your roadmap anyway, but build it knowing the framework is being rewritten.

When consolidating actually is the right call

Sometimes the migration everyone keeps proposing is correct. The honest triggers are these.

Consolidate when the duplication is at the identity layer and cannot be federated away. Consolidate when a compliance obligation or a client security review requires a single enforceable policy set and you cannot demonstrate equivalence on the second platform. Consolidate when the second suite is used by fewer people than it costs to administer properly. Consolidate when the business is being sold or is acquiring, because two suites double the integration work later.

Do not consolidate because one platform is unfamiliar to your provider. That is their problem to fix, not yours to pay for.

If you do decide to move, move deliberately. The comparison itself is covered where we have already compared the two suites feature by feature, and the actual migration mechanics, including what breaks in shared drives and calendar delegation, are in the mechanics of moving off Google Workspace. If you have inherited an environment and cannot even establish who owns what, start with inheriting a Workspace tenancy nobody documented.

What a properly run mixed fleet looks like

One authoritative directory. Every other platform federated to it, including Apple. Every device enrolled in a management service appropriate to its platform, reporting compliance back to that directory. One documented joiner and leaver process that touches every system. A written, defensible mapping of your security baseline onto each platform, including the parts where the framework does not fit and you have documented an equivalent control instead. And a hardware lifecycle that does not depend on who happened to buy the laptop, which is the subject of buying, redeploying and disposing of Apple hardware.

That is achievable at 30 staff and at 200. What it requires is a provider who is competent on all three platforms rather than one who tolerates two of them: someone who works with Apple’s business deployment programmes for enrolment and device management, runs Entra ID and Intune as daily work rather than as an escalation, and can open the Google Admin console and tell you what is wrong with it.

TechAssist has run Windows, Mac and Google environments side by side for Melbourne businesses for over 20 years, with 13 certified specialists across the team. We are a Microsoft partner and a Jamf partner, and on the Apple side we are a member of the Apple Consultants Network, Apple’s programme of independent technology partners specialising in Apple solutions for small and medium-sized businesses. That combination is the point rather than the decoration. A provider holding partnerships on both sides of an argument has no commercial reason to steer the answer, and the only honest test of neutrality is whether they ever recommend the option that earns them less. We do that regularly, and you will find us doing it in the posts linked above. If you want a straight assessment of whether your mixed fleet should be unified or simply run properly, call 1300 028 324 or get in touch at https://techassist.au/contact/. We will tell you which of the two it is, including when the answer is that you do not need to change anything.

Outlook rules are the single fastest way to stop drowning in email. They sort, file, flag and forward messages automatically, the moment they arrive, so your inbox shows you what matters and quietly parks the rest. Combine them with Focused Inbox, Quick Steps and templates, and Outlook starts working for you instead of the other way around.

This is a practical guide to the features that genuinely save time across the new Outlook, Outlook on the web and the classic desktop app. No theory, no clearing of throats. The examples come from configuring Microsoft 365 for Melbourne SMEs day in, day out, and there is a short security note near the end that every business owner should read.

Rules: the workhorse

A rule is a simple instruction: when a message meets a condition, do something with it. When it is from your accountant, move it to the Finance folder. When the subject contains “invoice”, flag it. When it is sent to a distribution list you only skim, mark it read and file it. You build them once and they run forever.

Server-side versus client-side rules

This distinction matters more than most people realise. Server-side rules run on the Exchange Online server, so they work whether or not your computer is on. A rule that files newsletters runs at 2am while your laptop is shut. Client-side rules only run while the classic Outlook desktop app is open and connected, because they depend on something only the desktop app can do.

The trigger for the difference is the action. Conditions and actions that Exchange understands on its own — move, copy, delete, forward, flag, mark as read — stay server-side. The moment a rule includes something the server cannot do, such as “display a desktop alert”, “play a sound”, or “move to a folder in a local PST”, the whole rule becomes client-only. In Outlook you will see these flagged with “on this computer only”.

The practical advice: keep your important filing and forwarding rules server-side so they run reliably from any device, including the Outlook mobile app and the web. Save client-side rules for cosmetic things you genuinely only want while sitting at that one machine. If you live across a desktop, a laptop and your phone, server-side is the only way to get consistent behaviour everywhere.

Where to build them

In the new Outlook and Outlook on the web, go to Settings > Mail > Rules and select Add new rule. In classic desktop Outlook, it is File > Manage Rules & Alerts, or right-click a message and choose Rules > Create Rule to pre-fill the conditions from that message. Building from an example message is the quickest way to get a rule right first time.

Rule recipes that earn their keep

• Tame distribution lists. Mail sent to a group you are on but rarely need urgently: move it to a dedicated folder and mark it read. You read it when you choose, not when it pings.
• Surface the important senders. Mail from your top clients or your boss: flag for follow-up and keep it in the inbox so it never gets buried.
• File the predictable stuff. Statements, system notifications, monitoring alerts and receipts: route straight to topic folders so the inbox stays for things that need a human decision.
• Catch the subject keywords. Anything with “PO”, “RFQ” or a project code in the subject into the relevant project folder, so nothing scatters.

One caution: rules run in order, top to bottom, and some can “stop processing more rules”. A common trap is a tidy-up rule near the top quietly swallowing messages a later rule was meant to catch. Review the order when something stops arriving where you expect it.

Focused Inbox, Other and Sweep

Focused Inbox splits your inbox into two tabs: Focused for the mail Outlook judges important, and Other for the rest — newsletters, notifications, bulk mail. It learns from your behaviour. Move something from Other to Focused a couple of times and it gets the message. It is on by default in most Microsoft 365 tenants and you can toggle it under View > Show Focused Inbox.

People either love it or fight it. The honest take: Focused Inbox is machine-guessed and changes daily, whereas a rule is a guarantee you wrote yourself. Use Focused Inbox as a soft first pass for mail you have not categorised, and use rules for anything where you need certainty. If you turn Focused Inbox off, your rules still do their job.

Sweep is the underused companion. Select a sender, hit Sweep, and you can delete all current mail from them, delete everything older than a set number of days, or keep only the latest and auto-delete the rest going forward. It is the fastest way to clear a sender who emails you forty times a week — a standing instruction rather than a one-off delete.

Quick Steps: one click, several actions

Quick Steps (classic desktop and increasingly the new Outlook) bundle a sequence of actions behind a single button. Where a rule runs automatically, a Quick Step runs when you click it — perfect for the repetitive handling you do by hand.

A help desk in Cremorne we set up uses one called “To Project” that, in a single click, moves the selected email to a project folder, marks it read and categorises it. Other useful ones: “Reply & Archive”, “Forward to team and flag”, or a “Done” button that files and clears. You will find them on the Home ribbon, and you can build your own from the Manage Quick Steps option. Five minutes setting up three Quick Steps removes hundreds of repeated clicks a month.

Templates, My Templates and Quick Parts

If you type the same reply more than twice, template it.

• My Templates is an add-in built into Outlook on the web and the new Outlook. Open the My Templates pane while composing, click a saved snippet, and it drops straight into the message body. Ideal for standard responses — opening hours, “received, we’ll be in touch”, booking confirmations.
• Quick Parts in classic desktop Outlook store reusable blocks of formatted text under Insert > Quick Parts. Better than My Templates when you need formatting, tables or images preserved.
• Email templates proper (.oft files) suit a whole pre-built message you send repeatedly — save via Save As > Outlook Template, reopen via New Items > More Items > Choose Form.

For replies that several staff send identically, templates beat everyone improvising. They keep the wording consistent and on-brand, and they spare you retyping the same paragraph for the hundredth time.

Signatures, and why org-wide ones belong centrally

Per-mailbox signatures are set under Settings > Mail > Compose and reply in the new Outlook, or File > Options > Mail > Signatures in classic desktop. Fine for one person.

