Moving to Microsoft 365 is only the beginning. This article looks at how Teams, SharePoint, managed devices, backup, access controls, and documentation can work together in a compliance-first environment without making everyday work harder.

Moving Huntzberry Civil Construction to the cloud was never just about getting rid of servers. It involved business applications, internet connectivity, computers, files, permissions, security, employee workflows, backup and eventually AI. This is how I approached the project and what changed along the way.

Microsoft is moving businesses toward passkeys and phishing resistant authentication. Here is what small business owners need to know about Microsoft 365 passkeys, Windows Hello, Authenticator, password managers, YubiKeys, new phones and account recovery.

Your Microsoft 365 may be working, but is anyone actually managing it? Microsoft changes, your business changes and configurations can drift over time. Here’s what small businesses should know about security, licensing, permissions, Copilot and knowing what is really in place.

A law firm's Microsoft 365 environment contains email, client information and conversations involving financial transactions, which makes business email compromise particularly concerning. I look at how BEC works, the Microsoft 365 protections I want configured, why MFA isn't enough by itself, and why firms should periodically check for configuration drift.

I have worked with small healthcare organizations that believed they were HIPAA compliant because they were using Microsoft 365. I understand how they got there. Microsoft talks about HIPAA, provides a Business Associate Agreement for covered services and offers security tools that can be used to protect electronic protected health information, commonly called ePHI. If you are a small practice owner who depends on an outside IT company to manage all of this for you, it is rea

Your Microsoft 365 environment may be working every day, but that doesn't mean it is configured, secured or managed the way you think it is. A Microsoft 365 Tenant Audit looks beneath the surface at licensing, identity, devices, Defender, SharePoint, third-party applications, vendor access, backup, AI readiness and the controls protecting your business.

Microsoft 365 includes built in recovery tools, but does your business know what it can actually recover when something goes wrong? Learn how Microsoft 365 backup, OneDrive, SharePoint, retention, and a layered recovery strategy can help protect your small business data.

Microsoft 365 is more than email and Office apps. Learn what small businesses should know about Business Premium, MFA, device management, email security, SharePoint, backups, third-party applications and preparing Microsoft 365 for AI.

Sometimes an IT problem that looks fairly simple at first exposes a much bigger issue underneath. I saw that firsthand with a small law firm I support when an employee left the firm and other employees suddenly lost access to files they had been using. What initially appeared to be a file-access problem turned out to be an issue with how the firm's data had been stored and shared. This kind of Microsoft 365 data loss can happen when a business doesn't realize that important s

Updated August 2026: I originally wrote about this client after helping a small defense contractor deal with a compromised Microsoft 365 email account. Since then, what started as an email security problem has become a much larger conversation about Microsoft 365 for small DoD contractors, CUI, and what CMMC Level 2 actually changes in the technology environment. The company handles Controlled Unclassified Information, or CUI, which means the conversation has expanded well be

Should your small business move everything to the cloud? I look at the security, workflow, compliance and technology questions I consider before recommending cloud, on premises or hybrid IT.

A suspicious email led to the discovery that a law firm’s Microsoft 365 account had been compromised for months. See what I found, how I investigated the firm’s email environment, and the security changes I implemented to better protect its email, identities, and Microsoft 365 environment.

What started as a concern about backups turned into a full IT Baseline Assessment and technology overhaul for a small law firm. I uncovered shared accounts, unmanaged computers, an ineffective backup solution, and years of client files stored on an employee’s everyday PC. Here’s how I rebuilt the environment with dedicated file storage, Microsoft Entra ID, stronger Microsoft 365 security, backup, monitoring, and documentation.

Most small businesses using Microsoft 365 do not realize their accounts are open to the world by default. In this post, I share a real-world example of how I helped a client recover from an email breach, then took their security further with country-based restrictions, passkeys, and Microsoft Defender for Business. Learn how to protect your accounts and keep your data safe.

A real Microsoft 365 account compromise showed why having MFA enabled is only part of the security conversation. Learn how passkeys, phishing resistant authentication, Conditional Access, and Microsoft's changing authentication requirements are reshaping how small businesses protect their accounts.

A cyberattack is not always obvious. Learn the warning signs I look for across Microsoft 365, email, devices and networks, plus why preserving evidence, screenshots, timestamps and logs matters when investigating a possible compromise. Why? Because attackers count on you not having strong protections in place. Over the years, I have helped small business owners identify threats they were unaware of. Emails were being sent from their accounts. Their systems slowed down. Cli

A healthcare business came to me needing to address HIPAA requirements and CARF accreditation, but first we had to understand where their technology stood. This real client story covers the IT Baseline Assessment, security improvements, cloud transition, incident response planning, and how those changes helped the business stay operational when a severe storm later damaged its office and IT equipment.