Microsoft 365 and Entra ID
Our Microsoft 365 consultancy helps organisations across the UK get more from the tenant they already pay for. We review how it is set up, fix identity and access in Entra ID, protect email and files with Defender and Purview, and organise SharePoint and Teams so people can find their work. The engineers who advise you can also run it day to day.
The Microsoft 365 health check
Trusted by teams across UK government, healthcare, education, charities, financial services and global brands
Microsoft 365 is quick to start and easy to leave half-configured. These are the gaps we find most often in a first review.
Identity
MFA is on for some people but not others, old protocols still work, and a few accounts hold permanent Global Administrator rights.
What you can doMove to conditional access in Entra ID, block legacy sign-in, and give admin rights only when needed. Business Premium already includes Entra ID P1 for this.
Default email protection is left as it was, and nobody reviews what was quarantined or which rules forward mail outside the business.
What you can doConfigure Defender for Office 365, which Business Premium includes as Plan 1, and check mail flow and forwarding rules regularly.
Data
Links that anyone can open, sites with no clear owner, and sensitive documents with no labels make it hard to know who can see what.
What you can doSet sensible sharing defaults, give every site an owner, and use Purview sensitivity labels and data loss prevention for sensitive information.
Licences
Many organisations own Defender, Intune and Purview through Business Premium or E3 and have never switched them on.
What you can doReview what each plan includes before buying anything new. See Microsoft 365 licensing.
The same tenant, set up deliberately and documented.
| Area | Left as set up | Reviewed and managed |
|---|---|---|
| Sign-in | Left as set upMFA for some people, legacy protocols still allowed. | Reviewed and managedConditional access for everyone, with legacy sign-in blocked. |
| Admin access | Left as set upSeveral permanent Global Administrators. | Reviewed and managedNamed admin roles, granted only for the task in hand. |
| Left as set upDefault protection, unreviewed forwarding rules. | Reviewed and managedDefender for Office 365 tuned, forwarding rules checked. | |
| Files | Left as set upAnyone links and sites with no owner. | Reviewed and managedSharing defaults set, owners named, sensitive files labelled. |
| Devices | Left as set upAny device can open company data. | Reviewed and managedOnly compliant devices reach Microsoft 365, through Intune or Jamf. |
| Records | Left as set upSettings live in one person’s memory. | Reviewed and managedA written baseline and change log you keep. |
From identity to devices to data, we make Microsoft 365 secure and simple to use. It is part of our Microsoft cloud services.
Microsoft 365
Users, licences, Exchange Online, SharePoint, Teams and OneDrive, managed and secured.
Entra ID
Single sign-on, multi-factor authentication (MFA), conditional access, privileged identity management and hybrid identity.
Intune and Autopilot
Windows devices that set themselves up, stay compliant and update automatically.
Microsoft IntuneDefender
Defender for Business or Defender for Endpoint, and Defender for Office 365, configured and monitored.
Purview
Sensitivity labels, data loss prevention and retention for sensitive information.
SharePoint and Teams
SharePoint sites, permissions and Teams structured so people can find things.
Organisations that run on Microsoft 365, often alongside Macs.
Your tenant was set up quickly and has grown since. You want it reviewed, tidied and run properly, usually as part of managed IT support.
You run IT yourselves but want a second opinion, a project team or third-line escalation. Our co-managed IT service keeps your team in control.
Financial services, legal, public sector and charities that must show who can reach which data. See our cyber security work.
Four steps. It starts with a Microsoft 365 health check, and you decide how far to go: fix the findings yourselves, or have us run the tenant.
Microsoft 365 health check
We look at identity, admin roles, conditional access, email protection, sharing, devices and licences, using read-only access you approve through GDAP.
Book a Microsoft 365 health checkIdentity and access first
We move sign-in to conditional access, starting in report-only mode, then enforce it. Admin rights are reduced to the roles each task needs.
Email, files and Teams
We tune Defender for Office 365, set sharing defaults, give every SharePoint site and Team an owner, and add Purview labels where you need them.
Day-to-day management
We manage starters, leavers, licences and changes, monitor security alerts and review the tenant with you regularly. Or we hand it over with training.
We plan migrations carefully. Email, files and identities move across without your people losing work, and the new environment is secure from the first day.
Leaving on-premises Active Directory? Read our Active Directory to Entra ID guide.
Can’t see your question? Call us on +44 20 7550 9103 or book a call.
A Microsoft 365 consultancy reviews how your tenant is set up, then plans and delivers the changes: identity and conditional access, security, licensing, migrations and how SharePoint and Teams are organised. We are a UK Microsoft 365 consultancy based in London, and the engineers who advise you can also run the tenant day to day.
Yes. We manage users, licences, Exchange Online, SharePoint, Teams and OneDrive, with security baselines, monitoring and regular reviews. That can be part of managed IT support, or work alongside your own IT team through co-managed IT, where your team keeps control of the tenant.
Yes. We migrate from Google Workspace, on-premises Exchange and file servers, and between Microsoft 365 tenants after mergers and acquisitions. We also move identity from on-premises Active Directory to cloud-only Microsoft Entra ID, as we did for Toynbee Hall.
Often not. Business Premium includes Entra ID P1, Intune Plan 1, Defender for Business and Defender for Office 365 Plan 1. Many organisations have never switched these on. We review your licences and configure what you already have.
Through Microsoft’s granular delegated admin privileges (GDAP): only the admin roles we need, for a fixed period, approved by you. You can see and remove our access on the Partner relationships page of the Microsoft 365 admin center.
Yes. We are a UK Microsoft Cloud Solution Provider (CSP) and supply Microsoft 365 licences alongside your support. We review your current licences first, so you pay only for what you use and switch on the security you already own. See Microsoft 365 licensing.
Day-to-day management, a migration or a health check: a 1-hour call is the quickest way to find out what you need. We will tell you what you already own and what to fix first.
London head office
Postremo IT Limited
Level 24, One Canada Square
Canary Wharf
London E14 5AB
+44 20 7550 9103
info@postremoit.com
Also in Dubai
Business Bay, Dubai
Your brief: