The Microsoft 365 you already pay for and do not use

Most small businesses I visit pay for Microsoft 365 and use it as email, Word and Excel.

That is roughly a third of what the subscription includes. The rest is sitting there, already paid for, solving problems the business is currently solving badly or not at all.

Here is what is in there and what is genuinely worth the effort.

Shared files that do not live on one person’s laptop

SharePoint and Teams files. Almost every small business has the same problem: important documents live on individual computers, get emailed around, and exist in six versions with nobody certain which is current.

Moving shared files into SharePoint fixes this. One copy, everybody sees the same version, edits happen live, version history goes back months, and it keeps working when somebody’s laptop dies or somebody leaves.

This is the single highest-value thing on the list and it is the one most often ignored, usually because moving files feels disruptive. It takes an afternoon.

OneDrive is the personal equivalent, for a person’s own working files. Worth setting up so that Desktop and Documents are backed up automatically.

Important: sync is not backup. OneDrive protects you from a dead laptop, not from a file being deleted, overwritten or encrypted, because that change syncs too. See is your backup actually working.

Teams, used properly

Most businesses use Teams for video calls and continue to run everything else through email.

The genuine value is in channels: one place per project or per topic where the conversation and the relevant files sit together, visible to everybody who needs them. It removes an enormous amount of internal email and it means a new staff member can read back rather than asking.

Forms

Free, included, and almost nobody knows it exists.

Booking requests, staff leave forms, customer feedback, incident reports, safety checklists. Build a form in ten minutes, send a link, and answers arrive in a spreadsheet automatically.

Businesses routinely pay for a separate service to do this, or do it on paper.

Power Automate

Simple automation between things you already use.

A form submission creating a task. An email with an attachment saving it to the right folder automatically. A reminder when something has not been actioned.

You do not need a developer for the straightforward ones. This is where the tedious repeated admin goes to die.

Bookings

If clients book appointments with you, this is included in many plans and does the job perfectly well: a public booking page, calendar integration, automatic confirmations and reminders.

Businesses commonly pay a monthly fee for a separate booking service they already have.

Planner and To Do

Shared task lists. Unglamorous, and better than the whiteboard and the group chat that most small teams actually run on.

The security settings that matter

These are the ones I would check first in any business, and they are frequently switched off.

Multi-factor authentication on every account. The single most effective control available, and business email compromise is the most common way Australian small businesses lose money. Somebody gets into an email account, watches for an invoice, and changes the bank details. MFA stops nearly all of it.

Check who has administrator access. Frequently it is a former IT provider, a staff member who left, or everybody.

Review external sharing settings on SharePoint and OneDrive, which are often more open than the owner realises.

Turn on audit logging, so that if something does happen you can find out what.

What is not included

Worth being clear about, because it is widely misunderstood.

Microsoft 365 is not a backup service. Retention for deleted mail and files is limited and shorter than most people assume. If you would be in trouble losing a year of email, you need a third-party backup for it. Microsoft says this themselves in their shared responsibility model, and almost nobody reads it.

Which plan you are on

Check before assuming any of this is available. Business Basic, Business Standard and Business Premium include different things, and Premium adds meaningful security and device management.

A lot of businesses are on the wrong plan in both directions: paying for Premium and using none of it, or on Basic and missing the desktop applications they thought they had.

Where to start

If you do one thing: turn on multi-factor authentication for everyone. It takes an afternoon and it is the control that prevents the most expensive thing that happens to small businesses.

If you do two: move shared files into SharePoint and stop emailing documents around.

Both are included in what you already pay for.

If you would rather have somebody go through it

Working out what your plan includes, what is switched off that should be on, and training the team to actually use it is usually a session or two.

I have nothing to sell you, no licences to resell and no ongoing contract. Details on the small business page.