Randtech I.T.

Category: IT Guides

  • Why Microsoft 365 Still Needs Independent Backup

    Why Microsoft 365 Still Needs Independent Backup

    Introduction

    Microsoft 365 is the backbone of many South African small and medium-sized businesses. It offers email, collaboration, file storage and productivity tools in a single subscription — a compelling value for organisations in Johannesburg and beyond. However, Microsoft’s shared responsibility model means that some critical aspects of data protection remain the customer’s responsibility.

    This article explains why Microsoft 365 still needs independent backup, the common risks businesses face, compliance and recovery considerations in a South African context, and practical steps to implement a resilient backup strategy.

    What Microsoft 365 protects — and what it doesn’t

    Microsoft protects the availability of the Microsoft 365 infrastructure and provides built-in recovery tools for certain scenarios. But that protection is not the same as a comprehensive backup designed for long-term retention, point-in-time restores and legal discovery.

    Microsoft’s strengths

    • High availability and geographically distributed infrastructure.
    • Redundancy to keep services running during outages.
    • Basic restore capabilities for deleted items within retention windows.

    Where independent backup is needed

    • Accidental deletion beyond retention periods.
    • Malicious insider actions or compromised accounts.
    • Ransomware that encrypts or deletes cloud-hosted files.
    • Legal and compliance requirements for long-term retention and eDiscovery.
    • Retention gaps when subscriptions or licences change.

    Common data loss scenarios for South African SMEs

    Understanding typical failure modes helps prioritise backup decisions.

    Human error

    Employees frequently delete emails or documents accidentally. If the deletion passes Microsoft’s retention window or version history, the content can be gone for good without an independent backup.

    Security incidents

    Compromised accounts and ransomware attacks are rising in South Africa. Attackers who gain access to Microsoft 365 can delete or alter content across Exchange, SharePoint and OneDrive. An immutable, independent backup helps recover clean copies without paying ransom.

    Compliance and litigation

    SMEs working with regulated industries or on public contracts may need to retain records for specific periods. A third-party backup provides defensible retention policies and easier eDiscovery than relying on native tools alone.

    Key benefits of independent Microsoft 365 backup

    • Point-in-time restores for mailboxes, SharePoint sites and OneDrive files.
    • Longer, custom retention schedules to meet legal requirements.
    • Protection against account compromise and ransomware.
    • Operational simplicity for restores — less downtime and faster recovery.
    • Separation of duties: backups isolated from the primary tenant reduce single points of failure.

    What to look for in a Microsoft 365 backup solution

    Not all backup offerings are equal. When evaluating options for a South African SME, prioritise these capabilities:

    Comprehensive coverage

    Ensure the solution covers Exchange Online, SharePoint Online, OneDrive for Business, Teams and group mailboxes. Verify it preserves metadata, permissions and version history where possible.

    Retention flexibility and immutability

    Choose solutions that allow custom retention periods and support immutable storage to defend against tampering or accidental deletion.

    Efficient storage and cost control

    Look for deduplication, incremental backups and pricing that aligns with your budget. For SMEs, predictable monthly costs in ZAR (Rands) make planning easier.

    Fast, granular restore options

    Ability to restore single items, full mailboxes, or entire SharePoint sites quickly is crucial to reduce business disruption.

    Local expertise and support

    Work with a partner who understands South African business conditions, compliance expectations and can offer hands-on support when you need it.

    Implementing a practical backup strategy

    Below is a practical approach tailored for South African SMEs that balances protection with cost and operational needs.

    1. Assess your data and risk

    Identify critical data stores in Microsoft 365 and classify them by business impact. Prioritise mailboxes of key personnel, financial records, contracts and project documents stored in SharePoint.

    2. Define retention and recovery objectives

    • Recovery Time Objective (RTO): how quickly you need data restored.
    • Recovery Point Objective (RPO): how much data loss is acceptable.
    • Retention periods driven by compliance and business needs.

    3. Choose the right backup product

    Select a solution that covers your selected workloads, supports immutability and fits your budget. Prefer vendors with local or regional support partners.

    4. Test backups and restores regularly

    Schedule periodic restore tests to confirm recoverability. Testing reduces surprises during real incidents and keeps your team confident in the process.

    5. Combine with strong security practices

    Backups are part of a broader security posture. Implement MFA, least privilege access, conditional access policies and effective endpoint protection to reduce attack surfaces.

    Cost considerations for South African SMEs

    Budgeting for independent backup need not be prohibitive. Many backup providers offer tiered plans suitable for SMEs, with predictable monthly pricing in ZAR. Factor in:

    • Licence and per-user costs.
    • Storage consumption driven by retention and change rates.
    • Support and managed services if you prefer offloading administration.

    Working with a trusted local MSP can simplify procurement, implementation and ongoing support — avoiding costly mistakes and time spent on in-house management.

    Frequently asked questions

    Does Microsoft not back up my data automatically?

    Microsoft maintains infrastructure availability and short-term recovery capabilities, but it does not take responsibility for long-term retention, point-in-time restores beyond native retention windows, or protection against deliberate deletion by users.

    How long does Microsoft retain deleted items?

    Retention varies by service and configuration. Native recovery windows may be short or dependent on specific retention policies — which can leave gaps for organisations needing longer-term archives.

    Will having a backup protect me from ransomware?

    An independent, immutable backup is a key defence against ransomware because it enables recovery to a clean state without paying a ransom. Backups must be properly secured and tested to be effective.

    Can I manage backups myself or should I use a managed service?

    SMEs can use self-managed solutions, but many benefit from a managed service that brings experienced engineers, local support and faster resolution — freeing internal teams to focus on core business activities.

    Is independent backup required for compliance?

    Depending on your industry and contractual obligations, independent backup may be necessary to meet retention and eDiscovery requirements. Consult your legal or compliance adviser to confirm obligations.

    Conclusion

    Microsoft 365 provides robust infrastructure and useful native recovery features, but it is not a substitute for independent backup. South African SMEs face specific risks — accidental deletion, ransomware and compliance demands — that call for a deliberate backup strategy.

    Implementing independent backups with clear retention policies, immutable storage and regular restore testing will reduce downtime, protect your data and help meet regulatory obligations. Partnering with a local MSP can simplify the process and provide experienced support when it matters most.

    Contact RandTech IT — if you’d like practical, experienced help protecting your Microsoft 365 data, our engineers prioritise fast resolution and understand the needs of South African SMEs. Reach out to RandTech IT for a straightforward assessment and tailored backup solution.

  • How to Secure Microsoft 365 Against Account Takeover

    How to Secure Microsoft 365 Against Account Takeover

    Introduction

    Account takeover is one of the most common and damaging cyber threats for small and medium-sized businesses (SMBs). For South African organisations using Microsoft 365—email, Teams, OneDrive and SharePoint—a compromised account can expose sensitive client data, interrupt operations and damage reputation. This guide explains practical, cost-effective steps SMBs in South Africa can implement to secure Microsoft 365 against account takeover.

    Understand the risk

    Account takeover typically starts with credential theft—phishing, reused passwords or leaked credentials—and escalates through privilege abuse and lateral movement. In the Microsoft 365 environment, attackers target admin accounts, mailboxes and file shares because they provide broad access.

    Why SMBs are at risk

    • Limited IT resources often mean basic controls are missing.
    • Users may reuse passwords across personal and work accounts.
    • Remote or hybrid work increases login attempts from varied locations.

    Core controls to prevent account takeover

    Start with these high-impact controls. They’re practical for small teams and deliver measurable protection.

    1. Enforce multi-factor authentication (MFA)

    MFA is the single most effective control to prevent account takeover. Require it for all users, not just admins. Use app-based authenticators or hardware tokens rather than SMS when possible, since SMS can be intercepted.

