What actually changes on 14 October 2025

• No more free security updates from Microsoft for Windows 10 Home, Pro, Enterprise or Education.
• No more free technical support from Microsoft for Windows 10 issues.
• No more feature updates — Windows 10 is essentially frozen.
• Cyber Essentials requires all in-scope software to be in-support. Out-of-support Windows 10 will fail certification.
• Most cyber-insurance policies require supported, patched operating systems. Running out-of-support Windows 10 can void cover at claim time.

Your three options

Option one is upgrade in place: if the device meets Windows 11 hardware requirements (TPM 2.0, supported CPU, 4 GB RAM minimum, 64 GB storage), you can move it to Windows 11 for free. About 70 to 80 percent of business-grade laptops bought in the last four years qualify. Option two is replace the hardware: any device that does not qualify either gets retired or replaced with a Windows 11 device. Option three is buy Extended Security Updates from Microsoft, at a price that doubles each year — sensible as a short-term bridge for a few stragglers, expensive as a long-term plan.

The migration plan we use with clients

• Audit every Windows 10 device against the Windows 11 hardware requirements (we use Microsoft Endpoint Manager or a free script).
• Sort into three buckets: upgradeable now, replace within budget cycle, retire.
• Stage upgrades by team and risk — start with low-risk users to validate driver and application compatibility.
• Plan replacement purchases against your existing refresh budget so this is not a surprise cost.
• Use the migration as an excuse to tidy up Intune / autopilot, conditional access and standard build images.

Most SMEs we work with can complete the migration in 8 to 12 weeks of calm planning. The ones that leave it until September will be paying premium prices for hardware and rushing the rollout. If you want a free Windows 10 audit and a costed migration plan, get in touch.

Business Standard — the productivity baseline

Business Standard gives every user the full desktop and web apps (Outlook, Word, Excel, PowerPoint, Teams, SharePoint, OneDrive, Exchange Online). It does not include any meaningful security or device management. For a small team that uses cloud email, Teams and shared SharePoint sites — and is comfortable accepting baseline Microsoft security — this is the right starting point. Capped at 300 users.

Business Premium — the SME sweet spot

Business Premium is what most of our clients land on. It bundles everything in Business Standard plus the security and device-management features SMEs genuinely need: Microsoft Defender for Business (EDR), Intune (device management), conditional access via Entra ID P1, data loss prevention, sensitivity labels, and the Windows 11 Pro to Enterprise upgrade. For Cyber Essentials and most cyber-insurance requirements, Business Premium is the cheapest licence that covers you out of the box. Also capped at 300 users.

Enterprise E3 — when you outgrow Business Premium

E3 is the right answer when you exceed 300 users, when you have specialist compliance requirements (eDiscovery, advanced auditing, customer key management), or when you need unlimited archive mailbox storage. It does not include Defender for Business — you add Defender for Endpoint Plan 1 or 2 separately. For SMEs under 300 users, E3 is almost always more expensive than Business Premium for less SME-focused security.

The decision in one paragraph

Under 300 users and want a productivity-only setup? Business Standard. Under 300 users and want Cyber Essentials–ready security included? Business Premium. Over 300 users or need specialist compliance? E3 with the right Defender add-on. We help SMEs across Hertfordshire, Bedfordshire and London size their tenancy correctly — including catching the common mistake of paying for Business Premium and not enabling half of what it includes.

Where Microsoft Teams Phone wins

If your team already lives in Microsoft Teams for chat and meetings, adding Teams Phone means one app, one identity and one set of admin tools. Calls follow the user across desk, laptop and mobile. Voicemail goes to Outlook. Call recording sits in OneDrive. For office-based knowledge workers, the experience is unbeatable and the admin overhead is tiny.

Where dedicated hosted VoIP wins

If you have a busy reception, a sales floor, a contact centre, or any team that handles high call volume, a purpose-built VoIP platform usually beats Teams. The wallboards are better, the call-flow editors are more flexible, and supervisor features (whisper, barge, real-time queue stats) are built for the job. The hardware story is also stronger — most decent IP phones, headsets and DECT systems are designed VoIP-first, with Teams support as a secondary path.