For a business, leave individual signatures behind. When everyone manages their own, you get mismatched fonts, dead phone numbers, broken logos and the occasional rogue inspirational quote. Worse, signatures set in Outlook desktop do not follow you to the web or the mobile app, so a phone reply goes out bare. The fix is a centrally managed signature applied at the Microsoft 365 service level — typically a transport rule or a dedicated signature platform — so every message from every device carries a consistent, correct, compliant footer your staff cannot break. We set this up as part of a managed Microsoft 365 environment, and it is one of those small things that quietly makes a business look more professional overnight.

Categories and Search Folders

Colour categories are a flexible tagging layer that works across mail, calendar and tasks. Tag by client, by project, by priority — whatever you actually sort by. Rename the default colours to something meaningful (right-click a message > Categorize > All Categories) and you can later filter or search on them in seconds.

Categories pair beautifully with Search Folders (classic desktop). A Search Folder is a saved, live view that gathers every message matching a rule no matter which folder it physically lives in — “all unread”, “flagged for follow-up”, “anything categorised Urgent”. The mail stays put; the Search Folder is just a smart window onto it. Set up two or three and you stop hunting through folders.

Scheduling: Calendar and Bookings

For internal scheduling, the Outlook calendar’s Scheduling Assistant shows colleagues’ free/busy so you stop the back-and-forth of finding a slot. For external scheduling, Microsoft Bookings — included in most Microsoft 365 Business plans — gives clients a public page to book a time against your real availability, with automatic confirmations and reminders. A consultancy in Box Hill we work with replaced a week of email tag with a Bookings page link in their signature; clients self-serve and the calendar fills itself.

Microsoft 365 mailbox hygiene

Rules and folders only help if the mailbox underneath is healthy.

• Archive, do not hoard. Use the Online Archive (auto-expanding in most business plans) and a retention/archive policy so the primary mailbox stays lean. Searching a 90GB mailbox is slow and painful.
• Unsubscribe, do not just delete. If you delete the same newsletter daily, you are doing manual labour a single unsubscribe would end.
• Audit your rules quarterly. Old rules forwarding to a former colleague, or filing into a folder nobody opens, accumulate quietly. Prune them.
• Keep it in folders, not the inbox. A 12,000-message inbox is a search problem waiting to happen. Let rules and Quick Steps do the filing.

A security note on forwarding rules

This one is not optional reading. Auto-forwarding rules — especially ones that quietly send copies of mail to an external address — are a classic indicator of a business email compromise (BEC). When an attacker phishes a mailbox, one of the first things they do is create a hidden rule that forwards finance-related mail out, or deletes the attacker’s own messages so the real user never sees the fraud playing out. Many breaches run for weeks behind a single forwarding rule nobody noticed.

Treat any unexpected forwarding rule, or a rule sending mail straight to Deleted Items or RSS Feeds, as a red flag worth investigating immediately. In a well-run tenant, external auto-forwarding is blocked or alerted on by default, and we monitor for rule changes as part of mailbox security. If you want the detail on how these attacks work and how to defend against them, our guide to business email security, phishing and BEC walks through it. Convenience features and attacker tools share the same plumbing here — which is exactly why the plumbing needs watching.

Frequently asked questions

Do my Outlook rules work when my computer is off?

Only if they are server-side rules. Move, forward, flag, delete and mark-as-read actions run on the Exchange Online server and work around the clock from any device. Rules with desktop-only actions — alerts, sounds, or moving to a local PST — run solely while the classic desktop app is open and are labelled “on this computer only”.

Should I use Focused Inbox or rules?

Both, for different jobs. Focused Inbox is an automatic best-guess that adapts over time and suits mail you have not specifically sorted. Rules are guarantees you write yourself for senders or subjects where you need certainty. Rules keep working whether Focused Inbox is on or off.

How do I save email templates for replies I send constantly?

Use My Templates (the snippet pane in Outlook on the web and new Outlook) for quick text blocks, Quick Parts in classic desktop when you need formatting preserved, or a saved .oft template for an entire pre-built message. For replies several staff send identically, templates keep the wording consistent.

Why should signatures be managed centrally?

Because signatures set in one Outlook app do not follow you to the web or mobile, and self-managed signatures drift into broken logos, dead numbers and inconsistent formatting. A signature applied at the Microsoft 365 service level applies to every message from every device, stays consistent, and cannot be broken by individual users.

Are forwarding rules dangerous?

Legitimate ones are fine, but an unexpected rule that forwards mail to an external address is one of the most common signs of a compromised mailbox. Attackers use them to siphon finance emails or hide their tracks. Review your rules periodically and have external auto-forwarding blocked or alerted on at the tenant level.

Make Outlook earn its keep

None of this needs new software — it is all sitting in the Microsoft 365 you already pay for. An hour spent building a handful of rules, a few Quick Steps and some templates pays itself back every single week. The catch is doing it properly: server-side where it counts, central signatures, sensible retention, and a tenant configured so the convenience features cannot be turned against you.

We are a Melbourne-based MSP with 13 Australian-employed engineers, and getting clients the full value of their Microsoft 365 — configured securely, not just switched on — is core to what we do. If you would like your tenant set up so Outlook genuinely works for your team, get in touch and we will sort it.

Microsoft Purview is Microsoft’s data governance and compliance suite inside Microsoft 365 — the rebranded, expanded successor to what used to be called the Microsoft 365 Compliance Centre. It is how you classify, protect, retain and audit your organisation’s data, and it is the layer that decides what Copilot is allowed to see.

For a Melbourne SME, the practical question is not “what is Purview” but “which bits do I already pay for, and what should I switch on first?” This post answers both, without the marketing gloss.

What Microsoft Purview actually is

Purview is an umbrella brand. Under it sit a set of tools that used to be scattered across separate portals. They are now grouped at purview.microsoft.com and broadly cover two jobs: knowing where your sensitive data is, and controlling what happens to it.

The capabilities that matter to most small and mid-sized businesses are:

• Sensitivity labels — tags like Confidential or Internal that travel with a file or email and can enforce encryption and access rules.
• Data Loss Prevention (DLP) — rules that stop sensitive data, such as credit card or Tax File Numbers, from leaving the organisation by email, Teams or to USB.
• Retention policies and labels — rules that keep records for a set period and delete them when they expire, which is how you meet records-keeping obligations without hoarding everything forever.
• eDiscovery — the ability to search across mailboxes, SharePoint and Teams to find content for a legal matter, dispute or regulator request.
• Audit — a searchable log of who did what: who opened a file, who deleted a mailbox item, who changed a permission.
• Insider risk management — analytics that flag risky behaviour, such as a departing employee mass-downloading client files.
• Communication compliance — monitoring of internal messaging for harassment, code-of-conduct breaches or regulated-industry conduct rules.

You will not use all of these on day one, and you should not try to. The point is that Purview is where data governance lives once you decide to take it seriously.

What you get with Business Premium, and what needs E5

This is where most decisions get made, because the licensing split is real and it is easy to overspend or assume you have features you do not.

Microsoft 365 Business Premium — the plan most Melbourne SMEs land on — includes a genuinely useful slice of Purview. You get manual sensitivity labels, basic DLP for Exchange, SharePoint, OneDrive and Teams, basic retention policies, standard audit logging, and basic eDiscovery (search and export). For a business under 300 seats, that is enough to make a real difference.

The advanced tier sits behind Microsoft 365 E5, the E5 Compliance add-on, or standalone Purview add-ons. That is where you find automatic labelling, DLP that extends to endpoints and browsers, communication compliance, insider risk management, eDiscovery (Premium) with legal hold and review sets, and longer audit retention.

The honest advice: do not buy E5 because the feature list looks impressive. Buy it when you have a specific obligation — a regulator, an insurer, a contract — that needs automatic labelling, endpoint DLP or insider risk. Most SMEs get years of value out of the Business Premium tier first. If you are weighing up the plans, our guide to what is included with Microsoft 365 support in Melbourne sets out where the lines fall.

What to do first: labels and DLP

If you take one thing from this post, take this. Start with sensitivity labels and DLP. They give you the most protection for the least effort, and everything else builds on them.

Sensitivity labels

A sensitivity label is a tag a user applies to a document or email. A typical SME set is three or four labels: Public, Internal, Confidential, and perhaps Highly Confidential. The label can be cosmetic (a footer marking) or it can enforce real controls — encryption, a watermark, blocking external sharing.