    2. Apply conditional access policies

    Conditional access lets you require stronger authentication or block access based on risk factors such as location, device compliance and sign-in risk. For Johannesburg- or Gauteng-based offices, set trusted locations and restrict high-risk countries.

    3. Harden admin accounts

    • Use dedicated admin accounts: no email, no regular browsing.
    • Require MFA and stronger authentication for all admin roles.
    • Limit the number of users with Global Administrator privileges.

    4. Enforce strong password policies and passphrases

    Encourage passphrases and ban legacy patterns like “Password123”. Use Azure AD password protection to block common or compromised passwords and consider passwordless options like Windows Hello for Business or FIDO2 security keys for critical users.

    5. Enable mailbox and audit logging

    Turn on unified audit logging and mailbox auditing. Logs help you detect suspicious activity—like mass forwarding rules or mailbox delegation—that often accompany account takeover.

    Detection and response

    Preventive controls reduce risk, but detection and response minimise damage if an account is compromised.

    Monitor sign-in activity

    Regularly review sign-in reports in the Azure portal. Look for unusual patterns such as sign-ins from unexpected countries, impossible travel indicators or repeated failed attempts.

    Set up alerting and automated actions

    Configure Microsoft Defender for Office 365 and Azure AD Identity Protection to alert on and automatically respond to risky sign-ins—forcing password resets, blocking access or requiring reauthentication.

    Incident response playbook

    1. Isolate the compromised account: disable sign-in if needed.
    2. Reset the user’s credentials and revoke active sessions and refresh tokens.
    3. Search mailboxes and SharePoint for suspicious forwarding rules, sharing links and data exfiltration.
    4. Restore from known-good backups if data was corrupted or deleted.
    5. Document and review the incident to close gaps in controls.

    Protect email and data

    Email is a primary target. These measures reduce exposure and harden communications.

    Anti-phishing and safe attachments

    • Enable Microsoft Defender for Office 365 anti-phishing policies.
    • Use Safe Links and Safe Attachments to inspect content in transit.

    Control external sharing

    Restrict external sharing on SharePoint and OneDrive where possible. Require link expiration and limit sharing to authenticated users. Regularly review externally shared content and revoke access that’s no longer required.

    Endpoint and device controls

    Compromised endpoints are a common attack vector. Ensure devices connecting to M365 meet minimum security standards.

    Use Microsoft Intune or an MDM solution

    • Enforce device encryption, PINs and updated operating systems.
    • Require device compliance before granting access via conditional access policies.

    Patch and antivirus

    Maintain a patch schedule and run reputable endpoint protection. For smaller firms, managed services can handle these tasks consistently and cost-effectively.

    Policies, training and governance

    Technical controls are essential, but people and processes complete the defence.

    User awareness training

    Phishing simulations and focused training reduce the chances of credential theft. Keep sessions short and practical—show examples relevant to South African business contexts, such as fake SARS or banking emails.

    Least privilege and access reviews

    • Apply least privilege principles across M365 roles and groups.
    • Perform periodic access reviews and remove inactive or unnecessary accounts.

    Backups and business continuity

    Microsoft 365 provides high availability but native retention doesn’t replace backups. Use third-party backup solutions to protect against accidental deletion, ransomware and long-term retention needs.

    Cost-conscious approaches for South African SMBs

    SMBs must balance security with budget. Prioritise controls that yield the greatest reduction in risk for the lowest cost.

    • Start with organisation-wide MFA—low cost, high impact.
    • Adopt conditional access rules for risky scenarios rather than broad licensing upgrades immediately.
    • Consider managed security services to get experienced engineers without hiring full-time specialists.

    If budget is limited, focus on the critical user accounts (finance, HR, executive) first and expand controls as resources allow.

    Conclusion

    Securing Microsoft 365 against account takeover requires a combination of identity controls, device management, monitoring and user education. For South African SMBs, practical steps—MFA, conditional access, admin hardening, logging and backups—deliver meaningful protection without excessive cost. Consistent policies and a tested incident response plan will reduce downtime and business impact when incidents occur.

    FAQ

    1. Is MFA enough to stop account takeover?

    MFA significantly reduces risk but is not a silver bullet. Combine MFA with conditional access, password protection and monitoring for comprehensive protection.

    2. Can my small business afford these controls?

    Many controls—like MFA, password policies and basic logging—are low-cost or included in Microsoft 365 plans. Managed security services can provide expertise cost-effectively for smaller budgets.

    3. How quickly should I respond to a suspected compromise?

    Isolate the account immediately, reset credentials, revoke sessions and search for suspicious activity. Acting within hours can prevent lateral movement and data loss.

    4. Do I need extra backup for Microsoft 365?

    Yes. Native retention may not meet regulatory or recovery needs. Third-party backups protect against accidental deletion, ransomware and long-term retention requirements.

    5. What role does user training play?

    User training reduces the likelihood of credential theft via phishing. Regular, relevant sessions and phishing simulations improve resilience significantly.

    Get practical help

    If your business needs experienced engineers to secure Microsoft 365 quickly and correctly, RandTech IT can help. We focus on fast resolution by seasoned technicians who implement proven controls with minimal disruption. Contact RandTech IT to arrange a review and practical next steps tailored to your environment.

  • Common Microsoft 365 Migration Mistakes and How SA SMEs Can Avoid Them

    Common Microsoft 365 Migration Mistakes and How SA SMEs Can Avoid Them

    Introduction

    Migrating to Microsoft 365 offers South African small and medium-sized businesses better collaboration, modern security controls and reduced on-premise overheads. However, the migration process is where many organisations incur avoidable costs, downtime and frustration. This guide highlights the most common Microsoft 365 migration mistakes and gives practical steps SA SMEs can take to avoid them.

    Why migrations go wrong

    Many migration failures are not caused by the cloud itself but by weak planning, poor data hygiene and assumptions about user behaviour. For SMEs in Johannesburg and Gauteng, lost productivity can stall projects and affect clients. Understanding the main risk areas helps you prioritise effort and budget effectively.

    Top mistakes and how to avoid them

    1. Skipping a thorough discovery and inventory

    Mistake: Organisations begin migrations without a detailed inventory of mailboxes, shared files, applications and third-party integrations.

    How to avoid it:

    • Run an audit of mailboxes, file shares, SharePoint sites and active applications.
    • Identify legacy apps that may need reconfiguration or replacement.
    • Map data owners and usage patterns to prioritise what moves first.

    2. Underestimating data cleanup and quality

    Mistake: Migrating duplicate or obsolete data increases storage costs and prolongs migration time.

    How to avoid it:

    • Use deduplication tools and implement a retention policy before migrating.
    • Archive or delete old mailboxes and files where appropriate.
    • Communicate with teams about what should be retained versus archived.

    3. Neglecting security and compliance considerations

    Mistake: Treating migration as purely a technical move and overlooking governance, data sovereignty and access controls.

    How to avoid it:

    • Review Microsoft 365 compliance features (retention labels, eDiscovery, audit logs).
    • Ensure identity and access policies are defined, including MFA and conditional access.
    • Confirm where data will reside; if required, document controls for POPIA compliance.

    4. Failing to plan for identity and authentication

    Mistake: Identity misconfigurations cause login failures and lost access during cutover.

    How to avoid it:

    • Choose the right identity model: cloud-only, Azure AD Connect, or federation.
    • Test Azure AD Connect sync in a pilot environment and validate password flows.
    • Enable multi-factor authentication for administrators and critical users early.

    5. Inadequate testing and pilot migrations

    Mistake: Skipping small-scale pilots leads to surprises when the full migration runs.

    How to avoid it:

    • Run pilot migrations with representative users and high-volume mailboxes.
    • Test mail flow, calendar sharing, permissions and third-party integrations.
    • Document discovered issues and update the migration runbook accordingly.

    6. Poor communication and change management

    Mistake: Users are unprepared for new workflows, causing productivity loss and helpdesk overload.

    How to avoid it:

    • Create clear communications about timelines, expected downtime and end-user actions.
    • Provide quick-start guides and short training sessions focused on daily tasks.
    • Allocate local super-users who can assist colleagues on the day of cutover.

    7. Not planning for backups and rollback

    Mistake: Assuming Microsoft 365 replaces backups and not having a rollback strategy.

    How to avoid it:

    • Maintain backup solutions for critical mailboxes and SharePoint libraries during migration.
    • Define rollback criteria and checkpoints in the migration schedule.
    • Test restore procedures before decommissioning legacy systems.

    8. Under-resourcing the migration effort

    Mistake: Treating migration as a side project for busy IT staff, which causes delays and mistakes.

    How to avoid it:

    • Assign a dedicated migration project lead and skilled engineers for the cutover window.
    • Consider external migration specialists for complex scenarios to speed resolution.
    • Budget realistically for tools, training and possible consultancy support (include contingency).

    Practical checklist for South African SMEs

    1. Complete a discovery and data inventory.
    2. Cleanse and archive unnecessary data.
    3. Choose and test the identity model and enable MFA.
    4. Run pilot migrations and validate key workflows.
    5. Communicate plans, provide training and appoint super-users.
    6. Ensure backups and a rollback plan are in place.
    7. Schedule the migration with enough technical resource and contingency time.

    Local considerations for South African businesses

    SMEs in South Africa should consider connectivity and cost factors. Internet outages or limited bandwidth during migration windows can slow bulk transfers—work with your ISP to schedule increased throughput if required. Budgeting should factor in possible additional hours from experienced engineers rather than assuming internal learning time. Using local specialists who understand POPIA and regional compliance expectations reduces the risk of oversights.

    FAQ

    How long does a typical Microsoft 365 migration take for an SME?

    Times vary with data volume and complexity. A simple mailbox-only migration for a small team can take days, while full tenant migrations with SharePoint and apps may take weeks. Always plan pilots and build in contingency.

    Do I need to back up Microsoft 365 data?

    Yes. Microsoft provides platform resilience but not full long-term backup/restore for user-deleted items or specific business retention needs. Use a third-party backup solution during and after migration.

    Can we migrate outside business hours to avoid downtime?

    Yes. Staging work and cutovers outside peak hours reduces user disruption, but ensure support staff are available if issues arise during the scheduled window.

    Is Azure AD Connect required?

    Not always. Azure AD Connect is needed when you want to synchronise on-prem Active Directory identities with Azure AD. For cloud-only deployments, it isn’t required, but plan identity strategy based on your environment.

    How can we ensure POPIA compliance during migration?

    Document data flows, enable appropriate retention and access controls, restrict administrative access, and keep audit logs. Work with specialists who understand local compliance requirements.

    Conclusion

    Migrating to Microsoft 365 brings clear benefits but also common pitfalls that can be avoided with proper planning, testing and the right expertise. For South African SMEs, practical steps—discovery, data hygiene, secure identity, thorough testing and clear communication—will reduce risk and speed a successful move.

    Need help avoiding migration mistakes? RandTech IT specialises in practical, experienced Microsoft 365 migrations for South African SMEs. Contact us to plan a smooth, secure migration led by engineers who resolve issues quickly rather than learning on your time.

  • Common Microsoft 365 Migration Mistakes & How to Avoid Them

    Common Microsoft 365 Migration Mistakes & How to Avoid Them

    Introduction

    Migrating to Microsoft 365 can transform how your small or medium-sized business operates: better collaboration, cloud storage and modern security controls. But migrations that are rushed or poorly planned can cause downtime, data loss and frustrated users. This article outlines the most common Microsoft 365 migration mistakes South African SMBs make and provides clear, practical steps to avoid them.

    1. Skipping a formal migration plan

    One of the biggest mistakes is treating migration as a simple switch instead of a project. A migration plan defines scope, timeline, responsibilities and rollback steps.

    Why a plan matters

    • Prevents surprises and scope creep
    • Ensures stakeholders know their roles
    • Allows for realistic scheduling to avoid peak business hours

    Practical checklist items

    • Inventory of users, mailboxes, shared drives and applications
    • Risk assessment and contingency plan
    • Timeline with test, pilot and cutover phases
    • Communication plan for staff

    2. Underestimating data complexity and volume

    Estimate the amount and types of data to migrate. Many businesses assume emails and documents are straightforward, but hidden complexities can derail a move.

    Common data issues

    • Large PST files and archived mailboxes
    • File path length and unsupported characters for OneDrive/SharePoint
    • Legacy file permissions and shared drive structures

    How to mitigate

    • Run a discovery and reporting tool to map data size and structure
    • Clean up old or redundant files before migrating
    • Plan for permission mapping and restructure shares if necessary

    3. Neglecting identity and authentication

    Poor planning for identities leads to login failures, sync issues and security gaps. Decide early whether to use cloud-only Azure AD, hybrid identity or federation.

    Key considerations

    • Directory sync (Azure AD Connect) configuration and health checks
    • Password sync versus single sign-on (SSO) and conditional access
    • Impact on existing on-premises services like file servers or line-of-business apps

    Recommendations

    • Test Azure AD Connect in a pilot environment
    • Enable multi-factor authentication for all administrators and users
    • Document account mappings and any required federated setups

    4. Ignoring application compatibility and integrations

    Microsoft 365 will interact with many applications—ERP, payroll, invoicing and CRM systems. Overlooking integrations can break business-critical workflows.

    What to check

    • Third-party apps that rely on on-prem Exchange or LDAP
    • Line-of-business applications with hardcoded SMTP settings
    • Custom scripts and scheduled tasks that access local file paths

    How to prepare

    • Catalogue integrations and test each in a staging environment
    • Coordinate with vendors for supported configuration changes
    • Plan cutover windows for any services that require reconfiguration

    5. Insufficient user communication and training

    Technical success can still feel like failure if users don’t know how to use new tools. Poor communication leads to helpdesk overload and decreased productivity.

    Best practices

    • Provide simple, role-based guides for Outlook, Teams, OneDrive and SharePoint
    • Run training sessions for power users and departmental champions
    • Share a clear schedule for cutover and expected user impacts

    6. Failing to secure data and meet compliance

    Security missteps are costly. Ensure data protection, retention policies and compliance settings are configured before going live.

    Security settings to configure

    • Data Loss Prevention (DLP) rules for sensitive information
    • Retention policies and legal hold for regulated industries
    • Conditional Access to enforce device and location rules

    Local considerations

    South African SMBs should consider POPIA implications for personal data processing and ensure adequate controls and documentation are in place.

    7. Not testing and running a pilot

    Skipping pilots increases risk. A staged rollout identifies issues on a small scale and enables adjustments before full migration.

    Pilot structure

    1. Select a representative department or group
    2. Migrate mail and files for that group first
    3. Collect feedback and refine processes

    8. Overlooking backups and recovery plans

    Many assume Microsoft 365 negates the need for backups. Native retention is useful, but independent backups protect against accidental deletion, ransomware and configuration mistakes.

    Backup strategy essentials

    • Independent backups for Exchange, OneDrive, SharePoint and Teams
    • Defined Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO)
    • Regular restore tests documented and reviewed

    9. Poor change management and support model

    Without clear support, users will revert to old habits or leave gaps unreported. Define who handles first- and second-line support and how escalation occurs.

    Support recommendations

    • Provide a temporary elevated support level during and after cutover
    • Assign departmental champions as first contacts
    • Track incidents and lessons learned for future projects

    10. Budgeting mistakes and hidden costs

    Under-budgeting leads to corners being cut. Account for licensing, consultancy, migration tools, training and potential hardware upgrades.