The hybrid pattern we see most often

• Knowledge workers on Microsoft Teams Phone — one app, follow-me calling, voicemail in Outlook.
• Reception, sales and support on a dedicated VoIP platform integrated with Teams presence.
• A single externally published number, intelligently routed to the right system.
• One UK invoice covering both platforms, with consolidated reporting.

We design, deploy and support both Microsoft Teams Phone and dedicated hosted VoIP — including the hybrid setups that get the best of both. If you are facing a PSTN switch-off deadline or your current contract is up for renewal, get in touch for an independent recommendation.

Why prompts matter more than features

Copilot is essentially a translator between plain English and the Microsoft 365 apps your team already uses — Outlook, Word, Excel, PowerPoint, Teams and SharePoint. A vague prompt produces a vague output. A specific, well-scoped prompt produces something you can ship in minutes rather than hours. The trick is teaching people to write prompts the same way they would brief a junior colleague: with context, a clear goal, and an example of the format they want back.

The categories that deliver fastest ROI

• Sales — summarising customer communications, drafting follow-up emails, updating CRM notes from Teams calls.
• Marketing — generating campaign briefs, drafting first-pass copy, pulling insights from analytics workbooks.
• Finance — explaining variances in monthly reports, building Excel formulas, summarising long supplier contracts.
• HR — drafting policy updates, summarising candidate CVs, producing first-pass interview questions.
• IT and operations — converting meeting transcripts into action lists, drafting change-request documents, summarising long incident threads.

Getting started without wasting licences

Copilot licences are not cheap, so the worst outcome is rolling them out without an enablement plan and watching usage fall off after week two. We help businesses pilot Copilot with a focused group of power users, measure the time saved on real tasks, then roll out to the wider team with documented prompts and short training sessions. The result is licences that pay for themselves within a quarter.

If your team has Copilot but is not yet seeing the productivity gains you were promised, talk to us. We help SMEs across Hertfordshire, Bedfordshire and London get measurable value out of Microsoft 365 Copilot.

Where Copilot helps the most

Microsoft 365 Copilot is most valuable in the moments around the customer interaction — the preparation, the summary and the follow-through. It can pull together everything the customer has emailed you about over the last six months, surface relevant SharePoint policies, and draft a context-aware response in seconds. It can summarise a long Teams call into action items and update the case record without anyone retyping anything.

• Auto-summarising long email threads before the agent replies.
• Drafting first-pass responses that match the customer’s tone and history.
• Producing meeting notes and action lists from Teams calls in real time.
• Consolidating customer data scattered across Outlook, SharePoint and OneDrive.
• Translating internal policy documents into plain-English customer-facing copy.

Where it does not — and why that matters

Copilot is not a replacement for a proper customer service platform or CRM. If your case data lives outside Microsoft 365, Copilot cannot see it. If your knowledge base is out of date or scattered across people’s inboxes, Copilot will reflect that mess back at you. The teams getting the biggest wins are the ones that tidy up their SharePoint and Teams structure first, then add Copilot on top.

We help customer service teams across the UK plan, deploy and adopt Copilot in a way that produces real productivity gains — not just a licence cost. Get in touch to discuss a pilot.

Week 1 — discovery, not action

The first week is almost entirely listening and documenting. We sit down with the leadership team to understand the business, the seasons, the dependencies and the risks. We walk the office, photograph the comms room, label cables, and run automated discovery across the network. We audit the Microsoft 365 (or Google Workspace) tenant, the domain registrar, the line-of-business apps, the backup estate and the licence position. The deliverable at the end of week one is a written "as-found" document — what we inherited, what is good, what is risky, what is missing.

Week 2 — secure the front door

Before anything else, we lock the obvious risks: enforce MFA on every account, rotate shared and admin passwords into a managed password vault, review and trim global-admin and domain-admin membership, deploy our endpoint protection and RMM to every device, and validate that backups actually run and actually restore. None of this is glamorous. All of it is the difference between a quiet first quarter and a 2am phone call.

Week 3 — knowledge transfer and ticketing

By week three the helpdesk takes over day-to-day support. Every user has been introduced to the new portal, the new ticketing email and the new phone number. We hold short floor-walks so people can put a face to the support team. Internally we run knowledge-transfer sessions on the quirky bits of the environment — that one line-of-business app that needs a registry tweak, the printer in finance that only works on Tuesdays — and document them in our knowledge base.

