I have done quite a bit of work with Office 365 (or Microsoft 365 to be more accurate). I've seen
the good, and I've seen the bad. These are the top seven things that I think everyone should know
before committing to it; although if you've already started, that's okay - this will still be useful.
Welcome back to the Pro Tech show - the place for tech, tips, and advice
for IT pros and decision-makers. I'm going to count these tips down from
seven to one because let's face it, countdowns are more exciting.
In at seven we have reliability. Now I don't want to overstate this one, but I do want to address
it because a lot of people assume that getting Microsoft server platforms delivered by Microsoft
will be a lot more reliable than their on-premises equivalents. They're not. At least, not if you're
managing the on-prem ones correctly. Office 365 doesn't aim for 100% uptime. It's a balance between
allowing Microsoft to innovate and try out new features, keeping it reliable enough that customers
don't revolt, whilst keeping it cheap enough that lots of people will pay for it and Microsoft still
make a decent margin. The "365" in Microsoft 365 definitely doesn't stand for its uptime;
or if it does that's only because they almost always classify their outages as "disruptio"n rather
than "downtime" so SLAs aren't affected. If that sounds harsh then maybe Microsoft might want to
try explaining to their customers who haven't been able to work for most of the day that it's not
actually down it's just disrupted; because frankly, I'm getting a bit fed up having to do it for them.
In reality the reliability is... fine. If it was really bad nobody would use it.
Microsoft aren't stupid - they knew how far they can push it before people get annoyed.
There's almost always something somewhere in Office 365 that's broken, but the vast majority
of the time it will be incredibly minor and you won't notice. If you need 100% guaranteed uptime
this might not be the best option for you, but for most businesses it's fine. Just go into with
your eyes open and don't over-promise. Don't tell your board the service is going to be invincible.
Tell them there will be occasional problems, but when they happen someone else will deal
with it and it will come back up. If people make an informed decision they can generally
live with the odd blip; but they don't like to feel misled. Number six: optimize your licensing.
The Microsoft 365 product stack is huge, and its licensing is convoluted and confusing.
There are loads of ways to buy the same service and this can lead to you overspending. As a general rule it
is better value to purchase product suites rather than individual services. Sometimes ridiculously
so. Take SharePoint for example. The cheapest way to buy SharePoint is to buy the standalone SharePoint
Online Plan 1 for £3.80 per user per month; but Microsoft 365 Business Basic is also £3.80
per user per month, and it includes SharePoint as well as Teams and Exchange. So why would anyone buy
standalone SharePoint? Well, if you have less than 300 users you probably shouldn't; but when you get
beyond that you can't use the Business plan anymore and it's cheaper than an E1 license...
assuming you only need SharePoint. If you buy the cheapest standalone SharePoint plan and the
cheapest standalone Exchange plan, guess what? You could have bought an E1 subscription. This
leads many people to say "Sod it. I'll just buy the big subscription that includes everything I need.".
Except then chances are you've just bought a whole bunch of services you have no intention of using.
You might be better off with a middle-tier package, plus a couple of add-ons. So what's the answer? Work
out what services you're going to need and figure out the most cost-effective way to get all of
them together. Don't let someone upsell you "just in case". You can always add more features later.
A good licensing partner here can save you quite a bit of money, whereas a bad one will
simply fleece you for commission. Don't forget about the on-premises world, either. Some Microsoft
cloud subscriptions include on-premises access rights. In fact the cheapest way to license your
on-premises servers is sometimes with a Microsoft 365 subscription. If you can offset a cost in one
place to get you more services in the other without changing your budget, you're winning!
Next up: it's the cloud, it changes. Sometimes services or features get killed off. Other times
free services suddenly become premium services. Premium as in "now you've got to pay for them".
That also works the other way. Sometimes premium features are moved down a tier at no extra cost -
particularly the security ones. You have to remember this is an evergreen subscription model.
You're not buying a fixed service for a fixed price and that's it forever.
The services and prices may change and you're free to keep paying,
or not. What can you do about this one? The most important thing is to stay informed.
Microsoft won't spring changes on you. They will typically give you plenty of notice. Where a lot
of people hit problems is when they don't bother to read their messages. They end up scrambling to
replace a critical service with only a week to go because they didn't read the notification
that arrived months ago. I appreciate there are a lot of notifications to read, but they're there
for a reason. If Microsoft decided to kill off a service they might suggest a better alternative...
or at least an alternative. In any case you'll want to take action and plan some sort of change
before you just lose access to it and have to explain to the rest of the business what happened.