    Typical cost items to include

    • Microsoft 365 licences and any add-on services
    • Migration tools or third-party consultants
    • User training time and temporary productivity loss

    Conclusion

    A successful Microsoft 365 migration for South African SMBs depends on planning, testing and experienced execution. Address identity, data, security, compatibility and user readiness up front to reduce risk and disruption. Taking the time to pilot, backup and document the migration pays off in faster adoption and fewer support incidents.

    Frequently Asked Questions

    1. How long does a typical Microsoft 365 migration take?

    Duration varies with size and complexity. For a small business with 10–50 users it may take days to a few weeks; larger or more complex environments can take several weeks to months. A discovery phase gives a reliable estimate.

    2. Will Microsoft 365 keep my data backed up?

    Microsoft provides retention and basic recovery, but it is not a substitute for independent backups. Third-party backup solutions offer point-in-time recovery and protection against accidental deletion or ransomware.

    3. Do we need to keep on-premises servers after migration?

    Not always. Some businesses keep directory controllers or file servers for legacy applications. A hybrid approach is common during transition; the long-term goal can be a full cloud migration if compatibility allows.

    4. What are common licensing pitfalls?

    Choosing the wrong licence tier for business needs can leave you without features such as DLP or advanced threat protection. Review required features and licence types during planning to avoid surprises.

    5. How do we prepare staff for the change?

    Communicate early, provide role-based training, run short how-to guides for core tasks and appoint power users as champions to help colleagues during and after cutover.

    6. Should we hire an external team for migration?

    Engaging experienced engineers reduces risk and accelerates resolution of unforeseen issues. For many SMBs, an expert partner is a cost-effective way to ensure a smooth migration.

    Ready to avoid these common Microsoft 365 migration mistakes? RandTech IT’s experienced engineers prioritise fast, practical resolution so your migration is smooth and minimally disruptive. Contact RandTech IT to discuss a tailored migration plan for your business.

  • Why Microsoft 365 Still Needs Independent Backup

    Why Microsoft 365 Still Needs Independent Backup

    Introduction

    Microsoft 365 is a critical productivity platform for thousands of South African small and medium-sized businesses. It delivers email, file storage, collaboration tools and compliance capabilities that help teams work from Johannesburg to the rest of the country. Yet despite its strengths, Microsoft 365 is not a substitute for a dedicated, independent backup solution. This article explains why independent backup remains essential and what local SMBs should consider when protecting their data.

    What Microsoft 365 does — and what it doesn’t

    Microsoft 365 offers built-in resilience, redundancy and high availability across its services. That protects against datacentre outages and gives businesses continuous access to email, SharePoint, OneDrive and Teams.

    Where Microsoft’s responsibility ends

    Microsoft’s service-level agreements cover platform availability. Microsoft maintains the infrastructure and ensures that services run. However, the company’s shared responsibility model places the onus for data protection, retention policies and recovery in part on the customer.

    Common gaps in Microsoft 365 data protection

    • Accidental deletion: Items removed by users or admins can be permanently lost if not backed up.
    • Retention policy limits: Default retention settings may not meet business, tax or regulatory requirements in South Africa.
    • Ransomware and malware: Infected files synced to cloud storage can propagate and overwrite user data.
    • Legal and compliance needs: eDiscovery and long-term retention may require immutable archives outside Microsoft’s native options.

    Real risks for South African SMBs

    Small and medium businesses in Gauteng and across South Africa face particular pressures: limited IT staff, tight budgets and rising cyber threats. These conditions make the risk of data loss more acute.

    Human error is the most common cause

    Employees and administrators make mistakes. A misapplied retention policy, a bulk delete in SharePoint or an accidental mailbox purge can quickly escalate. Without an independent backup, recovery can be slow or impossible.

    Ransomware and targeted attacks

    Ransomware groups increasingly target cloud accounts and synced endpoints. If attackers gain access to a Microsoft 365 account, they can encrypt or delete cloud files. Independent backups stored separately make recovery feasible without paying ransom.

    Benefits of independent Microsoft 365 backup

    Implementing an independent backup solution gives SMBs control, speed and peace of mind. Key benefits include:

    • Faster recovery: Restore specific mailboxes, files or versions quickly without relying on native recycle bins.
    • Longer retention: Keep data for the time required by your business or industry—beyond Microsoft’s default windows.
    • Protection against account compromise: Backups stored outside Microsoft 365 remain safe if accounts are breached.
    • Granular restore options: Recover individual items, folders or full sites to their original state.
    • Compliance support: Maintain immutable archives and retention policies to satisfy audits and legal holds.

    What to look for in an independent backup solution

    Not all backup products are equal. South African SMBs should evaluate solutions against practical criteria that reflect real-world needs.

    Essential features

    • Automated daily backups: Regular backups with flexible schedules to balance recovery point objectives (RPOs).
    • Point-in-time recovery: Ability to restore data to a specific date and time.
    • Encryption at rest and in transit: Secure data transfers and storage compliant with good practice.
    • Off-platform storage: Backups must be stored independently of the primary Microsoft 365 tenant.
    • Retention and immutability: Configurable retention periods and options for write-once, read-many (WORM) storage.
    • Local support and SLA: Access to responsive, knowledgeable support with clear recovery SLAs suited to SMB budgets.

    Considerations for South African businesses

    Choose a provider familiar with local business needs, such as support hours aligned to South African working times and pricing in rand when possible. Factor in internet connectivity: fast restores may require a hybrid approach where critical backups can be staged on-premises or via local bandwidth optimisation.

    How RandTech IT approaches Microsoft 365 backup

    RandTech IT balances pragmatic protection with cost control for small and medium businesses. We prioritise fast resolution by experienced engineers who minimise client downtime rather than learning on the job.

    Practical deployment steps

    1. Assess current Microsoft 365 configuration and identify data at risk: mailboxes, SharePoint sites, OneDrive accounts and Teams data.
    2. Define retention and recovery objectives with stakeholders, considering compliance and operational needs.
    3. Deploy a dedicated backup solution with off-platform storage and automated schedules.
    4. Test restores regularly and document recovery procedures so that your team can act quickly when needed.
    5. Train relevant staff and provide clear handover documentation—so incidents are resolved efficiently by experienced engineers.

    Costs and ROI for SMBs

    Backup solutions have a clear cost, but losing critical email, customer records or financial documents can be far more expensive. For many SMBs the decision is pragmatic: pay a predictable monthly fee for backup services and reduce the risk of major disruption. Consider phased deployments—protect the most critical data first to manage costs.

    Frequently asked questions

    1. Doesn’t Microsoft keep deleted items in the recycle bin?

    Yes, Microsoft 365 has recycle bins and retention features, but these have limits and can be misconfigured or bypassed. Independent backup offers point-in-time recovery and longer retention control.

    2. How quickly can we recover from a ransomware attack?

    Recovery speed depends on your backup configuration and bandwidth. With a good solution and tested procedures, individual mailboxes or files can often be restored within hours; full tenant restores take longer. RandTech IT focuses on fast, prioritised recovery to reduce business impact.

    3. Do backups increase our Microsoft 365 costs?

    Backups are typically a separate cost from Microsoft licensing. They won’t increase your Microsoft subscription fees but will add a service cost that should be compared to potential data-loss consequences.

    4. Can we keep backups in South Africa?

    Yes. Some backup providers offer local or regional storage options. Storing backups within South Africa can help with compliance and reduce restore latency. RandTech IT can advise on suitable storage choices for your needs.

    5. How often should we test backups?

    Test restores at least quarterly, and after any major change to your environment. Regular testing ensures recovery procedures work and staff know what to do during an incident.

    Conclusion

    Microsoft 365 provides excellent service availability, but it is not a complete backup or archive solution for business data. South African SMBs should adopt an independent backup strategy to protect against human error, retention gaps, ransomware and compliance risks. Practical, tested backups delivered by experienced engineers ensure faster recovery with minimal disruption.

