Most small business Microsoft 365 setups I inherit were done in an afternoon by whoever was nearest the laptop. Email works, so nobody looks again. Then the domain fails an SPF check, an old admin account with no MFA turns up in the sign-in logs, and there is no record of who owns the DNS.
This guide walks through a proper setup for a UK business of roughly 5 to 50 staff, in the order the work actually needs doing. It assumes you are moving from an existing email provider such as a hosting company POP mailbox, Google Workspace or an on-premises Exchange server.
There are three plans that matter for a business under 300 users. Everything else is either an add-on or an enterprise plan you do not need yet.
| Plan | What it adds | Best for |
|---|---|---|
| Business Basic | Exchange email, Teams, SharePoint, OneDrive, web versions of Office | Staff who only need email and Teams, no installed Office |
| Business Standard | Everything in Basic plus installed desktop Word, Excel, Outlook and PowerPoint | Standard office staff with no device management requirement |
| Business Premium | Everything in Standard plus Intune, Defender for Business and Entra ID P1 for conditional access | Any business with laptops out of the office, client data, or a Cyber Essentials requirement |
The pricing picture changed on 1 July 2026. Microsoft raised list prices across most Business and Enterprise plans, with Business Basic up around 17 per cent and Business Standard up around 12 per cent. Business Premium was the one mainstream plan left unchanged. Existing customers move to the new prices at their next renewal after that date rather than immediately.
The practical effect is that the gap between Standard and Premium is narrower than it has ever been. If you were previously talking yourself out of Premium on cost, run the numbers again. You are getting device management, endpoint protection and conditional access for a difference of a few pounds per user per month, and those three things are what stop a compromised password becoming a compromised business.
You can mix plans in one tenant. A warehouse team on Basic and an office team on Premium is perfectly normal and usually the right answer.
Sign up with a real business email address you will keep, not a personal one, and not the address of the person most likely to leave. The account you sign up with becomes the first global administrator.
Once the tenant exists, add your domain in the admin centre. Microsoft gives you a TXT record to publish at your registrar. Publish it, wait, then verify. Nothing has moved yet at this point. Verification only proves you control the domain, so this step is completely safe to do while your old email is still running.
admin.microsoft.com › Settings › Domains › Add domain Publish the TXT record, verify, then choose "I'll manage my own DNS records"
Choose to manage your own DNS records rather than letting Microsoft add everything automatically. Automatic setup will change the MX record straight away, which cuts your live email over before a single mailbox has been migrated.
This is the step that gets skipped, and it is the cheapest one to get right at the start. Retrofitting MFA onto forty users who have been signing in with a password for two years is a support ticket generator. Doing it on day one is just how the system works as far as they are concerned.
Microsoft has removed the choice anyway. Enforcement of MFA for the Microsoft 365 admin centre became mandatory on 9 February 2026, after a phased rollout that started in February 2025. Sign-in to the Azure portal has required MFA since March 2025, and Azure CLI, PowerShell and API write operations since October 2025.
Minimum baseline before you create a single user:
I have written the full detail of the identity side in conditional access policies in Microsoft 365 and disabling legacy authentication.
Decide your naming convention now and write it down. First name dot surname is the most common in the UK and reads well on a business card. Whatever you pick, apply it consistently, because inconsistent addresses are impossible to fix once they are on letterheads and invoices.
Three things people get wrong here:
For anything over about twenty users, do this with PowerShell rather than clicking. See bulk creating users in Entra ID with PowerShell.
The method depends on where you are coming from.
| Source | Method | Notes |
|---|---|---|
| IMAP hosting mailbox | IMAP migration in the admin centre | Moves mail only. Contacts and calendars do not come across |
| Google Workspace | Google Workspace migration in Exchange admin centre | Moves mail, contacts and calendar |
| On-premises Exchange | Cutover or hybrid migration | Cutover is fine under 150 mailboxes. Hybrid for anything larger or staged |
| PST files on desktops | Network upload to Microsoft 365 import service | Slow but reliable. Free |
Run the migration before you touch the MX record. New mail keeps arriving at the old system while the historic mail syncs across in the background. Users notice nothing. When the sync is complete and the delta is small, you cut over.
Do the cutover at the end of a working day, not on a Friday afternoon. Lower the TTL on your MX record to 300 seconds a day beforehand so the change propagates quickly.
Records you need in place:
p=none with a reporting address so you can see who is sending as you before you start rejecting anythingv=DMARC1; p=none; rua=mailto:dmarc@yourdomain.co.uk; fo=1
Leave DMARC at monitoring for two to four weeks, read the reports, then move to p=quarantine and eventually p=reject. Jumping straight to reject will silently kill your invoicing system's email. Full walkthrough in setting up DMARC, DKIM and SPF for M365.
On Business Premium you have Intune, and there is no good reason not to use it. The licence is already paid for. An unmanaged laptop is a laptop you cannot wipe when it goes missing from a car boot in Manchester city centre.
The minimum useful configuration:
For new hardware, Windows Autopilot means a device can be posted straight to a new starter and configure itself out of the box. Full detail in setting up Intune for a UK small business.
Get this decision made early, because moving 400 GB of shared drive twice is nobody's idea of a good week.
One thing worth stating plainly to the business owner: syncing files to OneDrive or SharePoint is not a backup. It is replication. A file deleted or encrypted on the laptop replicates that state to the cloud. Retention policies and versioning buy you a window, but they are not the same as a backup with its own retention. See why cloud sync is not a backup.
Licensing is the easy part to calculate. It is per user, per month, on an annual or monthly commitment, excluding VAT. Ten users on Business Premium is a predictable four-figure annual cost.
The setup work is the part people underestimate. For a typical business of 5 to 25 users migrating from an existing provider, realistic timings are:
| Phase | Typical duration |
|---|---|
| Discovery, plan selection, DNS access | 2 to 3 days, mostly waiting on the client |
| Tenant build, security baseline, users and groups | 1 day |
| Mailbox migration running in background | 2 to 10 days depending on volume |
| DNS cutover and Outlook reconfiguration | 1 evening plus the following morning |
| Device enrolment and policy rollout | 2 to 5 days |
| Handover and staff walkthrough | Half a day |
Two to three weeks end to end is a fair expectation. Anyone promising same-day is either working with three mailboxes or skipping the security baseline.
We set Microsoft 365 up end to end for a fixed price agreed in writing before anything starts.
See Microsoft 365 SetupMore in this series: all Klariq guides.