Week 4 — strategic roadmap

The final week is where the relationship shifts from reactive to proactive. We present a 12-month roadmap: the risks we want to close, the lifecycle replacements coming up, the licensing optimisations available, the projects the leadership team has asked us to scope. We agree a monthly or quarterly service review cadence and the metrics we will report against.

Questions to ask any MSP before you sign

• "Walk me through your first 30 days. What is delivered, by whom, and by when?"
• "Who specifically will I deal with day-to-day, and who is the escalation point?"
• "How do you handle out-of-hours? Is it the same team or an overflow?"
• "What does your offboarding look like if we leave in 18 months? Do we get our documentation?"
• "What is included in the monthly fee and what is billed extra? Show me a real invoice."
• "How many clients of our size do you currently support, and can we talk to two of them?"

Switching IT provider should feel like a relief, not a leap of faith. If you would like to see what our onboarding plan would look like for your business specifically, get in touch and we will put one together as part of the proposal — no obligation, and you keep the document either way.

Devices: managed, not borrowed

Company-owned, Microsoft Intune-managed laptops are the foundation. Autopilot ships a new device direct from the supplier to the user’s home; they sign in with their work account and the device configures itself — BitLocker, Defender, conditional access, line-of-business apps, the lot. Personal devices stay personal: if someone needs access from a home PC they get it through a browser, with no company data ever stored locally. This single change eliminates 80% of the data-loss and offboarding pain we see.

Identity and access: MFA, conditional access, no VPN

Identity is the new perimeter. Every user gets multi-factor authentication — ideally via the Microsoft Authenticator app, with passwordless sign-in for the keen. Conditional access policies enforce sensible rules: only managed devices can sync mail, sign-ins from unusual countries get challenged, legacy authentication is blocked outright. For most SMEs this removes the need for a traditional VPN entirely: apps are reached over the internet, protected by identity, not by a tunnel.

Network: business-grade at home, properly at the office

For staff who work from home most days — directors, senior engineers, customer-facing roles — a consumer ISP router is usually the weakest link in the chain. We deploy small business-grade access points and routers (UniFi, Meraki Go) at home, configure a separate work SSID, and where the role demands it we provide a 4G/5G failover so a domestic broadband outage does not stop the day. At the office a proper Wi-Fi 6 deployment, wired uplinks for desk phones and meeting-room kit, and a tidy patch panel are non-negotiable.

Telephony and meetings: one number, anywhere

Hybrid working killed the desk phone. We move clients to a cloud telephony platform — Microsoft Teams Phone where the rest of the stack is M365, a dedicated VoIP platform otherwise — so that one published number rings the user wherever they are, on whichever device. Meeting rooms get a Teams Rooms or comparable system with a proper camera and microphone array; nothing destroys a hybrid meeting faster than a laptop on the boardroom table.

The rules that make it sustainable

Technology gets you 70% of the way. The remaining 30% is policy: a written remote-working policy that covers acceptable use, equipment, data handling and incident reporting; a clear offboarding process that wipes managed devices and revokes access the same day; and a regular review of who has admin rights, who has access to which SharePoint sites, and which third-party apps users have connected to the tenant. Done properly, hybrid is not a compromise — it is a recruiting advantage and a productivity uplift. Done badly, it is a slow-burn security incident.

What Defender for Business actually does

• Next-generation anti-malware on Windows, macOS, iOS and Android devices.
• EDR — behaviour-based detection of suspicious activity (ransomware patterns, credential theft, lateral movement).
• Automated investigation and remediation — Defender acts on common threats without waiting for a human.
• Attack surface reduction rules — blocks the techniques attackers use to get a foothold (Office macros, script-based attacks, credential dumping).
• Vulnerability management — continuous scan for missing patches and weak configuration, with prioritised guidance.
• Web content filtering — block phishing and malicious sites at the browser layer.

What to enable first

Out of the box, Defender does the minimum. The real value comes from a handful of policies that we apply on every deployment: enable all attack-surface-reduction rules in audit mode, then move them to block once you have triaged the noise. Turn on automated investigation at full automation. Enforce tamper protection so attackers cannot disable Defender from a compromised endpoint. Push Edge with SmartScreen and web filtering enabled. Onboard servers as well as workstations — most SMEs forget servers exist.