    Contact RandTech IT — If you want practical, experienced assistance designing and managing Microsoft 365 backups, contact RandTech IT. Our engineers prioritise fast resolution so your business can get back to work quickly.

  • How to Secure Microsoft 365 Against Account Takeover

    How to Secure Microsoft 365 Against Account Takeover

    Introduction

    Account takeover of Microsoft 365 can interrupt business, expose sensitive data and lead to costly recovery. South African small and medium-sized businesses (SMBs) face targeted attacks because they hold valuable data but often lack hardened controls. This guide explains practical, prioritised steps you can take today to secure Microsoft 365 against account takeover, tailored to the realities of SMBs in Gauteng and across South Africa.

    Understand the risk and common attack methods

    Attackers use several routes to take over M365 accounts. Knowing these helps you focus defences.

    Phishing and credential harvesting

    Fraudulent emails and fake login pages remain the most common method for stealing credentials. Compromised credentials let attackers bypass perimeter defences quickly.

    Brute force and credential stuffing

    Reused or weak passwords are vulnerable to automated attacks that try large password lists or use leaked credentials from other breaches.

    Legacy protocols and insecure clients

    Older protocols (IMAP, POP) and unpatched email clients can bypass modern authentication and allow direct access.

    Priority controls to prevent account takeover

    Implement the following controls in order of impact. These are cost-effective and feasible for SMBs, including those in Johannesburg and wider Gauteng.

    1. Enforce Multi-Factor Authentication (MFA)

    MFA is the single most effective control to stop account takeover. Require it for all users including administrators. Use app-based authenticators or hardware FIDO2 keys where possible.

    2. Enable Conditional Access

    Azure AD Conditional Access lets you require MFA or block access from risky locations and unmanaged devices. Start with policies that require MFA for:

    • All admin roles
    • Access from outside South Africa if not business-critical
    • Unmanaged or non-compliant devices

    3. Block legacy authentication

    Disallow legacy protocols such as IMAP, POP and SMTP AUTH where possible. These do not support modern authentication and are a frequent attack vector.

    4. Use strong password policies and passphrases

    Encourage long passphrases and ban password reuse. Consider Azure AD Password Protection to block commonly used passwords and leaked credentials.

    5. Harden admin accounts

    Limit the number of global admins. Use dedicated breakout accounts for elevated tasks and protect them with MFA and FIDO2 keys.

    Device and endpoint controls

    Compromised endpoints are often the start of account takeover. Reduce this risk with device management and secure configurations.

    Microsoft Defender and endpoint management

    Deploy Microsoft Defender for Business or equivalent endpoint protection. Use Intune or another Mobile Device Management (MDM) solution to enforce patching, encryption and device compliance.

    Restrict access from unmanaged devices

    Conditional Access can block or limit access for unmanaged endpoints. Require device compliance for access to sensitive apps and data.

    Monitor, detect and respond

    Prevention is essential, but rapid detection and response reduce damage when incidents occur.

    Enable unified auditing and alerts

    Turn on Microsoft 365 audit logs and alerting for suspicious activities like impossible travel, mass mailbox rule creation, forwarding rules and sign-ins from unusual locations.

    Use activity monitoring and analytics

    Azure AD Identity Protection and Microsoft Defender for Office 365 provide risk scores and automated actions for risky sign-ins. Review reports regularly and tune alerts to reduce false positives.

    Establish an incident response plan

    Have a documented, tested plan for account compromise. Typical steps include isolating affected accounts, resetting credentials and reviewing mailbox rules and forwarding. Assign responsibilities and escalation paths.

    Email hygiene and data protection

    Protect against email-based attacks

    Enable anti-phishing, anti-spam and safe links/safe attachments in Defender for Office 365. Configure DMARC, DKIM and SPF for your domains to reduce successful spoofing.

    Limit external forwarding and mailbox delegation

    Prevent automatic forwarding to external addresses unless business-critical. Regularly review mailbox delegation and shared mailbox permissions.

    Operational practices for SMBs

    Practical day-to-day practices help keep your Microsoft 365 environment secure without large overhead.

    • Conduct regular user awareness training focused on phishing and social engineering.
    • Onboard and offboard users with a documented process that includes revoking access and removing licences.
    • Review licence assignments and remove unnecessary admin privileges.
    • Schedule quarterly security reviews and post-incident lessons learned.

    Cost considerations for South African SMBs

    Many security features are included in Microsoft 365 Business Premium or can be added affordably. Compare licence tiers against the cost of recovery from a compromise, which may include productivity loss, data recovery and reputational damage. RandTech IT can help choose the right mix to fit your budget in Rands and operational needs.

    FAQ

    How quickly should I enable MFA?

    Enable MFA immediately. Start with administrators and users with access to sensitive data, then roll out to all staff. This is a high-impact control you can implement in days.

    Will blocking legacy authentication break email for staff?

    It can affect older email clients. Survey your users, move clients to modern authentication-capable software, and use Conditional Access to phase the change.

    Do SMBs need Microsoft Defender for Office 365?

    It’s highly recommended if your business relies on email. It adds targeted anti-phishing, link protection and automated investigation features that reduce risk and workload.

    How do we handle a suspected account compromise?

    Immediately disable the account, reset passwords and revoke active sessions and tokens. Review mailbox rules, forwarding and recent activity. Engage your IT support or a managed service provider for containment and recovery.

    Can RandTech IT manage these settings for us?

    Yes. RandTech IT offers managed Microsoft 365 security and practical implementation services to ensure controls are correctly configured and maintained.

    Conclusion

    Securing Microsoft 365 against account takeover is achievable for South African SMBs with focused, practical actions: enforce MFA, use Conditional Access, block legacy authentication, protect endpoints and monitor activity. These steps reduce risk quickly and cost-effectively.

    If you need practical, experienced assistance to implement or review Microsoft 365 security, contact RandTech IT. Our engineers work rapidly to protect your business so you can get back to running it.

  • Microsoft 365 vs Google Workspace for South African SMEs

    Microsoft 365 vs Google Workspace for South African SMEs

    Introduction

    Choosing between Microsoft 365 and Google Workspace is a common crossroads for South African small and medium-sized businesses. Both suites offer email, document editing, storage and collaboration, but the right choice depends on practical needs: cost, security, local support and how your team works every day. This guide breaks down the key differences and considerations for SMEs in South Africa so you can decide with confidence.

    Overview: What each suite provides

    Microsoft 365

    Microsoft 365 centres on familiar desktop apps (Word, Excel, PowerPoint) alongside cloud services: Exchange Online for email, OneDrive and SharePoint for storage and Teams for chat and meetings. It suits organisations that rely on robust offline editing, complex spreadsheets, and deep integration with Windows environments.

    Google Workspace

    Google Workspace focuses on browser-first apps — Gmail, Docs, Sheets, Slides — with Drive for storage and Meet for video calls. Its strengths are real-time collaboration, simplicity and fast onboarding, particularly for teams working primarily online or on Chromebooks.

    Cost and licensing considerations for South African SMEs

    Pricing is an important factor, and South African buyers should consider both monthly fees and indirect costs like migration and support. Both vendors offer tiered plans; compare features rather than just headline price.

    • Direct subscription costs: Compare the included storage, desktop apps (Microsoft) and admin controls.
    • Migration and setup: Budget for migrating mailboxes, shared drives and permissions — often the bulk of practical cost.
    • Support: Local, responsive support from an IT partner reduces downtime — an important cost for SMEs in Johannesburg and Gauteng where business hours matter.

    Productivity and collaboration

    Real-time collaboration

    Google Workspace is known for smooth, simultaneous editing in the browser. Microsoft has closed much of the gap with co-authoring in Office for the web and synced desktop apps, but workflows that rely on complex Office features may still favour Microsoft.

