Almost every Microsoft 365 tenant we inherit was set up in an afternoon by whoever was least busy. Mail works, so nobody looks again, until an account is compromised, or somebody discovers a folder shared with the whole internet since 2022.
Day one: identity before anything else
One identity per person, and separate administrative accounts that nobody reads email on. Enforce multi-factor authentication for everybody, including the director who does not want it. Compromised executive accounts are how invoice fraud starts, and it is always the account with the exception.
Block legacy authentication in the same sitting. It is the protocol that lets an attacker skip MFA entirely, and almost nothing in a modern business still needs it.
Day two: decide the sharing rules on purpose
The default in a new tenant is more open than most businesses would choose if asked. Decide deliberately whether files can be shared with anyone who has the link, whether external guests can be invited, and whether links expire. Write the decision down; it will be questioned in six months.
Day three: structure before content
Create SharePoint sites that map to how the business is actually organised, and grant permissions to groups rather than to individuals. Individual permissions are how a tenant becomes unmaintainable: there is no way to answer 'what can this person see?' once there are two hundred of them.
Set up Teams last. A channel should be a view onto a library that already exists, not a fourth place the same file lives.
Day four: migrate, then verify
- Move files with permissions intact, not by dragging them into a browser.
- Leave the old shared drive mapped and read-only for a month so nobody panics.
- Verify that mail flow, SPF, DKIM and DMARC are all correct after the domain is attached.
- Test a restore from the recycle bin and from version history before you tell anyone it is done.
Day five: write it down
One page: which groups exist, what each site is for, who the administrators are, and what the sharing policy is. It takes an hour and saves a week the first time somebody new has to touch the tenant.