How it compares to third-party EDR

For the average SME, Defender for Business is now a credible alternative to dedicated third-party EDR products from vendors like SentinelOne, CrowdStrike or Sophos. The third-party products usually have better reporting consoles and stronger threat-hunting features — but those benefits only matter if you have someone watching the console. Most SMEs do not. Defender for Business, properly configured and bundled with a managed service, is the right answer for the large majority of SMEs we work with.

We deploy and manage Microsoft Defender for Business as part of our managed IT and managed security services. If you have Business Premium licences but are not sure whether Defender is doing anything useful, we offer a free 30-minute review.

The five controls, in plain English

• Firewalls and routers — every device that connects to the internet must sit behind a properly configured firewall, with the default admin password changed and unused services switched off.
• Secure configuration — devices and software ship with permissive defaults; you have to lock them down (no default accounts, no unused apps, auto-lock enabled, BitLocker on laptops).
• User access control — least privilege. Standard users do day-to-day work; separate admin accounts are used only when needed; multi-factor authentication on every cloud service.
• Malware protection — modern endpoint protection on every workstation and server (Microsoft Defender for Business, SentinelOne, CrowdStrike or similar), kept up to date.
• Security update management — operating systems, browsers and apps must be patched within 14 days of a high-severity update being released. No exceptions for the boss’s laptop.

The gotchas that fail first-time applicants

In our experience the same handful of issues sink most first attempts. Personally-owned (BYOD) phones that access company email are in scope and must meet the controls — most people forget this. Unsupported operating systems anywhere in the estate (a Windows 10 PC after October 2025, an old Server 2012 box quietly running a line-of-business app) are an automatic fail. MFA must be enforced, not just available — a tenant where users can still log in without MFA does not pass. And the scope statement matters: applying for a narrow scope is fine, but everything inside that scope must comply.

Cyber Essentials vs Cyber Essentials Plus

Cyber Essentials is a self-assessed questionnaire verified by an external assessor. Cyber Essentials Plus is the same controls, but independently tested by an assessor who will run a vulnerability scan against a sample of your devices and your external infrastructure. Plus is what most serious procurement processes and insurers actually want. If you are aiming for Plus, do not book the test until your patching, endpoint and MFA picture is genuinely tidy — failures are expensive to re-test.

How we approach it with clients

We treat Cyber Essentials as a side-effect of doing good IT, not as a project in its own right. For managed-service clients we keep an evidence pack that maps each control to the relevant tooling — Microsoft 365 conditional access policies, Intune compliance, Defender posture, patch reports from our RMM — so when renewal comes around the answers are already documented. If you have an upcoming tender, a renewal deadline, or a cyber-insurance question asking whether you are Cyber Essentials certified, talk to us early; the lead time to fix the typical findings is a few weeks, not a few days.

What Microsoft 365 actually retains

• Deleted items in Outlook: 14 days by default, recoverable from Deleted Items, then up to 14 more days in Recoverable Items. Total: 30 days.
• Deleted OneDrive and SharePoint files: 93 days in the recycle bin (first-stage 30 days, then second-stage to 93).
• Deleted user accounts: 30 days before the mailbox and OneDrive are unrecoverable.
• Teams chat and channel messages: governed by retention policies — by default kept indefinitely, but a single misconfigured policy can purge them.
• No version-by-version backup history beyond what Microsoft’s own retention provides.

The scenarios that catch SMEs out

A leaver’s account is closed and 31 days later finance realises they were the only person with three years of client contracts in their OneDrive. A ransomware attack encrypts SharePoint files via OneDrive sync, and by the time it is detected, version history has been cycled. An admin runs a "tidy up" PowerShell script and deletes a SharePoint site that had inherited data nobody had checked. A retention policy is changed and removes three years of Teams chat history overnight. In every one of these cases, Microsoft has done exactly what they promised — and your data is still gone.

What a proper Microsoft 365 backup gives you

• Independent copy of Exchange, OneDrive, SharePoint and Teams data, stored outside the Microsoft 365 tenant.
• Long-term retention well beyond Microsoft’s native windows — typically 7 years.
• Point-in-time restore: rewind a single mailbox, file or site to a specific moment.
• Granular restore — recover one email, one file or one Teams channel without restoring the whole tenant.
• Protection from administrative mistakes, malicious insiders, ransomware and misconfigured retention policies.