    Communication tools

    Microsoft Teams integrates chat, meetings, telephony and app integrations tightly into Microsoft 365. Google Meet provides straightforward video and ties closely to Calendar and Gmail. Choose Teams if you need a hub for integrated workflows and telephony; choose Meet for simpler video-first use cases.

    Storage, file management and backup

    Storage models differ: Microsoft uses OneDrive for personal storage and SharePoint for team files, which supports detailed permissions and document management. Google Drive stores files in a single namespace with shared drives for teams.

    • Backup and retention: Neither suite is a backup solution by default. SMEs should plan third-party backups for ransomware protection and long-term retention.
    • Offline access: Microsoft’s desktop apps provide the strongest offline editing experience; Google offers offline modes but they are more limited.

    Security and compliance

    Both platforms offer enterprise-grade security features: multi-factor authentication (MFA), mobile device management (MDM), data loss prevention (DLP) and audit logs. The practical difference for SMEs often comes down to the availability of policy templates, ease of administration and how an IT partner implements controls.

    Local compliance and data residency

    Neither Microsoft 365 nor Google Workspace stores all customer data exclusively in South African data centres for all services. SMEs should assess data residency needs, especially where industry regulations apply, and ask vendors or partners how data flows are handled.

    Integration with other business systems

    Consider the ecosystem your business uses. Microsoft 365 integrates deeply with Windows Server, Active Directory and popular ERP/accounting systems used locally. Google Workspace often integrates well with modern, cloud-native applications and may reduce complexity for browser-centric workflows.

    • Accounting and payroll: Check compatibility with your South African accounting systems — some connectors are vendor-specific.
    • Custom apps: If you rely on bespoke software or integrations developed by your web or software vendor, discuss API and single sign-on requirements.

    Administration and IT support

    Administration experience differs: Microsoft’s admin centre is feature-rich and can be complex; Google’s console is streamlined and easier for non-specialists. For SMEs, the deciding factor is often whether you have access to experienced engineers who can manage policies, migrations and incidents quickly.

    Why local managed services matter

    Fast, experienced support reduces downtime. RandTech IT prioritises resolution by experienced engineers rather than trial-and-error learning on the client’s time — a practical benefit that matters when email and collaboration tools are business-critical in Johannesburg’s fast-paced market.

    Migrations and change management

    Migrating from one platform to another involves mailbox transfers, shared drive restructuring, and user training. Common pitfalls include lost permissions, broken links in documents and user resistance.

    • Plan migrations outside peak business periods.
    • Run pilots with representative users before full cutover.
    • Provide short, role-specific training rather than lengthy generic sessions.

    Choosing based on business profile

    Match the platform to how your business works:

    • Choose Microsoft 365 if: Your team relies on advanced Office features, needs strong offline capabilities, or you have Windows Server/AD dependencies.
    • Choose Google Workspace if: You prefer simple administration, fast real-time collaboration in the browser, and mostly cloud-native workflows.
    • Consider hybrid approaches: Many SMEs use a mix — for example, Microsoft for advanced desktop users and Google for flexible collaboration teams — supported by single sign-on and managed identity services.

    FAQ

    Will my email remain working during migration?

    Yes—if the migration is planned and executed by experienced engineers. RandTech IT uses phased mailbox migration and DNS cutover planning to minimise downtime.

    Which platform is better for security against ransomware?

    Both offer security controls, but protection depends on configuration, patching and backups. Implement MFA, endpoint protection and third-party backups regardless of platform.

    Can we switch later if we pick the wrong suite?

    Yes, migrations are possible but not trivial. Plan for data export, permission mapping and user retraining. Factoring migration costs into your decision helps avoid surprises.

    How much training will my staff need?

    Training requirements depend on current habits. Most users adapt quickly to basic email and documents; attention is usually required for collaboration practices and shared drive management.

    Do we need local servers if we move to the cloud?

    Not usually. Many SMEs can operate fully in the cloud. However, businesses with legacy applications or specific regulatory needs might retain local servers and integrate them with cloud services.

    Conclusion

    Microsoft 365 and Google Workspace are both strong choices for South African SMEs. The right decision depends on day-to-day work patterns, the need for advanced Office functionality, administration preferences and the availability of experienced local support. Prioritise an assessment of workflows, migration costs and security posture rather than selecting on brand alone.

    If you’d like practical, experienced guidance and a clear migration plan, contact RandTech IT. Our engineers focus on fast, effective resolutions so your business stays productive during change.

  • SharePoint vs OneDrive: Where Should Company Files Be Stored?

    SharePoint vs OneDrive: Where Should Company Files Be Stored?

    Introduction

    Choosing where to store company files is a frequent question for South African small and medium-sized businesses. With Microsoft 365 widely used across Gauteng and beyond, teams often debate SharePoint vs OneDrive. Both are Microsoft cloud solutions, but they serve different business needs. This article explains the differences and gives clear recommendations so you can make the right choice for collaboration, security and future growth.

    What OneDrive and SharePoint Are

    OneDrive for Business — personal cloud storage with sharing

    OneDrive for Business is a user-centric storage location linked to an individual’s Microsoft 365 account. Think of it as each employee’s personal business folder in the cloud. It’s ideal for draft documents, private files and working copies before you share or publish them.

    SharePoint — team-based document management

    SharePoint Sites (and Document Libraries) are designed for team collaboration, departmental content and company-wide information. SharePoint provides structure, version control, metadata, and workflows that support organised, long-term storage and regulated access.

    Key Differences That Matter to SMEs

    Purpose and ownership

    • OneDrive: Owned by the user. Best for individual work in progress.
    • SharePoint: Owned by the organisation or team. Best for shared business records and processes.

    Collaboration and co-authoring

    Both platforms support real-time co-authoring of Office files. However, SharePoint is superior where multiple people need consistent access to a canonical copy, structured folders, or document sets tied to projects and compliance requirements.

    Permissions and governance

    OneDrive permissions are simple and user-controlled, which can lead to inconsistent sharing if left unmanaged. SharePoint supports granular permissions, site-level governance, retention labels and auditing — features many SMEs need as they scale or face regulatory requirements.

    Searchability and metadata

    SharePoint’s ability to use metadata, views and search across sites makes it easier to find documents across projects. OneDrive lacks these built-in taxonomies, so it’s not ideal as the primary store for company knowledge.

    Backup, retention and compliance

    Both are part of Microsoft’s cloud ecosystem, but SharePoint integrates more naturally with retention policies, legal holds and eDiscovery features required for formal records management and audits.

    When to Use OneDrive

    • Personal drafts and private working documents that aren’t ready for wider sharing.
    • Temporary files for ad hoc tasks or files tied to a single employee.
    • Situations where quick, limited sharing is required and strict governance isn’t necessary.

    When to Use SharePoint

    • Team collaboration on ongoing projects and departmental document libraries.
    • Official company records, policies, and procedural documents that must be centrally managed.
    • Processes that require approval flows, metadata, versioning and discoverability.
    • Any files tied to compliance, audit trails or retention policies.

    Common SME Use Cases and Recommendations

    Small marketing team in Johannesburg

    Store campaign assets, shared templates and final deliverables in a SharePoint site. Team members use OneDrive for draft ads and initial concept documents until they’re ready to publish to SharePoint.

    Finance and compliance

    Finance documents, contracts and tax records should live in SharePoint with strict permissions and retention rules. OneDrive is not appropriate for official records that must be retained or audited.

    Remote or hybrid teams

    Use SharePoint for shared resources like onboarding packs, SOPs and central templates. OneDrive remains useful for personal notes and files employees take with them between locations.