Start cosmetic, get people used to choosing a label, then add enforcement to the top one or two. A label that encrypts Confidential files means a document forwarded to the wrong address is unreadable to the recipient. That single control has saved more SMEs than any firewall rule.

Data Loss Prevention

DLP inspects content against patterns and conditions you set, then acts. The patterns Australian businesses care about are built in or easy to define: Tax File Numbers, Medicare numbers, credit card numbers, ABNs, driver licence details. A starter DLP policy might warn a user — or block outright — when they try to email a spreadsheet containing more than a handful of TFNs to an external address.

Begin every DLP rule in audit-only mode. Let it run for a fortnight, see what it would have flagged, and tune out the false positives before you switch to blocking. Turn DLP straight to block on day one and you will have the finance team locked out of legitimate work by Tuesday. DLP sits naturally alongside the rest of your cyber security services stack — it is the data-layer complement to identity controls like conditional access.

Retention, eDiscovery and audit: the records side

The governance half of Purview is about keeping the right things for the right length of time, and being able to find them.

Retention answers a question every business eventually faces: how long do we keep this? Some records have legal minimums — employee records under the Fair Work Act, financial records under the Corporations Act, health records under state health-records legislation. Retention policies enforce those minimums automatically and, just as importantly, delete data once the obligation lapses so you are not holding a decade of client files that are now pure liability.

eDiscovery earns its keep the day you receive a subpoena, a Fair Work claim or an OAIC enquiry. Instead of an engineer manually trawling mailboxes, you run a content search across Exchange, SharePoint and Teams and export exactly what is in scope. Standard eDiscovery in Business Premium handles most SME needs.

Audit is the quiet hero. When something goes wrong — a deleted file, a mailbox rule someone did not set, a permissions change — the audit log tells you who and when. It is also frequently the first thing a cyber insurer or incident responder asks for. If you are thinking about coverage, audit logging is part of what makes a claim defensible; our cyber insurance guide for Australian SMEs covers the broader picture.

Governance before AI: Purview and Copilot

This is the use case pushing Purview up the priority list for 2026. Microsoft 365 Copilot answers questions using your organisation’s data — every file, email and chat the asking user already has permission to see. That is the catch. Copilot does not break permissions; it surfaces what loose permissions already expose.

If your SharePoint has a “Company” site everyone can read, and someone parked the payroll spreadsheet there three years ago, Copilot will happily summarise salaries when an employee asks. The file was always accessible — nobody ever browsed to it. Copilot removes that friction.

This is why governance comes before AI, not after. Sensitivity labels let you mark and encrypt the data Copilot should never reuse. DLP and retention reduce the volume of stale, mislabelled data sitting in shared locations. Auditing tells you what Copilot has been asked. Switching on Copilot without doing this first is how a tidy-looking rollout becomes a quiet data-exposure incident.

The same logic applies to the Privacy Act 1988. Under the Australian Privacy Principles, you are obliged to take reasonable steps to protect personal information and to not keep it longer than needed. Reforms now working through Parliament are tightening those expectations, including around automated decision-making and data minimisation. Purview’s labelling, DLP and retention are precisely the “reasonable steps” the Office of the Australian Information Commissioner (OAIC) expects you to be able to demonstrate.

A Hawthorn scenario

A professional services firm in Hawthorn we work with wanted to roll out Copilot across forty staff. Before flicking it on, we ran a labelling and permissions review. We found three SharePoint sites with broad read access holding client financials and a folder of scanned passports from an old onboarding process. We applied Confidential labels with encryption to the sensitive sites, tightened the permissions, set a DLP rule on TFNs and Medicare numbers, and added a retention policy that purged the passport scans that should have been deleted years earlier. Copilot went live two weeks later — on data that was actually governed. The firm now has something concrete to show their professional indemnity insurer.

That sequence — govern, then enable — is the whole game. TechAssist has run Microsoft 365 for Melbourne SMEs since 2008, with thirteen Australian-employed engineers and a 24/7 NOC in Tecoma, and the Purview-before-Copilot review has become one of the more common pieces of work we do.

Frequently asked questions

Is Microsoft Purview a separate product I have to buy?

No. Purview is the brand for governance and compliance tools built into Microsoft 365. A meaningful set is already included with Business Premium. You only pay extra — through E5 or the E5 Compliance add-on — for advanced features such as automatic labelling, endpoint DLP and insider risk management.

What is the difference between sensitivity labels and retention labels?

Sensitivity labels control protection — encryption, access and markings on a file. Retention labels control lifecycle — how long an item is kept and when it is deleted. They solve different problems and you typically use both: sensitivity to protect, retention to keep or dispose.

Do I need Purview before turning on Copilot?

You should. Copilot surfaces anything the asking user can already access, so existing over-permissioned data becomes far easier to stumble across. Sorting out labels, permissions and DLP first stops Copilot turning a hidden exposure into an obvious one.

Does Purview help with the Privacy Act?

It helps you demonstrate compliance. The Australian Privacy Principles require reasonable steps to protect personal information and to not retain it beyond need. Purview’s DLP, sensitivity labels and retention policies are practical, auditable controls that show the OAIC you have taken those steps.

Where to start

Do not boil the ocean. Pick three or four sensitivity labels, switch on a couple of DLP rules in audit mode, and set retention on your one or two most regulated record types. That alone puts you ahead of most SMEs and gives you a defensible governance baseline — and the foundation you need before any AI tool touches your data.

If you would like a hand scoping a Purview rollout, sorting your Microsoft 365 licensing, or running a governance review before you enable Copilot, get in touch with TechAssist. We will tell you plainly what you already have, what is worth turning on, and what you can safely leave alone.

For most Australian SMEs the honest answer to Microsoft 365 vs Google Workspace comes down to how your team actually works. Google suits lean, cloud-native businesses that live in a browser. Microsoft suits desktop-heavy, Windows-fleet, compliance-driven operations. Both are mature, secure platforms — the wrong fit just costs you in friction.

We’re a Microsoft-centric MSP, so I’ll declare that bias up front. But there are plenty of Melbourne businesses where I’d point a client to Google without hesitation. This is a fair comparison, not a sales pitch, and below there’s a table to cut through the marketing on both sides.

The quick comparison

Pricing changes regularly and varies by term and reseller, so treat those figures as a guide rather than a quote. The real cost difference between the two is usually rounding error compared with the cost of choosing the platform that fights your workflow.

Apps: desktop power vs web speed

This is the clearest fork in the road. Microsoft gives you the full desktop Office suite — the real Excel, with the pivot tables, Power Query, macros and add-ins that finance teams and engineers depend on. If your business runs complex spreadsheets, branded Word templates, or PowerPoint decks that have to look identical every time, desktop Office still has no equal.

Google Workspace is web-first and proud of it. Docs, Sheets and Slides load instantly, autosave constantly, and make real-time co-editing feel effortless. For a marketing agency or a startup where two people are in the same document at once all day, that collaboration model is genuinely better. The trade-off is depth: heavy Excel users hit Sheets’ ceiling quickly, and complex formatting can drift.

Where Google clearly wins: if your team already does everything in a browser and nobody opens a desktop app from one week to the next, paying for desktop Office you’ll never install is waste.

Email: Outlook vs Gmail

Exchange Online with Outlook is the workhorse of Australian business email. Shared mailboxes, delegate access, distribution groups, calendar scheduling across a team — it’s all mature and granular. For a law firm in Hawthorn juggling shared client inboxes and rigid retention rules, Exchange and Microsoft Purview make that straightforward.

Gmail’s strength is search and filtering. Its spam and phishing detection is excellent, the interface is clean, and conversation threading is hard to beat. Smaller teams often find Gmail simply gets out of the way. Either way, email is your single biggest attack surface — we cover that in our guide to business email security and BEC, and the controls matter more than the brand.

Storage: OneDrive/SharePoint vs Drive

Microsoft splits storage into OneDrive (your personal files) and SharePoint (team document libraries). Done well, SharePoint is a proper intranet and document-management system with versioning, metadata and permissions. Done badly, it’s a sprawl of sites nobody can navigate. It rewards structure.

