Setting up Microsoft 365 for a small office

The three business plans and what they cost

Microsoft sells three main plans for businesses with up to 300 users. The prices below come from Microsoft's United States plan pages on 10/16/2026 and are per user, per month, for the versions that include Teams. Versions without Teams cost less, and Microsoft also sells higher-priced versions bundled with Microsoft 365 Copilot ($23.50 for Standard and $32.00 for Premium, paid yearly).

• A yearly commitment saves money but locks in your license count for the year.
• A monthly subscription costs more but lets you add or remove people as staff changes.

What Business Premium adds

Business Standard covers what most people think of as Office. Business Premium keeps all of that and adds tools that protect the business when a laptop is lost or a password is stolen. According to Microsoft's comparison page, Premium adds:

• Intune Plan 1: management of company laptops and phones, so you can require a screen lock, push updates and wipe a lost device.
• Defender for Business: protection on each computer that watches for malware and suspicious behavior.
• Advanced identity and access management with Microsoft Entra ID: rules about who can sign in, from where and from which devices. Basic and Standard include only the free version of Entra ID.
• Data loss prevention (DLP) for email and files: rules that warn or block when someone tries to send sensitive information outside the company.
• A 1.5 TB email archive per user, compared with 50 GB on Basic and Standard. Every plan includes a 100 GB primary mailbox.

A setup checklist in plain words

Work through these steps in order. Each one is small, and together they close the most common gaps.

• Connect your domain. Add your web address (for example, yourbusiness.com) in the Microsoft 365 admin center so that email uses your name instead of the onmicrosoft.com address that Microsoft assigns.
• Separate the admin accounts. Microsoft recommends fewer than five Global Administrators, the role that can change almost every setting. Give the owner a normal daily account and a separate admin account used only for settings.
• Create two emergency access accounts. Microsoft recommends two cloud-only emergency accounts that are not tied to one person, kept for the day every other admin gets locked out. Store their credentials somewhere safe and offline.
• Turn on multifactor authentication (MFA) for everyone. MFA means a second proof at sign-in, such as an app prompt on a phone. Microsoft says an account is 99.9% less likely to be compromised with MFA. On Basic or Standard, the free security defaults handle this. Microsoft says organizations with premium Entra ID licenses usually use Conditional Access rules instead, which allow more control.
• Set up email authentication. Publish an SPF (Sender Policy Framework) record that lists Microsoft as an allowed sender, turn on DKIM (DomainKeys Identified Mail) signing with the two records Microsoft gives you, and add a DMARC (Domain-based Message Authentication, Reporting and Conformance) record. Microsoft notes that custom domains do not DKIM sign mail until you complete this step.
• Plan for backup. Exchange Online keeps deleted items for 14 days by default, adjustable up to 30 days. After that, the item is gone. A separate backup service covers mistakes that someone notices later.
• Enroll the devices. On Premium, enroll each company computer in Intune and turn on Defender for Business, so that every machine gets the same updates and protection.
• Write it down. Record who has admin rights, where the emergency accounts are stored and which services send email for your domain.

The MFA changes from Microsoft in 2025 and 2026

Microsoft has been making MFA mandatory in stages. Since February 2025, Microsoft has gradually required MFA to sign in to the Microsoft 365 admin center. A second phase covers command-line and automation tools that change Azure resources. That phase began on 10/01/2025, and Microsoft allowed customers with technical barriers to postpone it only until 07/01/2026.

Microsoft also removed the old 14-day grace period for MFA registration on 07/29/2024, so new users must register right away when security defaults are on. Starting 07/01/2026, new tenants also block an older sign-in method called device code flow as part of security defaults. For a small office, the practical result is simple: plan for every person, and especially every administrator, to use MFA from day one.

Common mistakes

• Using the owner's daily email account as the Global Administrator.
• Leaving a former employee's account active, or sharing one login among several people.
• Turning on DMARC enforcement before every service that sends mail for you, such as a newsletter tool or billing system, is set up correctly.
• Assuming Microsoft keeps every deleted email forever.
• Buying Premium and never turning on the device management and security features that justify its price.

How Webflect can help

If you would rather not work through this list alone, Webflect recommends Microsoft 365 Business Premium for most small offices and handles setup, security and backup for offices of 1 to 15 people. You can read about IT support or compare the IT plans whenever it suits you.