The cloud changes quickly... yeah we already covered that, but here's a bit you might have missed:
you need to keep up! Gone are the days where you could just sit back on the same software stack for
10 years. If one half of your infrastructure (the cloud) is getting upgraded every single day and
you leave the rest lagging behind, then sooner or later you're going to run into problems.
The idea is that you upgrade everything, every single version, straight away... but I know that
can be a struggle for many organisations, so let me put it into a familiar lifecycle.
The traditional Microsoft lifecycle was that you get five years of mainstream support followed by
five years of extended support. Mainstream meant feature and compatibility updates.
Extended meant security patches and nothing else. Obviously Microsoft wanted you to upgrade to the
latest version every three years or so and you said "Nah, I'll do it every five"; and then
some of you said "five" and actually meant "ten", justifying it as "sweating your assets".
I mean you can't have a compatibility issue if everything you own is a decade old, right?
I'm not condoning that, I just know for a fact that some of you were doing it. The problem now is as
soon as you go past mainstream support there's no guarantee anything will continue to work. It's not
getting compatibility updates and the cloud end is constantly updating. Microsoft have a habit of
threatening to block old software from connecting and then not following through on it, but they will
eventually get round to it. More to the point, if there is a security issue that can be mitigated
by blocking software that's out of mainstream support, they will just kill it and say "Told you
so". You might cry if that happens to you, but here's the deal: the cloud thing has responsibilities on
both sides. By signing up you are effectively committing to keeping your end up to scratch.
Don't think you can just keep running stuff for 10 years and it will all be fine. In fact, for a lot of
modern systems that five and ten year lifecycle is a thing of the pas. Mainstream support may
now only last a matter of months if you're not patching regularly. Stay on top of your updates!
We're into the top three now and I've got a slightly controversial one: backups. Microsoft
do not provide you with backups you need to bring your own. Why is this controversial?
Because salespeople like to tell you the cloud is bulletproof and you don't need backups.
They're wrong. Office 365 is very resilient. Office 365 has a lot of data retention and undo features.
There are still a number of ways you can lose data and not be able to recover without a third-
party backup. I have an entire video about this so I'll link it up here and in the video description.
Here's the bottom line, though; I have come across multiple examples of data
loss in Office 365 that could not have been prevented using its native tools.
As to what Microsoft say about this? It's in your services agreement. Maybe you didn't read it, but it
plainly tells you that you should use a third-party backup service. I've had to give a few companies the
bad news that their data is gone before and I don't like doing it. Get yourself a backup!
Here comes number two and it's all about the dark side of sharing and collaboration.
Office 365 is great at empowering people to collaborate and share information - even with people
outside your organisation. The problem is that if you just let people at it, it will very quickly
become a wild west. It'll be an unstructured and unmanageable mess, and you won't have any clue
where your data has ended up. This is a security and compliance nightmare. It's a big offender when
it comes to security breaches and it can become so confusing for people that they'll just give up trying
to use it. It is very important (especially for large organisations) that you put some thought
into your strategy, first. Understand your data, design your strategy, and plan your governance.
Remember the seven Ps: Proper Planning and Preparation Prevents Piss Poor Performance.
It matters here, too. It is much easier to get it right from the start than it is to try and reel
it all back in afterwards - closing the door after the horse has bolted, so to speak. If you
design it properly and plan the rollout you can improve adoption and help people reap the benefits
without opening Pandora's box and putting your organisation at risk.
Last tip. Have you guessed it yet? Use multifactor authentication. Don't
think about it, don't put it in a risk log, just do it! It's really not that difficult.
There is a basic version included with every Office 365 subscription,
and it blocks 99.9% of account compromise attacks. I cannot stress this enough. I know
intelligent people, people I respect, who are just too lazy to do this; and it's really dumb. It is
such an easy way to mitigate your risk. If you've not done it, do it right now! I'll pop another link
up here and in the description to a video I made about multifactor authentication. It was my first
ever video so it probably looks a bit dated now, but there's a reason I picked it as my first topic:
it's important! Go. Go do it. Go do it now. I'll wait - there's a pause button. Actually, that was number
one so the video is almost over. There are a couple of other important things you need to do, though.
You need to hit the like button because you're still here and I consider that to be you liking
this content. If you just squidge a bit over from there, there's a subscribe button, too. If it's red,
that's YouTube's way of telling you you forgot to click it. Seriously, though; I hope this has been
helpful. There are a lot more useful tips I could have covered so if there's something you think
should have made the top seven then drop it in the comments. In fact, what are your top seven tips?
Pop them down in the comments then scroll all the way back up here and click on one of these videos;
because if you don't, YouTube will make me go away and I'll be stuck in your computer until you come
back. That's how the internet works... I think. Thanks for watching, guys. See you next time!