Google Drive with Shared Drives is more intuitive out of the box. Files live where you’d expect, sharing is a couple of clicks, and there’s less to misconfigure. For a business that just wants files in folders without a SharePoint information-architecture project, Drive is the gentler path.

Meetings: Teams vs Meet and Chat

Teams is the centre of gravity in the Microsoft world — meetings, calls, persistent chat, channels and an app platform all in one. For organisations already on Microsoft, that integration is a real advantage; for ones that aren’t, Teams can feel like a lot. Plenty of people find it heavy.

Google Meet and Google Chat are deliberately lighter. Meet is reliable, browser-based and quick to join with no client to install. If your meetings are mostly external and you value “click the link and you’re in”, Meet’s simplicity is a genuine plus. Microsoft’s edge shows up in internal collaboration depth, calling features and telephony integration.

Identity, admin and security

This is where Microsoft pulls ahead for businesses that need it. Microsoft Entra ID (the identity platform formerly known as Azure AD) offers some of the most granular access controls available — you can require multi-factor authentication only from unmanaged devices, block sign-ins from outside Australia, or enforce compliant-device checks. We walk through this in our piece on conditional access policies in Microsoft 365. Defender and Purview add threat protection and data-loss prevention that map neatly onto frameworks like the Essential Eight.

Google’s admin console is more approachable. Fewer settings means less to get wrong, which for a small team without dedicated IT is a real benefit. Google’s identity and security are strong — context-aware access and solid MFA — but Microsoft’s controls go deeper for complex, regulated or hybrid environments where on-premises Active Directory is still in the mix.

Compliance and data residency

For Australian businesses bound by the Privacy Act and the OAIC’s Notifiable Data Breaches scheme, data residency and auditability matter. Microsoft offers Australian data centres for core data at rest and gives detailed control over retention, legal hold and audit logging through Purview — useful for sectors under AHPRA, ASIC or similar oversight.

Google Workspace provides regional storage options and strong compliance certifications, though some processing still happens across its global infrastructure. For most SMEs that’s perfectly acceptable. For a healthcare practice or a firm with strict data-handling obligations, Microsoft’s granular controls usually make the compliance conversation easier — see our notes on healthcare IT and OAIC obligations.

Migration effort

Moving platforms is rarely trivial. Email migrates reasonably well in both directions, but the friction lives in the details: shared mailboxes, calendar permissions, distribution lists, and re-training people on a new interface. Document migration is messier — Google formats don’t always survive a clean trip into Office, and complex Excel or SharePoint structures don’t always land neatly in Sheets and Drive.

The practical rule is to migrate once, deliberately, and stay put. Bouncing between platforms because of a price tweak costs far more in lost time than it saves. Whichever way you go, plan the cutover properly and run the two systems in parallel briefly so nothing falls through the cracks.

A Melbourne example

A construction firm in Box Hill we work with came to us split down the middle — the site teams lived in Gmail on their phones, while the office ran Excel-heavy estimating and project schedules that Sheets simply couldn’t handle. They’d been arguing about it for a year. We standardised them on Microsoft 365 because the desktop Office dependency was non-negotiable for their estimators, then used Teams to pull the field and office staff onto one platform. Had their work been browser-only, we’d have recommended Google and meant it.

That’s the point. TechAssist is a Melbourne-based MSP founded in 2014 with 13 Australian-employed engineers, and most of our client base runs Microsoft because that’s where desktop-heavy, compliance-driven Australian businesses tend to land. But the right answer is the one that fits how your people actually work, not the one your MSP is most comfortable supporting.

Frequently asked questions

Is Microsoft 365 more secure than Google Workspace?

Neither is inherently more secure — both are mature, well-defended platforms. The difference is control depth. Microsoft Entra ID and Defender offer more granular configuration, which helps in regulated or complex environments. Google’s simpler model means fewer settings to misconfigure, which suits smaller teams. Security comes from how you configure either platform, not the logo.

Can I run both Microsoft 365 and Google Workspace?

You can, and some businesses do — for example, Microsoft for email and Office, Google for a specific cloud tool. But running both means two sets of licences, two admin consoles and two security surfaces to manage. For most SMEs the overhead outweighs the benefit. Pick one as your primary platform.

Which is cheaper for a small Australian business?

Entry tiers are close — Microsoft 365 Business Basic and Google Business Starter sit within a few dollars of each other per user per month. The bigger cost is fit: paying for desktop Office you never use, or wrestling with Sheets when you need real Excel, costs far more than the licence-price gap.

How hard is it to migrate from Google to Microsoft?

Email migrates fairly cleanly; documents and shared-drive structures are where the work lives. Expect format conversion, permission rebuilding and user re-training. With a planned cutover and a short parallel-run period it’s very manageable — the mistake is doing it ad hoc without a migration plan.

Getting the decision right

If your business is lean, cloud-native and browser-first, Google Workspace is a strong, often better choice — and we’ll tell you so. If you’re desktop-heavy, running a Windows fleet, or carrying real compliance obligations, Microsoft 365 usually wins, and it’s where our Microsoft 365 support is built to add the most value with security and identity configured properly rather than left on defaults.

Not sure which way to jump? Get in touch and we’ll look at how your team actually works before recommending anything. No pressure to switch, and an honest answer either way.

Windows Autopilot is a Microsoft service that lets a brand-new laptop set itself up automatically the first time a staff member turns it on. The device ships from the vendor straight to the user, connects to your Microsoft tenant over the internet, and configures itself — no imaging, no SOE, no IT hands on it.

If onboarding a new hire still means a laptop landing on an engineer’s desk for a day of imaging, this is the fix. Below: what Autopilot does, how a device self-provisions, the moving parts, the deployment modes, the licensing, and where an MSP fits in.

What Windows Autopilot actually is

Autopilot is not an imaging tool — there is no gold image and no USB stick. It takes the standard Windows installation the manufacturer already put on the device and transforms it into your corporate build during the out-of-box experience (the setup screens a user sees on first boot). It runs on two Microsoft cloud services: Microsoft Entra ID (formerly Azure AD) handles identity and joins the device to your directory, and Microsoft Intune — the mobile device management (MDM) platform inside Microsoft 365 — pushes down your policies, apps, baselines and configuration. A machine the user has never touched arrives configured exactly like every other device in the business, enrolled, encrypted and ready to work.

The problem it solves: no more manual imaging or SOE

The traditional approach was the Standard Operating Environment: you built a master image, captured it, and re-applied it to every new or rebuilt machine. The costs add up. Devices have to be shipped to IT first, imaged, then re-shipped to the user — adding days and double the freight. The image goes stale the moment it is captured and needs constant rebuilding. And it does not scale: imaging a laptop for someone starting in a Dandenong warehouse means shipping it to your office or sending an engineer out.

Autopilot removes the imaging step entirely. The configuration lives in the cloud and is applied at first boot, so the same provisioning works whether the user is in your CBD office or at home in Ringwood.

How a device self-provisions on first login

The sequence when an Autopilot-registered device is unboxed:

1. The user powers on the laptop and connects to Wi-Fi or ethernet — internet access is the only prerequisite.
2. Windows checks in with Autopilot, recognises the device by its hardware identity, and pulls down the assigned profile, which customises the setup screens and applies your branding.
3. The user signs in with their Microsoft 365 work account; Entra ID authenticates them and joins the device to your directory.
4. Intune enrolment kicks off automatically, pulling down your configuration profiles, security baseline, certificates, Wi-Fi settings and assigned apps.
5. The Enrollment Status Page blocks the user from reaching the desktop until the mandatory apps and policies have landed.

When it finishes, the first person to log into that machine is the staff member it was bought for — not an engineer — at a fully managed, encrypted desktop.

The moving parts

Autopilot profiles

A profile is the deployment template you assign to a group of devices in Intune. It controls the out-of-box experience: which setup screens are hidden, whether the user becomes a local administrator or standard user, the deployment mode, the naming convention and your branding. Most businesses run one or two — a user-driven profile for staff laptops, sometimes a separate one for shared devices.

