Browse all topics▾
All guidesGlossary
Microsoft 365 essentials

Microsoft 365 for small business

How to choose, set up, and run Microsoft 365 in a small business — the plan, the basics, and the security baseline.

If you run a small business and want email, documents, file storage, and meetings in one place, Microsoft 365 is the obvious default. The pitch is straightforward: a few pounds (or dollars) per user per month gets you the same tools the largest enterprises use, with no servers to maintain.

Which plan to pick

Under 300 users, you're in the Microsoft 365 Business family. The three main plans:

  • Business Basic — web and mobile Office, Exchange, OneDrive, Teams. No desktop apps. Cheapest.
  • Business Standard — adds installable desktop Office apps. The most common starting point.
  • Business Premium — adds Intune for device management, Defender for Business for endpoint protection, Entra ID P1 (Conditional Access), and Azure Information Protection P1 (sensitivity labels). The right choice if security matters.

A standalone Apps for Business plan covers desktop Office without the cloud services, but most teams want the bundle.

A sensible first-week setup

  1. Buy the right number of licences and assign them to users in the admin center.
  2. Add and verify your domain (yourcompany.com) and switch email DNS to Exchange Online.
  3. Set up users, with strong unique passwords and MFA enforced for everyone — non-negotiable.
  4. Migrate email from your existing provider (Microsoft has migration tools for Gmail, IMAP, and on-prem Exchange).
  5. Create Teams for each department or project. Teams will provision the SharePoint sites and shared mailboxes for you.
  6. Move files into the right places — personal in OneDrive, shared in SharePoint or a Teams channel.
  7. Install Office on staff devices and turn on Known Folder Move so Desktop, Documents, and Pictures back up to OneDrive automatically.

A minimum security baseline

  • MFA for every user.
  • Conditional Access blocking legacy authentication.
  • A simple set of sensitivity labels (Public, Internal, Confidential).
  • A Defender for Business roll-out on company-managed devices.
  • A backup story — Microsoft 365 Backup, a third-party SaaS backup, or both — beyond the built-in retention.

That gets you to a calm, well-run baseline that scales as the company grows.