Microsoft 365 support

Microsoft 365 support is the hands on administration of your organization’s email, Teams, SharePoint and OneDrive: setting them up, moving data in, sizing licences, adding and removing people, and keeping sharing and sign in settings sensible. Microsoft runs the service itself, but the configuration of your tenant, who can see what, and whether your data is backed up are your organization’s responsibility. This page is for office managers, owners and operations leads who want that work done properly and written down. Canada Create is a Toronto agency serving organizations across Canada.

Contents

• What Microsoft 365 support covers
• Setup and migration of email, Teams, SharePoint and OneDrive
• Licences right sized
• Joiners, leavers, shared mailboxes and calendars
• SharePoint structure, permissions and external sharing
• MFA and conditional access
• SPF, DKIM and DMARC in plain words
• Backing up Microsoft 365 data
• Copilot readiness and data permissions
• Everyday admin requests and the tenant record
• Privacy obligations and Canadian data regions
• How we work on your tenant
• What Microsoft 365 support costs
• Choosing a Microsoft 365 partner and your next step

What Microsoft 365 support covers

Many organizations bought Microsoft 365 one mailbox at a time. A founder set up the first account, a bookkeeper added two more, someone created a Teams channel for every project, and files ended up spread across personal OneDrive folders, an old file server and email attachments. Nothing is broken exactly, but nobody can say who has access to the client folder, why there are three unused licences or whether the departed sales manager can still sign in.

Microsoft’s part and your part

Microsoft keeps the platform available, patches the underlying service and provides the admin tools. Your organization decides how those tools are set: which users exist, which licences they hold, which sites they can open, whether outsiders can receive shared links, how people prove who they are at sign in, and whether a separate copy of your data exists. Microsoft 365 support is the work of making those decisions deliberately and keeping them current.

Who usually asks for it

Office managers asking for “Office 365 support” are usually tired of being the accidental administrator. Owners want to know they are not paying for licences nobody uses. Finance leads want someone to explain the admin bill. Firms answering an insurer’s or client’s security questionnaire find they cannot answer questions about MFA or external sharing without help.

Setup and migration of email, Teams, SharePoint and OneDrive

A move into Microsoft 365, or a cleanup of a tenant that grew without a plan, works well when mail, files and collaboration are planned together.

Moving email

Email migrations come from older hosted mail, another productivity suite, or a server in the back room. The work covers copying existing mailboxes, contacts and calendars, switching the domain’s mail records at a planned moment, reconnecting phones and desktop mail apps, and checking that shared addresses such as info@ or orders@ still arrive where staff expect. Staff should get a short note before the switch explaining what will look different on their first morning.

Moving files into SharePoint and OneDrive

A common mistake is copying an old shared drive into one giant SharePoint library. A better approach is to sort files first: personal working files go to each person’s OneDrive, team and client files go to SharePoint sites organized by department or client group, and archive material goes to a clearly labelled archive site with tighter access. Folder paths that were deep on the old server often need flattening because long paths cause sync trouble.

Setting up Teams with intent

Teams becomes cluttered quickly when every conversation spawns a new team. A short plan for which teams exist, who creates new ones, how channels are named and what happens to a team when a project ends keeps the sidebar useful. Each team is connected to a SharePoint site, so Teams decisions are also file permission decisions.

Licences right sized

Microsoft offers several business plans with different features, and organizations often end up with a mix that no longer matches how people work. A licence review lines up each person’s role with what that role actually needs.

Common findings

• Licences still assigned to people who left months ago.
• Staff on a premium plan who only use email and the web apps, and others on a basic plan who need desktop apps or device management features.
• Separate mailboxes for roles like reception or accounts payable that would work better as shared mailboxes.
• Add on subscriptions bought for a single project and never removed.

Who pays whom

Licences are paid to Microsoft or to the licensing partner your organization buys through, and they appear separately from our support fees. We recommend the licensing account sits in your organization’s name with billing visible to your finance lead, so you can see each seat and adjust the count when headcount changes.

Joiners, leavers, shared mailboxes and calendars

The daily rhythm of Microsoft 365 support is people arriving, changing roles and departing. Doing these steps the same way every time prevents most access problems.

A new person’s first morning

A written onboarding checklist covers the account, the right licence, membership in the correct groups and teams, access to the SharePoint sites for their department, mailbox signature, MFA enrolment and a short welcome note on where files live. The manager requests the account through one channel and confirms the role, so access matches the job rather than copying whatever the last hire had.

When someone leaves

Offboarding is where tenants go wrong. The departing person’s sign in is blocked on their last day, their phone sessions are signed out, their mailbox is either converted for a colleague to monitor or kept for a period the owner decides, their OneDrive files are moved to a manager or a team site, their licence is removed once data is safe, and any external sharing links they created are reviewed. A record of who did what and when goes into the tenant documentation.