Microsoft’s own shared responsibility model is explicit: protecting your data is your responsibility, not theirs. We deploy and manage third-party Microsoft 365 backup for SMEs across the UK — typically using Veeam or comparable platforms — billed per user, per month, with restores included. If you have not validated what happens when one of your users deletes something important and asks for it back six months later, talk to us.

Content and creative

• Draft long-form blog posts from a one-line brief and a target keyword.
• Repurpose a blog post into a LinkedIn carousel, an email and a tweet thread in one pass.
• Generate first-pass image alt text and SEO meta descriptions across an entire content library.
• Translate marketing copy into multiple languages while preserving tone.
• Rewrite jargon-heavy product copy in plain English.

Research and insights

• Summarise long competitor whitepapers into 200-word briefings.
• Extract themes from a SharePoint library of customer research interviews.
• Cluster open-ended survey responses by sentiment and topic.
• Pull insights out of Excel analytics workbooks without writing formulas.
• Produce executive-ready summaries of long quarterly reports.

Campaign delivery and reporting

• Draft full campaign briefs from a single objective statement.
• Generate launch checklists tailored to channel and audience.
• Convert campaign performance data into a board-ready PowerPoint.
• Summarise email campaign performance against goals.
• Build a post-campaign retrospective from Teams meeting transcripts.
• Draft answers to common stakeholder questions about results.
• Update content calendars based on team capacity in Planner.
• Generate a weekly internal update for marketing leadership.
• Produce a polished case study from a Teams call with a customer.
• Draft press releases from a one-page product brief.

We work with marketing teams to roll Copilot out properly — with the right licences, prompt libraries and adoption support so the productivity gains stick. Get in touch to plan your rollout.

The morning: triage and prep

A marketing manager opens Outlook to a queue of 30+ overnight emails. Copilot summarises the lot in under a minute, flags the ones that genuinely need a response, and drafts replies to the routine ones. The time saved on inbox triage alone is usually 30 to 45 minutes a day.

Mid-morning: the campaign review meeting

A Teams call to review last week’s campaign performance. Copilot transcribes the meeting, summarises the decisions, and produces an action list assigned to each attendee. No one is taking minutes. The manager spends the meeting actually thinking about the work instead of typing.

Afternoon: drafting and approvals

A board update is due tomorrow. The manager points Copilot at the campaign performance workbook, the latest brand guidelines, and a previous board deck. Copilot produces a first-pass PowerPoint in the right house style. The manager spends the afternoon refining the strategic narrative rather than wrestling with PowerPoint.

Where Copilot does not help

It will not make a bad strategy good. It will not replace a creative director’s judgement on tone. It will not catch every factual error — the manager still has to review carefully. The teams getting the biggest wins are the ones who treat Copilot as a fast, tireless junior, not as a replacement for human judgement.

We help marketing teams deploy and adopt Microsoft 365 Copilot in a way that actually changes the working day — not just the licence bill. Get in touch to scope a pilot.

The everyday wins

• Draft personalised follow-up emails from a one-line prompt and the prospect’s recent email history.
• Summarise the last six months of communication with an account in 30 seconds before a renewal call.
• Convert a Teams discovery call into a structured opportunity summary, with stakeholders, pain points and next steps.
• Update bid documents and proposals using language pulled from previously won deals.
• Produce a board-ready pipeline review from Excel data without writing a single formula.

What changes for the rep

The teams getting the biggest wins are not necessarily closing more deals per rep — they are closing the same deals faster, with better-prepared conversations, and reps with more time for prospecting. The compounding effect across a year is significant: more time at the top of the funnel, faster cycle times, and a noticeable improvement in the quality of customer-facing output.

The pre-requisites no one talks about

Copilot only works as well as the data it can see. If your customer history is split across personal inboxes, shared mailboxes and SharePoint sites no one has tidied up in three years, Copilot will reflect that mess back at you. Before rolling Copilot out to a sales team, we usually spend a week tightening up email hygiene, mailbox sharing and SharePoint structure. It is unglamorous work that pays for itself the moment Copilot starts producing genuinely useful summaries.

We help UK sales teams plan, pilot and roll out Microsoft 365 Copilot in a way that produces measurable cycle-time gains. Get in touch to discuss a pilot.