Why reliable IT support matters for growing organisations

Most organisations do not notice their IT until it fails. A business of five people can get by with one person who “knows computers”, a shared password written on a whiteboard and backups that someone meant to set up. At fifteen or thirty people, those same habits start producing real problems: a departed staff member who still has access to email, a laptop stolen with client files on it, a ransomware incident with no recent backup to restore from. Reliable IT support is the discipline that prevents those outcomes, and it is far cheaper than recovering from them.

Growth multiplies small problems

Every new staff member adds accounts, devices, shared files and permissions. Every new system adds another place where access needs to be managed. What was a manageable amount of informal knowledge in a small team becomes a set of gaps nobody owns.

The signs are familiar. Nobody is sure who has admin access to the Microsoft tenant. Three different people have set up three different file structures. A former contractor still receives the weekly reports because nobody removed them from the distribution list. Each of these is minor on its own. Together they are the reason growing organisations suffer outages and breaches that smaller or larger ones avoid.

Microsoft 365 hygiene

Most Australian businesses run on Microsoft 365, and most tenants we see have never been reviewed since they were created. A few basics make a large difference.

• Multi-factor authentication should be enforced for every account, with no exceptions for senior staff or shared mailboxes.
• Admin rights should be held by a small, known group, with a separate admin account that is not used for daily email.
• Shared mailboxes and distribution groups should be reviewed regularly so that only current staff receive what they need.
• Licences should match actual staff numbers. Paying for licences assigned to people who left last year is common and avoidable.
• Email forwarding rules, especially to external addresses, should be checked, because attackers often create them after compromising an account.

A support provider should be able to walk you through these settings and show you the current state of each one. If they cannot, the tenant is probably not being managed.

Backups that have been tested

Cloud services do not remove the need for backups. Microsoft 365 retains deleted items for a limited period, but it does not protect you from a staff member emptying a shared folder, a ransomware attack that encrypts synced files, or a malicious deletion by someone on their way out.

A proper backup arrangement covers email, OneDrive, SharePoint and Teams, as well as any line-of-business systems and local servers if you still have them. It is stored separately from the live environment, it runs on a schedule, and it is tested. A backup that has never been restored is a hope, not a plan. Ask your provider when the last test restore was done and what it covered.

Onboarding and offboarding

How a person joins and leaves the organisation says more about IT maturity than almost anything else. A good onboarding process creates the accounts, assigns the licences, enrols the device, applies security policies and gives the new starter access to the right files on their first morning. A poor one means the person spends their first week asking colleagues to share things.

Offboarding is where the risk sits. When someone leaves, their access to email, files, cloud applications, remote access and any shared logins should be removed the same day. Their mailbox should be preserved or forwarded according to a policy, their device recovered or wiped, and their entries in distribution lists and shared calendars cleaned up.

Write both processes down as checklists. Have the provider follow them every time, and have a manager confirm completion. Informal offboarding is how former staff end up with access months after they leave.

Security basics that most businesses miss

Security does not need to be elaborate to be effective. The measures that prevent most incidents are well known and often skipped.

• Devices should be encrypted and able to be wiped remotely if lost.
• Operating systems and applications should be updated automatically, with a way to confirm that updates are actually applying.
• Staff should use a password manager rather than reusing a handful of passwords.
• Email filtering should be configured to catch common phishing patterns, and staff should know how to report a suspicious message.
• Access to sensitive files should be based on role, not granted to everyone by default.

Staff awareness is part of this. A short, regular reminder about current scams does more than an annual training video nobody watches.

What to ask a provider

Choosing an IT support provider is a long-term decision, and the right questions reveal more than a brochure.

• What exactly is included in the monthly fee, and what is billed separately?
• Who will be responding to our requests, and how do we log them?
• How do you document our environment, and can we see that documentation?
• What is your process when a staff member starts or leaves?
• How are backups configured, where are they stored and when were they last tested?
• What security baseline do you apply to every client, and what is optional?
• What happens if we decide to move to another provider?

Be wary of promises that sound better than they can be delivered, and prefer a provider who explains what they will do and how they will show you it is being done. Ask for the reporting you will receive and what it covers.

Where to start

Begin with an audit of the current state. This does not need to be complicated, and much of it can be done in an afternoon with the right access.

• List every staff member and contractor and confirm which accounts and systems each one can access.
• Check whether multi-factor authentication is enforced on every Microsoft 365 account.
• Confirm what is being backed up, where, and when it was last restored successfully.
• Write down the onboarding and offboarding steps as they happen today, and identify the gaps.
• Review admin access and remove anything that is not needed.

With that picture, you can decide whether the current arrangement needs tightening or replacing, and any provider you speak to will be able to give you a far more useful answer.