Shared mailboxes and room calendars

Addresses like bookings@ or support@ belong in shared mailboxes that several staff can open, with permissions given to groups rather than individuals. Meeting rooms, company vehicles and loaner laptops can have their own bookable calendars so people stop double booking the boardroom. These are small setups that remove daily friction for a front office.

SharePoint structure, permissions and external sharing

File access is the part of Microsoft 365 many owners worry about and least often review. The goal is that staff can find and share what they need while confidential material stays with the right group.

Site structure that mirrors the organization

A simple pattern works for many offices: one site per department or practice group, a separate site for leadership and finance, and per client or per project sites only where outside collaboration is needed. Permissions are granted to groups, not to individual names scattered across hundreds of folders.

External sharing settings

Microsoft 365 lets you choose whether staff can share files with anyone holding a link, only with signed in guests, or not outside the organization at all, and you can set this differently for different sites. A law office may allow guest sharing only on a client collaboration site; an accounting firm may want links to expire after a set period; a clinic may turn off anonymous links entirely. These are business choices the owner should make knowingly.

Periodic access reviews

A few times a year, someone should check who has access to sensitive sites, which guests still have accounts, and which shared links are still active. This is quiet work, but it is what lets you answer a client or insurer honestly when they ask how files are controlled.

MFA and conditional access

Sign in settings decide how people prove they are who they say they are. Most Microsoft 365 account problems start with a password, so this is where small settings make a large difference.

Multi factor authentication for everyone

MFA asks for a second proof, usually an approval in an authenticator app on the person’s phone, in addition to the password. It should apply to every user, with administrator accounts held to the strictest settings. Rolling it out well means a short guide for staff, help for the few people without a work phone, and a plan for when someone gets a new device.

Conditional access in plain language

Depending on your licences, conditional access lets you write rules such as “admins must use MFA every time”, “block sign in from countries where we have no staff”, or “only company managed laptops may download files from the finance site”. The rules are powerful and easy to get wrong, so each one should be tested with a pilot group and recorded in the tenant documentation with the reason it exists.

Admin accounts kept separate

Day to day work should happen under a normal account; administrator rights belong on a separate account used only for admin tasks. At least two admin accounts should be owned by your organization so you are never locked out of your own tenant.

SPF, DKIM and DMARC in plain words

These three records live in your domain’s DNS settings and tell other mail systems which messages really come from you. Getting them right helps your invoices and proposals reach inboxes and makes it harder for someone to send mail pretending to be your domain.

SPF

SPF is a published list of the services allowed to send mail for your domain: Microsoft 365, plus perhaps your website’s contact form, an accounting system that emails invoices or a newsletter tool. If a sender is missing, its mail may land in spam; if the list is too loose, it offers little protection.

DKIM

DKIM adds a digital signature to outgoing messages so receiving systems can check the message was not altered and really came from an approved sender. It is switched on per domain and needs matching DNS records.

DMARC

DMARC tells receiving systems what to do when a message claiming to be from your domain fails those checks, and sends you reports about who is sending in your name. Organizations usually start in a report only mode, read the reports to find forgotten senders, then tighten the policy step by step. Done carefully, nobody notices except the impostors. Mail records are one piece of the wider work described on our cyber security services page.

Backing up Microsoft 365 data

Microsoft keeps the service running and offers recycle bins and retention features, but those are not the same as an independent copy of your data that you control. Customers should plan their own backups of mail, OneDrive, SharePoint and Teams files.

What a separate backup protects against

An independent copy helps when a staff member deletes a folder and nobody notices for weeks, when a departing employee’s data is removed too early, when a sync problem overwrites a shared library, or when ransomware encrypts files that then sync to the cloud. It also helps if you ever need to move between tenants.

Decisions for the owner

How far back copies go, where they are stored, who can restore them and how often a restore is tested are owner decisions. We cover the wider planning, including servers, laptops and accounting files, on the Data backup page in this batch; on the Microsoft 365 side, the support work is making sure every mailbox, site and OneDrive is included and that new ones are added automatically.

Copilot readiness and data permissions

Copilot for Microsoft 365 answers questions and drafts content using the files, mail and chats a person already has access to. That makes it useful, and it also means any loose permissions in your tenant become visible quickly.

Why permissions come first

If the salary spreadsheet sits in a folder shared with “everyone in the organization”, Copilot can draw on it when a staff member asks a question. The tool respects permissions; it does not fix them. Before switching it on, review who can open sensitive sites and files, remove broad sharing that was set for convenience years ago, and label confidential material.

A sensible rollout

Many organizations start with a small group, write a short AI use policy that says what staff may and may not ask, and collect questions before widening access. Copilot is a separate licence paid to Microsoft. For a broader view of where AI fits in your organization, see our AI consulting for organizations page.