    Practical Governance Steps for SMEs

    • Define clear policies: what goes to SharePoint vs OneDrive.
    • Create team sites and libraries aligned with business functions (Sales, HR, Finance).
    • Apply retention and access policies to SharePoint libraries for compliance.
    • Train staff on sharing practices and how to use Teams integrations (Teams uses SharePoint for file storage).
    • Use lifecycle rules to archive or delete obsolete content and reduce clutter.

    Costs and Licensing Considerations in South Africa

    Microsoft 365 plans commonly used by SMEs already include both OneDrive and SharePoint. When estimating costs, factor in storage growth, additional backup tools if required, and any professional services to configure governance. For budgeting purposes, consider the cost of time lost to poor organisation — moving files, chasing versions and rebuilding lost records can be greater than modest management or migration fees.

    Tools and Integrations

    SharePoint integrates with Microsoft Teams, Power Automate and Power Apps to automate approvals and create simple business apps. OneDrive integrates seamlessly with Office apps for quick syncing. For SMEs in Gauteng, RandTech IT can help design SharePoint structures and automate common tasks so your team works faster without unnecessary complexity.

    Migration Tips

    1. Audit current file locations and duplication across OneDrive and shared drives.
    2. Classify documents: keep, archive, delete or move to SharePoint.
    3. Plan site architecture around functions rather than individuals.
    4. Communicate changes clearly and provide short how-to guides for staff.
    5. Test with a pilot team before full rollout to ensure permissions and workflows behave as expected.

    FAQ

    Can files in OneDrive be moved to SharePoint?

    Yes. You can move or copy files from OneDrive to SharePoint. Use the OneDrive or SharePoint web interface or migration tools for bulk moves and preserve version history when possible.

    What if an employee leaves the company?

    Files stored in OneDrive tied to the user account can be transferred to another account or moved to SharePoint before deprovisioning. SharePoint ensures company-owned files remain accessible regardless of personnel changes.

    Do SharePoint and OneDrive work offline?

    Yes. Both support syncing to local devices with the OneDrive sync client. SharePoint document libraries can be synced and accessed offline; changes will sync back when online.

    Is extra backup necessary if we use SharePoint/OneDrive?

    Microsoft protects against infrastructure failure, but accidental deletion, ransomware and retention gaps are reasons many SMEs choose third-party backups. Consider a backup strategy aligned with your recovery objectives.

    How do we prevent uncontrolled sharing from OneDrive?

    Implement sharing policies, limit external sharing by default, and provide user training. Conditional access and Data Loss Prevention (DLP) policies help control sensitive data exposure.

    Conclusion

    SharePoint and OneDrive are complementary. OneDrive works best for individual work-in-progress, while SharePoint should be the authoritative store for team collaboration, company records and compliance. For South African SMEs, the right balance reduces risk, improves productivity and keeps files discoverable as your business grows.

    Need practical help? RandTech IT specialises in configuring Microsoft 365 for South African SMEs. If you want the file structure, governance and migration managed by experienced engineers — not trial-and-error — get in touch and we’ll help implement a solution that fits your business needs.

  • How to Secure Microsoft 365 Against Account Takeover

    Introduction

    Microsoft 365 is the backbone of many South African small and medium-sized businesses (SMEs). Its email, Teams and Office apps keep teams productive, but they also present a prime target for account takeover attacks. For businesses in Gauteng and across South Africa, a compromised M365 account can mean lost invoices, exposed client data and costly downtime.

    This article provides a clear, practical roadmap on how to secure Microsoft 365 against account takeover. It focuses on measures that deliver immediate protection and are realistic for SMEs, highlighting where experienced support speeds implementation and reduces risk.

    Understand the risk: how account takeover happens

    Account takeover (ATO) generally follows a predictable pattern. Attackers use stolen credentials, phishing, credential stuffing or exploitation of weak authentication to gain access. Once inside, they can forward emails, reset passwords at other services, and use the account to launch further attacks.

    SMEs are particularly vulnerable because they often lack hardened identity controls and rapid incident response.

    Core protections every SME should deploy

    1. Enable and enforce multi-factor authentication (MFA)

    MFA is the single most effective control against ATO. Require MFA for all accounts, not just administrators. Prefer authenticator apps or security keys over SMS, which can be vulnerable to SIM swap attacks.

    • Use Microsoft Authenticator or hardware FIDO2 keys for high-risk users.
    • Apply MFA via Conditional Access (see below) for gradual rollout and exceptions.

    2. Use Conditional Access policies

    Conditional Access lets you enforce rules based on user, device, location and risk. For an SME, useful policies include:

    • Require MFA for all access from outside South Africa or untrusted networks.
    • Block legacy authentication protocols (IMAP, POP) that don’t support modern auth.
    • Require compliant or hybrid-joined devices for sensitive resources.

    3. Block legacy authentication and modernise protocols

    Legacy authentication is commonly exploited in automated credential stuffing. Disable basic auth where possible and migrate mail clients to use modern authentication (OAuth).

    4. Configure secure password policies and identity protection

    Strong password policies matter, but they’re less effective without MFA. Use Azure AD Password Protection to block common and compromised passwords, and enable Microsoft Defender for Identity or Azure AD Identity Protection to detect risky sign-ins.

    Hardening mail and collaboration to prevent abuse

    1. Protect email flow and prevent forwarding

    Compromised mailboxes are often used to defraud suppliers or clients. Configure these controls:

    • Disable automatic mailbox forwarding to external addresses unless explicitly required.
    • Enable mailbox auditing and alerting for unusual forwarding rules.
    • Use Exchange Online Protection and anti-phishing policies to flag impersonation attempts.

    2. Configure DKIM, DMARC and SPF properly

    Set up SPF, DKIM and DMARC for your business domains to reduce email spoofing and improve deliverability. A DMARC policy set to quarantine or reject reduces successful phishing impersonations of your domain.

    3. Restrict third-party app permissions

    OAuth consent grants can give malicious apps long-lived access. Regularly review and restrict app permissions; require admin approval for high-risk apps.

    Monitoring, detection and rapid response

    1. Enable logging and alerts

    Turn on sign-in and audit logs in Azure AD and Exchange Online. Create alerts for anomalous activity such as:

    • Impossible travel or sign-ins from unexpected countries.
    • Mass mailbox rule creation or deletions.
    • Multiple failed sign-ins followed by success.

    2. Use Defender and SIEM for richer detection

    Microsoft Defender for Office 365 and Defender for Identity provide threat analytics. Feeding logs into a SIEM or Microsoft Sentinel (even a scaled deployment for SMEs) helps correlate events and speed response.

    3. Have an incident response plan

    Predefine steps for suspected ATO: isolate affected accounts, reset credentials, force reauthentication, review activity, notify impacted parties and, if needed, involve specialist incident responders. Practised playbooks reduce downtime and risk.

    Operational practices that reduce exposure

    1. Least privilege and role separation

    Assign admin roles sparingly. Use Privileged Identity Management (PIM) for just-in-time elevation so high privileges are rarely active. Limit global admin accounts and require MFA for them.

    2. Regular user training and simulated phishing

    Human error is a frequent cause of account takeover. Deliver targeted training and simulated phishing campaigns to help staff recognise social engineering. Focus on finance, HR and staff who handle external communications.

    3. Keep devices and endpoints patched

    Compromised endpoints can bypass identity controls. Ensure Windows updates and security patches are applied, use endpoint protection and enforce disk encryption on laptops used outside the office.

    Practical rollout steps for SMEs in South Africa

    1. Audit: catalogue M365 users, admin accounts and third-party app permissions.
    2. Immediate: enable MFA for all users and block legacy authentication.
    3. Short term (2–6 weeks): implement Conditional Access, configure DKIM/SPF/DMARC, enable logging and basic alerting.
    4. Medium term (1–3 months): deploy Defender features, set up PIM, run staff training and simulated phishing.
    5. Ongoing: review alerts, perform quarterly access reviews and practice incident response playbooks.

