Introduction
Microsoft 365 looks deceptively simple from the outside. You create a user, assign a license, and give them access to Outlook, Teams, and OneDrive.
However, managing Microsoft 365 in a real business environment is far more complex than the initial setup suggests.
IT administrators have to balance security, licensing costs, user productivity, data management, file migrations, and compliance—all while making sure employees can actually get their work done.
After managing Microsoft 365 in a real business environment, I’ve learned that keeping the tenant running smoothly requires much more than simply creating accounts and assigning licenses.
Here are seven areas I focus on when managing Microsoft 365.
1. Identity, Access, and License Audits
Everything in Microsoft 365 starts with identity.
Microsoft Entra ID, formerly known as Azure Active Directory, controls much of how users authenticate and access Microsoft 365 services.
Authentication and MFA
One of the first security controls I consider essential is Multi-Factor Authentication (MFA).
Passwords alone are no longer enough to protect business accounts. MFA adds another layer of protection if a user’s password is compromised.
Of course, MFA is only one part of identity security. Conditional Access policies, device compliance, privileged account management, and regular access reviews can all play an important role depending on the organization’s requirements.
License Management
Microsoft 365 licensing can also become a significant cost if it isn’t reviewed regularly.
For example, premium products such as Visio or Project can be assigned to users who may no longer need them.
Regularly reviewing Microsoft 365 Admin Center → Reports → Usage can help identify unused services and licenses.
When employees leave the company, their accounts and licenses also need to be handled properly. Removing unnecessary licenses and reviewing inactive accounts can help prevent the IT budget from slowly increasing without providing additional value.
For larger organizations, even a small amount of unused licensing can become a significant annual expense.
2. Microsoft 365 Is Much More Than Outlook
Many users think of Microsoft 365 primarily as Outlook and Office.
In reality, Microsoft 365 is a deeply interconnected ecosystem.
Exchange Online handles email, SharePoint provides collaboration and document management, OneDrive provides personal cloud storage, Teams brings communication and collaboration together, and Microsoft Entra ID provides the identity layer behind many of these services.
Changes in one area can affect another.
For example, changing SharePoint permissions can affect Teams file access, while changes to a user’s identity or license can affect multiple Microsoft 365 services.
For an IT administrator, understanding how these services connect is just as important as knowing how to configure each individual product.
3. OneDrive vs. SharePoint: Where Should Company Files Live?
One of the most common questions I encounter is:
“Why can’t we just put everything in OneDrive?”
The answer comes down to ownership and collaboration.
OneDrive for Business
OneDrive is primarily designed for an individual’s work files.
It’s a good place for:
- Personal working documents
- Drafts
- Temporary files
- Individual notes
- Files that are primarily owned and managed by one person
SharePoint Online
SharePoint is better suited for files that belong to a team, department, or organization.
It’s designed for:
- Departmental documents
- Shared company files
- Team collaboration
- Centralized document management
- Controlled access to business information
My general rule is simple:
If multiple people need long-term access to a document, it should generally live in SharePoint rather than an individual’s OneDrive.
This makes ownership, permissions, and employee offboarding much easier to manage.
4. Moving Away From Traditional File Servers
Many businesses still rely on traditional Windows file servers and mapped network drives.
Moving suitable file shares to SharePoint Online can significantly change how employees access and collaborate on documents, but the migration itself needs to be planned carefully.
Avoid Simple Drag-and-Drop Migrations
For a small number of files, uploading through a browser might be perfectly fine.
For thousands of files and complex folder structures, however, browser-based uploads can become difficult to manage.
If something fails during a large upload, it can also be difficult to determine exactly which files were transferred successfully.
Use the SharePoint Migration Tool
For larger migrations, I prefer using Microsoft’s SharePoint Migration Tool (SPMT) rather than relying on browser uploads.
SPMT provides migration reports and logs that make it easier to identify errors and verify that the migration completed successfully.
It also gives IT administrators a more structured approach to moving large amounts of data from traditional file servers into SharePoint Online.
A migration is not simply about copying files. Permissions, folder structures, file names, metadata, unsupported characters, and user expectations all need to be considered before shutting down the old file server.
One of the areas where Microsoft 365 can make a significant difference is moving away from traditional file servers and network drives. I’ve experienced this transition firsthand, and you can read more about the process in [SharePoint vs. Traditional File Servers: What I’ve Learned From Migrating Company Files].https://aussiekim.com/sharepoint-vs-traditional-file-servers/
5. Security and Restricted External Collaboration
Cloud storage makes sharing files incredibly easy.
That is one of Microsoft 365’s biggest advantages—but it can also become a security risk if external sharing isn’t controlled.
Instead of allowing unrestricted external sharing, organizations should consider limiting collaboration to trusted external organizations and domains where appropriate.
For example, Microsoft Entra ID and Microsoft 365 provide various controls that can be used to manage external collaboration and guest access.
The exact configuration will depend on the organization’s security requirements, but the principle is straightforward:
Users should have access to the information they need, while unnecessary access should be restricted.
This is the principle of least privilege.
Security also needs to be reviewed when an employee changes roles or leaves the organization. Access that was appropriate six months ago may no longer be appropriate today.
6. SaaS Backup Is Still Important
One of the biggest misconceptions about Microsoft 365 is that Microsoft automatically provides a complete backup of all business data.
Microsoft provides a highly resilient cloud platform and has extensive capabilities for service availability and data protection. However, organizations still need to consider their own requirements for backup, retention, recovery, and accidental deletion.
This is where third-party SaaS backup can provide an additional layer of protection.
In our environment, we use Veeam Data Cloud to back up Microsoft 365 data such as Exchange Online mailboxes, OneDrive, and SharePoint.
Having a separate backup solution gives IT another recovery option when data is accidentally deleted or needs to be restored.
The important lesson is that availability is not the same thing as backup.
Microsoft 365 may be a cloud service, but businesses still need to think about how they would recover their data if something went wrong.
7. Managing the Devices Accessing Microsoft 365
Managing identities and cloud data is only part of the job.
You also need to manage the devices accessing that data.
This is where Microsoft Intune becomes an important part of a modern Microsoft 365 environment.
Intune can be used to help organizations:
- Manage Windows devices
- Deploy applications
- Configure security policies
- Enforce device compliance
- Manage operating system updates
- Apply configuration policies
- Remotely wipe lost or stolen devices
The exact Intune configuration will vary depending on the organization.
In my environment, Intune is part of the broader device management strategy alongside Microsoft Entra ID and existing Windows management technologies.
I’ll cover how I use Intune to manage Windows devices in a separate post.
(Update : I’ve published a detailed follow-up guide ! Check out my post on https://aussiekim.com/microsoft-intune-device-management/ to see our exact enrollment and policy setup.)
Conclusion
Managing Microsoft 365 effectively goes far beyond creating users and assigning licenses.
A well-managed Microsoft 365 environment requires ongoing attention to identity, licensing, collaboration, security, data migration, backup, and endpoint management.
Tools such as Microsoft Entra ID, SharePoint Migration Tool, Microsoft Intune, and Veeam Data Cloud can each solve different parts of the problem, but the real challenge is making all of these components work together.
For me, the biggest lesson is that Microsoft 365 should be treated as an IT platform, not simply a collection of Office applications.
The more an organization relies on Microsoft 365, the more important proper administration, security, and data management become.
Leave a Reply