The Enrollment Status Page

The Enrollment Status Page (ESP) shows setup progress and gates access to the desktop until the apps and policies you mark mandatory have installed — so a new starter cannot begin work on a half-configured machine. Block on a slow or flaky app, though, and you leave users staring at a spinner; tuning it well is one of the fiddlier parts of the job.

Hardware hash and device registration

Autopilot identifies each device by a hardware hash — a unique fingerprint of its components — which must be registered against your tenant before first boot. With OEM / CSP registration, the hardware vendor or Cloud Solution Provider partner registers the hash to your tenant at purchase, so the device is Autopilot-ready before it leaves the warehouse — the clean path for volume orders. For devices you already own, manual hash collection exports the hash into Intune with a PowerShell script, but that means handling the device once. Build OEM or CSP registration into your procurement so hardware arrives pre-registered; that is what makes true drop-ship onboarding possible.

Deployment modes: user-driven vs self-deploying and kiosk

Autopilot supports several modes, depending on how the device will be used:

User-driven is what most growing teams use. Self-deploying and kiosk modes suit devices no single staff member owns — a reception terminal in a Hawthorn clinic, a warehouse scanning station — and need a TPM 2.0 chip, which any recent business device has.

Prerequisites: what you need before you start

Autopilot is not a standalone product — it is a capability on top of Microsoft 365. You need:

• Microsoft Entra ID for identity and device join — the standard directory in a Microsoft 365 business or enterprise subscription covers this, though some advanced enrolment options want Entra ID P1.
• Microsoft Intune licensing for the MDM management — included in Microsoft 365 Business Premium and the E3/E5 plans. On a cheaper plan you will need to add Intune first.
• Devices that ship with Windows 11 Pro or Enterprise — the Home edition cannot be managed this way.
• A configured tenant — your Intune profiles, security baselines, app deployments and ESP set up before the first device ships.

That last point is the one businesses underestimate: Autopilot delivers whatever you have built in Intune, so the value is in the policies and app packaging, not the provisioning trick itself. If you are reviewing your licensing, our Microsoft 365 support team can tell you whether your plan already covers what Autopilot needs.

Why this matters: fast onboarding and consistent security baselines

Two things drive most businesses to Autopilot. The first is onboarding speed: a drop-shipped self-provisioning laptop takes the engineer, the queue and the freight out of every hire. The second, and arguably more important, is consistent security baselines. Because every device is built from the same Intune configuration, every machine gets BitLocker encryption, the same firewall and account-protection policies, Defender, conditional access and patching automatically — no engineer remembering to tick a box. An enforced baseline across the fleet is exactly what the Essential Eight mitigation strategies expect, and the same Intune layer lets you wipe a lost device remotely the moment a laptop goes missing on a train at Box Hill — it pairs naturally with conditional access policies in Microsoft 365.

A Melbourne scenario

An engineering consultancy in Camberwell we work with was hiring two or three people a month and rebuilding laptops by hand each time — a machine couriered to their office, half a day of imaging, and a checklist someone occasionally skipped, so no two laptops were quite the same and a couple shipped without disk encryption on.

We stood up their Intune configuration, built a user-driven Autopilot profile with a tuned Enrollment Status Page, and arranged for new hardware to be registered at purchase. Now a laptop is drop-shipped to the new hire; they open the box, sign in, and an hour later are working on a fully configured, encrypted device identical to everyone else’s. Their office manager handles onboarding without touching a technical step, and the fleet has a uniform baseline at last.

The MSP role in setting it up

The provisioning is the easy part to demonstrate and the hard part to build well. The work an MSP does sits underneath what the user sees:

• Designing and hardening the Intune configuration — the compliance policies, configuration profiles, security baselines and app deployments every machine inherits — and packaging line-of-business apps to install silently during enrolment.
• Setting up the procurement pipeline so devices arrive Autopilot-ready, tuning the ESP, and integrating Autopilot with conditional access, encryption and your broader MDM strategy so device management is one coherent system.

TechAssist is a Melbourne MSP, founded in 2014, with thirteen Australian-employed engineers — so the people building your Intune environment are local, not offshore. We bundle this into our managed IT services, so device provisioning, patching and security baselines sit inside the fixed monthly per-user fee, not a per-device charge each time you hire.

Frequently asked questions

Do I need to wipe a new laptop before using Autopilot?

No. Autopilot works with the standard Windows installation the manufacturer ships and transforms it into your corporate configuration during first boot — there is no wiping or imaging step. Devices you already own can be reset and will provision on the next boot once registered.

What happens if there is no internet during setup?

Autopilot needs internet to reach Entra ID and Intune, so the device must connect to Wi-Fi or ethernet during the out-of-box experience. Until it does, the laptop sits at the network screen — which is why drop-ship onboarding assumes the user has working internet.

Is Autopilot the same as Intune?

No, but they work together. Intune is the management platform that holds your policies, apps and baselines; Autopilot hands a new device over to Intune at first boot. You need Intune licensing for Autopilot to do anything.

Where TechAssist fits

Autopilot looks like magic in a demo and falls over in practice if the Intune configuration behind it is thin — the provisioning is the visible part, but the policies, baselines and procurement pipeline are what make the fleet secure and consistent. If manual device setup is slowing your onboarding, get in touch and we will scope what your tenant needs.

Microsoft Defender for Business is Microsoft’s endpoint detection and response (EDR) product built specifically for small and mid-sized businesses. It bundles next-generation antivirus, EDR, threat and vulnerability management, attack surface reduction and automated investigation into one licence — enterprise-grade endpoint security at a price an SME can actually justify.

It is not the same as the free Defender that ships with Windows

This is the confusion we untangle most often. Every Windows 10 and Windows 11 machine already includes Microsoft Defender Antivirus — the free, built-in scanner that replaced the old Windows Defender. It is genuinely good antivirus. It catches known malware, runs real-time scanning, and for a home PC it is fine.

Microsoft Defender for Business is a different product that sits on top of that engine. The free antivirus protects a single device and tells that device about a threat. Defender for Business adds the layer enterprises pay for: it collects telemetry from every endpoint into a central portal, correlates suspicious behaviour across your fleet, hunts for attacker activity that signature-based antivirus never sees, and gives someone a console to investigate and respond. Antivirus asks “is this file bad?”. EDR asks “is something bad happening on this network right now, and how did it get in?”.

A small construction firm in Ringwood we onboarded last year had Defender Antivirus on every laptop and assumed they were covered. They were covered against commodity malware. They had no visibility into lateral movement, no record of what a compromised account did after a phishing click, and no way to isolate an infected machine remotely. That gap is exactly what Defender for Business fills.

How you get it: Business Premium or standalone

There are two ways to licence it. The first, and the one most Melbourne SMEs land on, is Microsoft 365 Business Premium. Defender for Business is included in that plan at no extra cost, alongside the Office apps, Exchange Online, Intune device management and conditional access. If you are already paying for Business Premium, you own Defender for Business whether or not anyone has switched it on — which, frustratingly often, nobody has.

The second is the standalone Defender for Business licence, sold per user per month for organisations that do not want the full Business Premium stack. It is capped at 300 users, in line with Microsoft’s SMB licensing ceiling. Above that you move into the enterprise Defender for Endpoint Plan 1 or Plan 2 tiers.

For most businesses under 300 staff, Business Premium is the better value because you get the security plus Intune, conditional access and the rest of the productivity suite for not much more than the standalone security licence alone. We cover what that plan actually includes in our guide to Microsoft 365 support in Melbourne, and we deploy it through our Microsoft 365 service.

What it actually does

Defender for Business is not a single feature — it is five capabilities working together. Here is what each one buys you in practice.

Next-generation antivirus

The same cloud-delivered protection as the enterprise product: behaviour-based detection, machine-learning models and near-instant cloud lookups, rather than just a local signature file. It blocks fileless attacks and never-before-seen malware that traditional antivirus misses, and it updates protection across your fleet from the cloud in minutes.