Everyday admin requests and the tenant record

Most Microsoft 365 support is ordinary: a shared calendar that will not appear, a Teams meeting room that needs setting up, a mailbox approaching its storage limit, a distribution list that needs a new member, a guest who cannot open a shared file, a phone that will not sync after an update. These small requests are where an organized administrator saves staff time.

The tenant record

Every change worth making is worth writing down. A tenant record lists admin accounts, licence counts, groups and their owners, SharePoint sites and their permissions, sharing settings, conditional access rules, DNS records for mail and the backup arrangement. It belongs to your organization, sits where you can read it, and means the next administrator does not start from scratch.

Where this sits among our IT services

Microsoft 365 support can be bought on its own or as part of managed IT services for your office, which also covers devices and the network. If you are weighing how much technology work to hand to an outside team, the IT outsourcing page in this batch explains full, partial and co managed models. Projects such as choosing between productivity suites or planning a merger of two tenants fit IT consulting and planning. Phishing awareness for staff using Microsoft 365 is covered by security awareness training, and wider cloud configuration reviews by cloud security.

Privacy obligations and Canadian data regions

Your Microsoft 365 tenant holds client correspondence, staff records and often health or financial information, so privacy law follows it.

PIPEDA, Law 25 and PHIPA

PIPEDA requires organizations to report breaches of security safeguards that create a real risk of significant harm to the Privacy Commissioner of Canada and to the affected individuals, and to keep a record of breaches. Audit logs in Microsoft 365, kept for an appropriate period, help an organization reconstruct what happened. Quebec Law 25 adds its own obligations for organizations operating in Quebec, and Ontario health custodians follow PHIPA when personal health information sits in mail or files. This is a marketing observation, not legal advice.

Where tenant data lives

Some organizations prefer, or must, keep data in Canada. Microsoft and other cloud providers offer Canadian data centre regions, and the region a tenant uses can be checked in the admin settings. Confirm it before a migration if residency matters to your clients, funders or regulators.

How we work on your tenant

Canada Create follows the same plain steps whether you need a migration, a cleanup or ongoing administration.

A free review

We start with a conversation about how many users you have, which plans you hold, where mail and files live today and what frustrates staff. With read access you grant, we can look at licences, sharing settings and sign in rules and tell you what we see.

A custom proposal

You receive a custom proposal listing what we would change and why: licence adjustments, migration steps, site structure, sharing and MFA settings, email records and backup coverage. Fees are quoted in writing, with Microsoft licences shown as separate lines.

Changes with a pilot group

Settings that affect sign in or sharing are tested with a small group first, then rolled out with a short staff note. Admin accounts and the tenant record stay in your organization’s name.

Monthly reporting

On ongoing support, each month you receive a summary of joiners and leavers handled, licence counts, changes made to settings, and anything worth a decision, such as guests to remove or a mailbox nearing its limit.

What Microsoft 365 support costs

Microsoft 365 support is quoted in writing after the free review. Licences are paid to Microsoft or your licensing partner and are always a separate line from our fees.

What drives the quote

• The number of users, shared mailboxes and SharePoint sites.
• Whether a migration is involved, from where, and how much mail and file data must move.
• How tangled current permissions and sharing are, and how much cleanup comes first.
• Whether you need conditional access rules, device management or Copilot readiness work.
• Whether support is a one time project, ongoing administration, or part of a wider IT arrangement.

A small office moving from older hosted email is a very different scope from a multi site firm cleaning up years of Teams sprawl, which is why we quote after looking rather than from a price list.

Choosing a Microsoft 365 partner and your next step

Whoever administers your tenant can see a great deal of your organization’s information, so choose on clarity and ownership, not on who answers fastest. Questions worth asking:

• Who owns the accounts? The answer should be you, including at least two admin accounts and the licensing account.
• Will you document every setting you change, and where will that record live?
• How will you test sharing and sign in changes before they affect everyone?
• What is your offboarding checklist for a departing staff member?
• How will Microsoft 365 data be backed up independently of Microsoft’s own features?
• How do you handle a tenant that holds health information or serves Quebec clients?

Your next step

A free Microsoft 365 review starts with three facts: your user count, the plans on your latest Microsoft invoice, and the one tenant problem staff complain about most. Send those through a short message about your tenant. Call (416) 273-9030, Monday to Friday, 9 am to 6 pm, and Saturday, 10 am to 2 pm. After hours, our 24/7 AI agent answers the toll-free line, +1 (800) 808-9235, and we’ll follow up the next business morning. Expect an answer within one business day. You will find us at 126 Willowdale Avenue, Suite 3, Toronto, and the story of Canada Create is worth a read before your call.