    These steps are practical for SMEs and can be staged to match resource availability. For many businesses, partnering with experienced engineers ensures fast, low-disruption execution.

    Cost considerations for South African SMEs

    Microsoft 365 licensing affects which features are available. MFA and basic security controls are included in most plans, while Defender, PIM and advanced Conditional Access features may require higher-tier licences. Factor in:

    • Licence upgrades where necessary.
    • Costs for security keys (FIDO2) or additional endpoint protection.
    • Managed service or consultant fees for setup and monitoring.

    Budgeting in advance avoids unexpected costs and ensures the right level of protection for the business. For many SMEs the cost of managed security is small compared with the potential expense of a breach.

    Frequently asked questions

    Can MFA be bypassed?

    MFA significantly reduces risk but is not infallible. Attackers can use sophisticated phishing or session capture. Pair MFA with Conditional Access, device compliance checks and monitoring to strengthen protection.

    How quickly should we act after a suspected takeover?

    Immediate containment is critical: disable or block the account, force password reset and revoke active sessions. Then conduct a focused investigation and follow incident response steps.

    Is it hard to disable legacy authentication?

    It can affect older mail clients and devices. Test changes with a small user group first and provide guidance for migrating to modern authentication. Blocking legacy auth is essential for security.

    Do we need a SIEM for an SME?

    A full SIEM is not mandatory, but centralised logging and alerting are important. Consider managed SIEM or Microsoft Sentinel in a scaled deployment if you need advanced correlation and 24/7 monitoring.

    How often should we review admin accounts and app permissions?

    Conduct reviews at least quarterly. Remove unused admin accounts and revoke unnecessary app permissions to reduce attack surface.

    Conclusion

    Securing Microsoft 365 against account takeover is achievable for South African SMEs with practical controls: enforce MFA, use Conditional Access, block legacy authentication, harden email, monitor activity and prepare an incident response plan. These measures reduce risk quickly and can be implemented in stages that suit your business.

    RandTech IT specialises in helping SMEs deploy these protections with minimal disruption. If you want experienced engineers who prioritise fast resolution over learning on the job, contact RandTech IT for practical assistance securing your Microsoft 365 environment.

    Contact RandTech IT — reach out for a security review, MFA rollout, Conditional Access setup or incident response support tailored to South African SMEs.

  • Microsoft 365 Business Standard vs Business Premium: Which Is Right for Your SME?

    Microsoft 365 Business Standard vs Business Premium: Which Is Right for Your SME?

    Introduction

    Choosing between Microsoft 365 Business Standard and Business Premium is a common decision for South African small and medium-sized businesses. Both plans provide essential productivity apps, cloud storage and collaboration tools, but they differ in security and device management. This article explains the practical differences in local context, so you can pick the plan that aligns with your operations, budget and regulatory needs.

    What each plan includes: a quick overview

    Business Standard

    Business Standard focuses on productivity and collaboration. Key elements include:

    • Desktop and web versions of Office apps (Word, Excel, PowerPoint, Outlook)
    • Exchange Online email with business-class mailboxes
    • OneDrive for Business with cloud storage per user
    • Microsoft Teams for chat and meetings
    • SharePoint for intranet and file sharing

    Business Premium

    Business Premium includes everything in Standard plus enhanced security and device management features important to growing firms:

    • Advanced threat protection for email and files
    • Intune for device and application management
    • Azure AD Premium features for conditional access and identity protection
    • Additional policies to secure data on mobile devices and remote endpoints

    Security and compliance: where Premium adds value

    Security is often the deciding factor. For businesses in Johannesburg or across Gauteng handling sensitive client data, Business Premium’s security stack is meaningful.

    Threat protection

    Business Premium offers enhanced email protection against phishing, malware and malicious attachments. This reduces the risk of costly security incidents that can disrupt services and damage reputation.

    Device management

    With Microsoft Intune, you can manage company devices and enforce encryption, password policies and remote wipe. For organisations using a mix of office desktops and remote laptops, this helps maintain a consistent security posture.

    Identity and access control

    Conditional access and multi-factor authentication policies let you limit access based on device health and location — a practical control for companies with remote workers or field staff.

    Productivity and collaboration: both plans cover the essentials

    If your priority is day-to-day productivity—documents, spreadsheets, email and online meetings—Business Standard already delivers the tools teams need.

    Office apps and email

    Both plans provide the full Office suite and Exchange-hosted email. For client-facing SMEs that rely on polished documents, standardised templates and professional email, these features are the baseline.

    Teams, SharePoint and OneDrive

    Collaboration tools are identical across plans. Teams for meetings and chat, SharePoint for internal sites and OneDrive for individual file storage keep teams connected whether they’re in a Sandton office or working remotely.

    Cost considerations for South African SMEs

    Pricing matters. Business Premium sits at a higher monthly cost than Business Standard because of the bundled security and management features. When evaluating cost, consider:

    • Direct subscription costs in rand per user per month
    • Potential savings from avoided incidents and reduced downtime
    • Administrative overhead — Premium can reduce time spent manually securing devices

    For many SMEs, Premium is an investment: higher license cost but lower risk and simpler management. If cost is the primary constraint and you can manage security through other means, Standard may suffice.

    Which plan suits your business? Practical recommendations

    Choose Business Standard if:

    • Your priority is cloud-based Office applications and email at an affordable price
    • You have a small, primarily office-based workforce with limited remote or mobile device use
    • You already have third-party security solutions you trust and can manage centrally

    Choose Business Premium if:

    • You handle financial, legal or client-sensitive data and need stronger protection
    • Your team uses mobile devices or remote endpoints that must be managed and secured
    • You prefer an integrated Microsoft approach to identity, threat protection and device management

    Migration, management and support considerations

    Switching plans or migrating to Microsoft 365 should be handled carefully to avoid downtime. RandTech IT advises following best practices:

    • Plan migrations outside core business hours to limit impact
    • Ensure backups and a rollback plan are in place
    • Test conditional access and device policies on a pilot group first
    • Train staff on MFA and phishing awareness to maximise security investments

    As a Gauteng-based managed IT provider, RandTech IT focuses on resolving issues quickly with experienced engineers so your business doesn’t have to learn on the client’s time.

    FAQ

    1. Can I upgrade from Business Standard to Business Premium later?

    Yes. You can upgrade licences to Business Premium when your security or management needs increase. Plan the change with your IT provider to apply policies smoothly.

    2. Do both plans include desktop Office apps?

    Yes. Both Business Standard and Business Premium include the full desktop, web and mobile Office apps for each licensed user.

    3. Is Business Premium necessary for compliance with South African data protection laws?

    Business Premium provides stronger controls that help meet data protection requirements, but compliance depends on how you configure and use the tools. Legal and regulatory needs vary by industry.

    4. Will Business Premium prevent all cyberattacks?

    No security plan can guarantee complete prevention. Business Premium reduces risk through integrated protections and management, but you still need user training, backups and good security practices.

    5. How much technical support do I need to manage Premium features?

    Premium adds complexity. Many SMEs benefit from managed services to configure Intune, conditional access and threat protection correctly and maintain them over time.

    Conclusion

    Microsoft 365 Business Standard covers essential productivity and collaboration needs at a competitive price. Business Premium adds a valuable security and device management layer for businesses that handle sensitive data, support remote devices, or want tighter control over access. For South African SMEs, the right choice depends on risk tolerance, regulatory obligations and internal IT capability.

    If you’re unsure which plan suits your business or need hands-on help migrating and securing your environment, contact RandTech IT. Our experienced engineers deliver fast, practical solutions so your team stays productive and protected.

    Contact RandTech IT for practical, experienced assistance tailored to South African SMEs.