Endpoint detection and response (EDR)

This is the heart of it. Every endpoint reports process activity, network connections and file changes back to the Microsoft 365 Defender portal. When something looks like an attack — credential dumping, suspicious PowerShell, a process spawning where it shouldn’t — it raises an alert with the full chain of what happened. You can remotely isolate a device from the network, collect an investigation package, or stop and quarantine a file across every machine at once.

Threat and vulnerability management

It continuously inventories the software on your devices and flags known vulnerabilities and misconfigurations, ranked by real-world risk. Instead of guessing which of 40 outstanding updates matters, you get a prioritised list: this unpatched browser is being actively exploited, fix it first. This feeds directly into Essential Eight patching discipline.

Attack surface reduction

A set of rules that close the doors attackers walk through — blocking Office apps from spawning child processes, stopping credential theft from the Windows credential store, controlling which USB devices can mount, and filtering web content. These map almost one-to-one to the application control and macro restrictions in the Essential Eight.

Automated investigation and remediation

When an alert fires, Defender can automatically investigate it the way a junior analyst would — examining the affected device, determining whether the threat is real, and remediating low-risk detections without a human touching it. For a small team with no overnight security staff, this quietly handles a lot of the noise so the genuine incidents are the ones that reach a person.

Onboarding devices: Windows, macOS and mobile

Coverage is not Windows-only, which matters because most Melbourne SMEs run a mix. Windows 10 and 11 onboard cleanly through Intune or a local script and need no extra agent — the sensor is already in the operating system. macOS is supported with a downloadable agent, so the designer’s MacBook in the same office gets EDR too. iOS and Android are covered through the Defender app via Intune, mainly for web protection and phishing defence on phones that touch company email.

In a typical rollout we push the Windows configuration through Intune policy, deploy the macOS agent to the handful of Macs, and enrol mobiles through the company portal. Servers are worth noting: Defender for Business includes a server add-on (Defender for Business servers) licensed per server per month, so the Windows Server running your file shares or line-of-business app gets the same EDR coverage. We handle this fleet-wide as part of managed cybersecurity and managed IT services.

How it maps to the Essential Eight

The Australian Cyber Security Centre (ACSC) Essential Eight is the baseline most Australian SMEs are measured against, especially for cyber-insurance and government-adjacent work. Defender for Business does not deliver all eight on its own, but it directly supports several and gives you the evidence to prove it.

It does not cover multi-factor authentication, restricting administrative privileges, application allow-listing in full, or regular backups — those need Entra ID conditional access, Intune policy and a separate backup platform. For the full picture, see our Essential Eight compliance work. Defender for Business is a strong contributor to maturity, not a one-click compliance button.

The honest question: is it enough, or do you still need a SOC?

Here is the part most vendors skip. Defender for Business is excellent technology. It is also only as good as the person reading the alerts. The product will detect the ransomware operator moving through your network at 2am on a Sunday — but if nobody is watching the portal at 2am on a Sunday, the alert sits unread until Monday, by which point the damage is done.

This is the difference between having an EDR tool and having managed detection and response. The licence gives you the sensor and the console. It does not give you a human who triages alerts around the clock, escalates the real ones, and actually responds. For a 15-person firm, expecting your one IT-savvy staff member to monitor a security console alongside their day job is wishful thinking.

You have three realistic options. Watch it yourself, which works only if you have someone genuinely capable and available. Accept that alerts get reviewed during business hours and live with the overnight gap — defensible for lower-risk businesses, not for anyone holding sensitive client data. Or put it under managed detection and response, where a team monitors the telemetry 24/7. We dig into the distinctions between SIEM, MDR and EDR in our piece on managed cybersecurity services, and our security operations centre is how we close that monitoring gap for clients who need eyes on the alerts at all hours.

The blunt version: buying Defender for Business and switching it on is the right move for almost every SME. Believing that alone means you are protected is the mistake. A smoke detector that nobody can hear is decoration.

Frequently asked questions

Do I need Defender for Business if I already have Microsoft Defender Antivirus?

Yes, if you want real endpoint detection and response. The built-in antivirus protects individual devices against malware but gives you no central visibility, no investigation tools, no vulnerability management and no way to respond across your fleet. Defender for Business adds all of that. They work together — the antivirus is the foundation, Defender for Business is the security operations layer on top.

Is Defender for Business included in Microsoft 365 Business Premium?

Yes, at no additional cost. If you pay for Business Premium you already own it, even if it has never been configured. It is also sold as a standalone per-user licence for businesses that do not want the full Business Premium suite, capped at 300 users.

Will Defender for Business make me Essential Eight compliant?

No single product does that. It strongly supports patching, application control, macro settings and user application hardening, and it produces evidence for assessments. But you still need multi-factor authentication, restricted admin privileges and tested backups from other tools to reach a defensible Essential Eight maturity level.

Can it protect Macs and phones, not just Windows?

Yes. macOS is supported with a dedicated agent, and iOS and Android are covered through the Defender mobile app deployed via Intune, mainly for web and phishing protection. There is also a per-server add-on for Windows Server. A mixed fleet can be fully covered under one approach.

Do I still need a managed SOC if I have Defender for Business?

It depends on who watches the alerts. The tool detects threats brilliantly but does nothing on its own about an alert raised overnight or on a weekend. If you do not have someone monitoring the console around the clock, managed detection and response fills that gap. For most SMEs with sensitive data, that monitoring is what turns the licence into actual protection.

The short version

Microsoft Defender for Business gives Melbourne SMEs the same class of endpoint security that large enterprises run — next-gen antivirus, EDR, vulnerability management, attack surface reduction and automated investigation — included free with Microsoft 365 Business Premium or available standalone. It is a genuinely strong product and an easy decision to deploy. The catch is that the technology only protects you if someone acts on what it finds. As a Melbourne-based MSP with 13 Australian-employed engineers and a 24/7 NOC in Tecoma, that is the half we handle. If you are paying for Business Premium and have never switched the security on, or you are not sure anyone is watching the alerts, get in touch and we will tell you straight where you stand.

Microsoft Entra ID is Microsoft’s cloud identity and access management service — the system that decides who can sign in to your Microsoft 365 tenant and what they can reach once they do. It is the new name for Azure Active Directory, renamed in 2023. The technology underneath did not change; the label did.

If you run a business on Microsoft 365, you already use Entra ID every day, whether you know the name or not. Every login to Outlook, Teams, SharePoint and OneDrive is authenticated by it. It is also, increasingly, the single most important security control you own. This post explains what it actually is, what the licensing tiers unlock, and why identity has quietly become the perimeter you most need to defend.

The rename: Azure AD became Microsoft Entra ID in 2023

In July 2023, Microsoft renamed Azure Active Directory to Microsoft Entra ID. The product, the APIs, the sign-in URLs, the licences — all of it kept working. Service plan names like “Azure Active Directory Premium P1” were rebadged as “Microsoft Entra ID P1”, but your existing subscriptions carried across without action. Microsoft folded the identity product into a broader family called Microsoft Entra, which also covers Entra Permissions Management, Entra Verified ID and Entra Internet Access.

One point of confusion worth clearing up: Entra ID is not the same thing as the on-premises Active Directory you might run on a Windows Server domain controller. On-prem AD (the one with domains, organisational units and Group Policy) still exists and still carries the Active Directory name. Entra ID is the cloud directory behind Microsoft 365. Many businesses run both and synchronise between them using Entra Connect. So when someone says “we got rid of AD”, ask which one they mean — they almost certainly still have Entra ID.

What Microsoft Entra ID actually is

At its core, Entra ID is a directory and an authentication engine. It holds the identities for your organisation and brokers access to applications. Strip away the marketing and there are a few building blocks worth understanding.

Users and groups

Every staff member has a user object — their account, their email, their licence assignments, their sign-in history. Groups bundle users together so you can assign licences, app access and policies in bulk rather than one person at a time. Security groups control access; Microsoft 365 groups also create a shared mailbox, calendar and SharePoint site. Getting your group structure right early saves a lot of pain later, because almost everything else hangs off it.

App registrations and single sign-on

Entra ID is also where third-party applications connect to your tenant. When you sign in to Xero, Canva or a line-of-business app using your Microsoft account, that app is registered against Entra ID and trusts it to verify who you are. This is single sign-on (SSO): one identity, one set of credentials, one place to enforce policy. SSO is not just convenient — it is a security win, because it means staff are not inventing weak passwords across a dozen separate logins, and you can cut access to everything by disabling one account when someone leaves.

Conditional Access and MFA

This is where Entra ID stops being plumbing and becomes a genuine security tool. Multi-factor authentication (MFA) requires a second proof of identity — typically an approval in the Microsoft Authenticator app — on top of the password. Conditional Access is the policy engine that decides when to demand it. You can require MFA for all users, block sign-ins from outside Australia, force a compliant device for admin accounts, or step up authentication when a login looks risky.

We have written a full walkthrough on Conditional Access policies in Microsoft 365, so we will not repeat it all here. The short version: Conditional Access is the difference between MFA being a blanket annoyance and being a targeted, risk-aware control. It is the single highest-value thing most Melbourne SMEs can turn on.

Security defaults versus Conditional Access

Microsoft offers two ways to enforce baseline identity security, and the distinction matters.

Security defaults are a free, all-or-nothing switch available to every tenant. Turn them on and Microsoft enforces MFA for all users, requires it for admins, and blocks legacy authentication protocols that bypass MFA entirely. For a very small business with no internal IT, security defaults are far better than nothing and should be enabled if you have nothing else.

The catch is that they are rigid. You cannot exclude a service account, you cannot vary policy by location or device, and you cannot tune the risk thresholds. The moment you need that flexibility — and most businesses do once they grow past a handful of staff — you move to Conditional Access, which requires Entra ID P1 or higher. You cannot run both at once: enabling Conditional Access means switching security defaults off.

Entra ID P1 and P2 licensing

Most of the security value lives behind paid licences. Entra ID comes in a free tier (bundled with any Microsoft 365 subscription), plus two paid plans: P1 and P2. P1 is included in Microsoft 365 Business Premium, which is the plan we steer most clients towards. P2 is included in the larger enterprise E5 suites or can be bought as an add-on.

What P1 unlocks

P1 is the workhorse tier. It gives you Conditional Access, self-service password reset that writes back to on-prem AD, group-based licence assignment, and the ability to enforce device compliance. For the overwhelming majority of Melbourne SMEs, P1 — via Business Premium — is the right baseline.

What P2 adds

P2 includes everything in P1 and layers on the more advanced controls:

• Identity Protection — machine-learning detection of risky sign-ins and compromised accounts, feeding risk signals into Conditional Access so you can automatically force a password reset or block a suspicious login.
• Privileged Identity Management (PIM) — just-in-time, time-limited access to admin roles. Instead of leaving five people as permanent Global Administrators, they request elevation when needed, it expires automatically, and every activation is logged and approvable.
• Access reviews — scheduled recertification so access does not quietly accumulate over years.

PIM alone is a strong reason for any business with multiple administrators to consider P2. Standing admin rights are one of the most common findings we see in security assessments.

Why identity is the new perimeter for SMEs

The old model of security assumed a hard outer wall — a firewall at the office, with everything inside it trusted. That model died when work moved to the cloud and to homes across the metro. Your data now lives in Microsoft 365, accessed from laptops, phones and home networks that your firewall never sees. The only thing standing between an attacker and your email, files and finance system is whether they can prove they are an authorised user. That proof is identity, and Entra ID is where it is enforced.

This is why attackers no longer bother breaking through walls — they log in. Credential theft, phishing and token replay are the dominant intrusion methods against Australian SMEs precisely because a valid login bypasses everything else. The Australian Cyber Security Centre (ACSC) puts multi-factor authentication front and centre in its guidance for exactly this reason.

A real-world shape of the problem: a manufacturing business in Dandenong we work with had MFA switched on for office staff but had quietly left it off for a shared accounts-payable mailbox, because “it was easier”. That mailbox was the one an attacker phished, and from it they sat reading invoice threads for a fortnight before attempting a payment redirection. Nothing was breached at the network layer. The gap was an identity exception nobody had reviewed. Conditional Access with no carve-outs, plus PIM on the admin accounts, would have closed it.

How Entra ID maps to the Essential Eight

The Essential Eight is the ACSC’s baseline of eight mitigation strategies, and two of them are pure identity controls that Entra ID delivers directly.

Multi-factor authentication is one of the eight outright. Entra ID with Conditional Access is the standard way Australian businesses meet it for Microsoft 365 and connected apps. Restrict administrative privileges is another, and this is where PIM earns its keep — just-in-time elevation and access reviews are precisely what the maturity levels ask for as you move up from Maturity Level One. Entra ID also contributes to the broader picture through sign-in logging and audit trails that support detection and response.

If Essential Eight alignment is on your radar — and for any business touching government contracts or cyber insurance it should be — Entra ID configuration is a large part of the work. Our Essential Eight compliance service treats identity hardening as the first thing to fix, because it is the cheapest, fastest control with the largest blast-radius reduction.

Getting it right

Entra ID ships with sane-ish defaults, but “switched on” and “configured properly” are different things. The common failures we see across Melbourne tenants are predictable: MFA with too many exclusions, legacy authentication still enabled, no Conditional Access despite paying for P1, Global Administrator handed out like sweets, and break-glass accounts that either do not exist or are not protected. Each of these is a quiet open door.

TechAssist is a Melbourne-based MSP, founded in 2014, with thirteen Australian-employed engineers and a 24/7 NOC in Tecoma. We run Microsoft 365 and Entra ID hardening as standard onboarding for managed clients, because identity is the control that prevents the largest category of incidents we are called to clean up. Per-user fixed monthly pricing means this work is in scope, not a surprise invoice.

Frequently asked questions

Is Microsoft Entra ID free?

There is a free tier bundled with every Microsoft 365 subscription, which covers basic users, groups and SSO. The security controls most businesses need — Conditional Access (P1), and Identity Protection and PIM (P2) — require paid licences. P1 is included in Microsoft 365 Business Premium, which is what we recommend for most SMEs.

Do I still need on-premises Active Directory?

It depends. Many businesses have moved entirely to the cloud and run Entra ID alone. Others keep on-prem AD for legacy applications or file servers and synchronise it to Entra ID with Entra Connect. There is no requirement to keep on-prem AD if nothing depends on it, and removing it can simplify management considerably.

What happened to my Azure AD settings after the rename?

Nothing broke. The rename in 2023 was cosmetic at the product level — your policies, users, app registrations and licences all carried across. The portal now refers to Microsoft Entra ID and some menus moved, but no reconfiguration was required.

Should I use security defaults or Conditional Access?

If you have no internal IT and no Entra ID P1 licences, enable security defaults today — it is far better than nothing. Once you have P1 (via Business Premium) and need to handle service accounts, location rules or device compliance, move to Conditional Access. You cannot run both simultaneously.

Talk to us about identity

Identity is the control most worth getting right and the one most commonly left half-configured. If you are not sure what your tenant is actually enforcing, our Microsoft 365 and cybersecurity teams can audit your Entra ID setup, close the gaps and align it to the Essential Eight. Get in touch and we will tell you plainly where you stand.

A SharePoint intranet is a set of SharePoint Online sites — built on the licence you already pay for in Microsoft 365 — that gives staff one place for news, policies, documents and people. Build it around how people actually work and they use it daily. Build it as a digital filing cabinet and it dies.

Most Melbourne businesses already own SharePoint and don’t realise it. If you have Microsoft 365 Business Standard or Business Premium, the intranet platform is sitting there, unused, while staff email each other PDFs and hunt through a network drive nobody has tidied since 2019. The technology is rarely the problem. The decisions you make before you build it are.

What a modern SharePoint Online intranet actually is

Forget the old picture of a clunky 2010-era SharePoint server. The modern version runs entirely in the cloud, looks like a clean website, works on a phone, and is made of three building blocks: communication sites, team sites and hub sites. You assemble those into an intranet rather than installing a single “intranet product”.

The point of the thing is to answer the questions staff ask all day: where’s the current leave policy, who do I call in accounts, what’s the new client onboarding process, has anything changed this week. When those answers live in one searchable place that people trust, you stop losing hours to “do you know where the…” messages.

Communication sites versus team sites

This is the first decision that trips people up, so get it straight early. The two site types do different jobs.

In plain terms: your intranet’s front door and its polished, company-wide pages are communication sites. The messy day-to-day work — drafts, working documents, a project’s files — happens in team sites, which are the same thing that gets created every time someone makes a new team in Microsoft Teams. Most organisations need a handful of communication sites and a growing number of team sites.

Hub sites tie it together

On their own, a dozen separate sites are just a dozen separate sites. A hub site is what makes them feel like one intranet. You designate a site as a hub, then associate other sites with it, and they inherit shared navigation, a consistent look, and rolled-up news and search across everything connected.

A practical structure for a mid-sized business: one hub as the company intranet home, with the HR, IT, Operations and Sales sites associated to it. Staff get one top navigation bar across the lot, news from any connected site surfaces on the home page, and search spans the whole hub. You can re-associate sites later, so the structure isn’t a one-way door — but planning it up front saves a painful reorganisation six months in.

The pieces staff care about

An intranet earns its keep through a few core features. None of them are exotic; the difference is whether they’re set up deliberately or thrown together.

• News — SharePoint News posts are how you communicate. A short post about a policy change or a new starter beats an all-staff email nobody reads, and it stays findable afterwards.
• Document libraries — where files live, with version history, check-out, and metadata so you can filter and sort rather than scroll. This is what replaces the network drive.
• Policies — a single authoritative home for the employee handbook, the leave policy, the WHS documents. One current version, not eleven copies in eleven inboxes.
• Staff directory — pulled from your Microsoft 365 user accounts, so people can find who does what and how to reach them.

Integration with Teams and Viva Connections

This is where SharePoint stops being a website you have to remember to visit. Every Microsoft Teams team is already backed by a SharePoint team site — the Files tab in any channel is a SharePoint document library. So your collaboration sites are reachable without leaving Teams, where most staff already spend their day.

Viva Connections takes it further: it surfaces your intranet home page, news and resources directly inside Teams as an app, on desktop and mobile. For frontline and on-the-go staff who never open a browser, that’s often the difference between an intranet they see and one they forget exists. If you’re already invested in the Microsoft stack, our Microsoft 365 support covers wiring these pieces together so the intranet meets staff where they work rather than asking them to come to it. For a fuller picture of what the platform includes, our rundown of what Microsoft 365 support covers is a useful companion read.

The decisions that make or break adoption

Information architecture is the unglamorous part everyone skips, and it’s the part that decides whether the intranet works. Information architecture means how you structure and name things so people find them without thinking.

The mistakes are predictable. Folder structures fifteen levels deep that mirror the old network drive. Navigation built around your org chart instead of around tasks — staff don’t think “I need the People & Culture division’s content”, they think “where’s the leave form”. Twenty different document libraries with no naming convention. Search left to fend for itself with no metadata to work with.

Get the architecture right and the platform does the rest. The questions worth arguing about before you build anything are: what are the ten things staff look for most, what should the top navigation be, what’s a hub and what’s associated to it, and how do you name and tag documents consistently. An hour of disagreement in a planning meeting saves a rebuild later.

Permissions and governance

The fastest way to ruin a SharePoint intranet is to let permissions sprawl. Out of the box it’s easy to share a file or site with one person, then another, until nobody can tell who can see what — and a staff directory or HR site with leaky permissions is a privacy problem, not just a tidiness one.

The disciplined approach is to manage access through Microsoft 365 Groups and security groups rather than one-off shares, keep company-wide content readable by everyone and editable by few, and set a clear policy on who can create new sites. Left unchecked, “anyone can spin up a team” produces hundreds of orphaned sites within a year. Governance also means deciding retention, external sharing rules, and a content owner for each site so pages don’t go stale. Conditional access policies sit underneath all of this, controlling who can reach the intranet, from which devices, and under what conditions — important when the same platform holds your policies and your client files. This kind of structure is part of broader cybersecurity hygiene, not an optional extra.

Migrating off file servers and network drives

Most intranet projects are also a migration off an ageing file server or a mapped network drive, and that’s where the real effort lives. You don’t just copy files across — you decide what comes, what gets archived, and how it’s structured on the other side.

A law firm in Hawthorn we work with had a 600GB shared drive built up over a decade, with matter folders, duplicates, and files three people swore were the master copy. The temptation is to lift-and-shift the whole thing into SharePoint and call it done. That just moves the mess to a new address. We sorted what was still live, archived closed matters, agreed a folder and metadata structure that matched how the firm actually worked, then migrated in stages so nobody lost access mid-week. The migration tooling matters — SharePoint has document size and path-length limits the old drive didn’t — and so does timing it around the firm’s quieter periods.

If your file server is also your backup and disaster-recovery weak point, moving to SharePoint changes that equation too — though “it’s in the cloud” still isn’t a backup strategy, which is why our backup and recovery approach covers Microsoft 365 data as well.

Why “build it and they won’t come” happens

The most common SharePoint outcome in Australian SMEs is an intranet that was built with enthusiasm, launched with an email, and abandoned within two months. It happens for clear reasons: nobody owned the content so it went stale, the structure mirrored the org chart instead of staff tasks, the launch was a one-off announcement with no follow-through, and leadership didn’t use it themselves.

Driving adoption is mostly non-technical. Put the things people need daily — the leave form, the phone list, this week’s news — on the front page so there’s a reason to visit. Move a real workflow onto it, like leave requests or IT support requests, so people have to use it. Surface it in Teams via Viva Connections so they don’t have to remember a URL. Name content owners who keep their corner current. And get the leadership team posting news, because staff follow what management actually uses. An intranet that’s the easiest path to the answer wins; one that’s a chore loses.

Realistic effort

Setting up a basic intranet — a home site, a few hub-connected sites, news and document libraries — is days, not months, for someone who knows the platform. The work that takes time is the thinking: the information architecture, the permissions model, the migration off the old drive, and the change management to get people using it. A sensible mid-sized rollout runs over several weeks, with a planning phase, a build, a staged migration, and a launch backed by training rather than an email. Trying to compress all of that into a weekend is exactly how you end up with the abandoned version.

Frequently asked questions

Do we need extra licences to build a SharePoint intranet?

Usually no. SharePoint Online is included in Microsoft 365 Business Standard, Business Premium and most enterprise plans, and Viva Connections is included as well. If you already run Microsoft 365 for email and Teams, you almost certainly have everything you need to build the intranet on your existing licences.

What’s the difference between SharePoint and Teams?

They’re two views of the same data. Teams is where you chat and meet; SharePoint stores the files and pages behind it. Every Teams team has a SharePoint site underneath, and the Files tab in a channel is a SharePoint document library. An intranet adds the company-wide communication sites and hubs on top.

How do we stop the intranet becoming a mess of duplicate files?

Agree a structure and naming convention before you migrate, use metadata and search rather than deep folders, manage permissions through groups, and control who can create new sites. The discipline is in governance and information architecture, not in the platform itself.

Can staff access the intranet on their phones?

Yes. SharePoint sites are mobile-responsive, and Viva Connections puts your intranet home page, news and resources inside the Teams mobile app — which is how frontline and on-the-go staff actually reach it, since most never open a browser at work.

Getting it built properly

A SharePoint intranet is one of the best-value things you can do with Microsoft 365, because the licence is already paid for and the payoff — less time hunting for documents, one source of truth for policies, cleaner communication — compounds. The risk is doing it without the architecture, permissions and adoption work, and ending up with abandoned space. TechAssist is a Melbourne-based MSP, founded in 2014, with 13 Australian-employed engineers — no offshore helpdesk — and per-user fixed pricing, so a project like this is scoped properly rather than billed by the hour. If you’d like to turn the SharePoint you already own into something staff actually use, explore our cloud services or get in touch for a straight conversation about it.