Microsoft 365 Management and Support Services
Operate Microsoft 365 as a governed business platform.
Administration and operational support for agreed Microsoft 365 services, identities, collaboration and security configuration.
Based in Boksburg and supporting organisations across Gauteng: IT support in Johannesburg and IT support on the East Rand.
Discuss this managed service →Defined scope. Clear ownership. Visible service.
Administration and operational support for agreed Microsoft 365 services, identities, collaboration and security configuration. Namandla Consultants begins with discovery, agrees responsibilities and measures the service against operational outcomes.
What the service can cover.
Identity administration
Manage approved user, group, role and access changes with traceability.
Exchange and collaboration
Support agreed Exchange Online, Teams, SharePoint and OneDrive administration.
Service health
Monitor Microsoft service health, advisories and tenant-impacting incidents.
Security configuration
Review and maintain agreed authentication, sharing, access and protection controls.
Licence oversight
Track licence allocation and identify avoidable waste or assignment gaps.
Lifecycle support
Coordinate joiner, mover and leaver processes across the Microsoft 365 environment.
Controlled from onboarding to improvement.
What tenant management actually covers
Microsoft 365 is sold as a subscription and treated as one. It is closer to a platform, and platforms need administration.
A tenant that nobody administers does not fail visibly. It drifts. Licences get assigned and never reclaimed. Security defaults get disabled during a troubleshooting session and stay disabled. Guest accounts accumulate. Sharing links get created with no expiry. Conditional access exclusion groups grow. Six of these individually are minor. Together they are the reason a tenant three years old bears little resemblance to its design.
Management covers six areas.
Identity
Entra ID, user lifecycle, groups, licensing assignment, hybrid synchronisation where an on-premises directory remains, and the joiner, mover and leaver processes that keep it accurate.
Access security
Multi-factor authentication, conditional access policy, legacy authentication blocking, privileged role management and break-glass account governance.
Device management
Intune enrolment, configuration profiles, compliance policies, application deployment and update rings.
Workload governance
Exchange Online mail flow and protection, SharePoint and OneDrive sharing policy and retention, Teams lifecycle and external access.
Data protection
Retention policies, litigation and legal hold, data loss prevention, sensitivity labels and a deliberate backup strategy. Microsoft 365 provides service resilience and native retention features, and Microsoft also offers Microsoft 365 Backup as a separate service; those are different from simply assuming cloud data is recoverable to any historical point you may need.
Commercial
Licence reconciliation, subscription right-sizing and renewal preparation.
What we consistently find
Nine findings account for most of what an assessment turns up. None of them require a purchase to fix.
1. Security features already paid for and switched off
This is the single most common finding and the highest value to correct. Business Premium includes Intune, Entra ID Plan 1, Defender for Office 365 Plan 1 and Defender for Business. E3 and E5 include progressively more. In most mid-market tenants we assess, a substantial share of it has never been configured.
Conditional access sitting unused while security defaults do the work. Intune licensed with no devices enrolled. Defender for Office 365 policies at factory settings. Sensitivity labels never published. The organisation is paying for all of it monthly.
2. Legacy authentication still permitted
Basic authentication bypasses multi-factor authentication entirely. Microsoft has retired it across most protocols, and it persists in tenants through per-tenant exceptions, older SMTP relay configurations and line-of-business applications that were never updated. Checking sign-in logs for legacy authentication and closing what remains is a specific, finite piece of work.
3. Conditional access exclusions that grew
A policy is written correctly. A user cannot get in. They are added to an exclusion group as a temporary measure. The measure is not temporary. Two years later the exclusion group has nineteen members including two service accounts and a director.
Reviewing exclusion group membership against a documented justification is a half-day exercise that materially changes the security posture, and it needs to be a scheduled recurring exercise rather than a one-off.
4. Break-glass accounts absent or wrong
Emergency access accounts exist so that a conditional access misconfiguration cannot lock every administrator out of the tenant. They need to be excluded from all conditional access policies, hold permanent Global Administrator, use a long credential stored offline, and be monitored for any sign-in.
Tenants commonly have none, or have one that is included in the policies it exists to bypass, which defeats the purpose in the exact circumstance it was created for.
5. Licence drift
Unassigned licences billing monthly. Users on E3 who need F3. Users on F3 who need E3 and have been working around the gap. Duplicate functionality bought separately when the existing subscription already includes it, which happens most often with backup, archiving and threat protection.
Reconciliation is a report and a conversation, and in most mid-market tenants it finds enough to fund the management arrangement.
6. Sharing configured at rollout and never revisited
SharePoint and OneDrive sharing defaults set during migration, anonymous links with no expiry, guest accounts from a project that closed in 2023, and site collections with no owner because the owner left.
7. Backup requirements left undecided
Microsoft 365 is resilient, but service resilience, retention and backup solve different problems. Native recycle bins, retention policies and legal hold may cover much of your requirement, and Microsoft 365 Backup now provides a separate native backup and restore service for supported workloads. Third-party platforms remain another option where their retention, export, coverage or recovery model is a better fit.
The control is to decide what recovery history you need, which workloads need it, how quickly you must restore, and then test that design. ‘It is in the cloud’ is not a recovery objective.
8. Intune deployed as enrolment only
Devices enrolled, no compliance policies, no configuration profiles, no update rings. Enrolment gives you an inventory. Compliance and configuration give you control, and conditional access referencing device compliance is what turns it into a security control rather than a list.
9. No documented tenant configuration
Nobody can say what changed, when or why. Microsoft 365 has a unified audit log and it is a legitimate substitute for documentation, if anyone reads it. A short configuration record covering the decisions that were made deliberately is more useful than reconstructing them from logs two years later.
What Namandla delivers
Tenant assessment
A full review across identity, access, devices, workloads, data protection and licensing. The output is a written position with findings ranked by impact and effort, and it is yours whether or not you continue.
Security baseline configuration
Conditional access policy set built from a documented design rather than from templates, multi-factor authentication rollout, legacy authentication closure, privileged role management and break-glass account establishment.
Intune deployment
Enrolment for Windows, macOS, iOS and Android, configuration baselines, compliance policies tied into conditional access, application deployment and update ring structure.
Exchange Online administration
Mail flow, connectors, anti-spam and anti-phishing policy, shared mailbox and distribution management, and mail protection tuned rather than left at defaults.
SharePoint, OneDrive and Teams governance
Sharing policy, external access, site and team lifecycle, retention and sensitivity labelling.
Backup for Microsoft 365 data
Requirement definition, platform selection, deployment and restore testing using Microsoft 365 Backup or an appropriate third-party platform.
Licence reconciliation
Assignment against actual usage, right-sizing recommendations and renewal preparation.
Ongoing administration under the managed services agreement, with the response commitments on /it-services/.
Remote delivery nationally. Onsite work in Gauteng where a project needs it.
Technical notes
Conditional access design order
Build the policy set as a designed whole rather than incrementally. A working baseline is: block legacy authentication, require MFA for all users, require MFA for administrative roles without exception, require compliant or hybrid-joined devices for access to sensitive applications, block or challenge sign-in from unexpected locations, and require MFA for guest access. Every policy in report-only mode first, reviewed against sign-in logs, then enforced. Break-glass accounts excluded from every one of them.
Intune update rings
Three rings minimum. Pilot at zero days deferral covering IT and volunteers. Broad at seven days. Critical at fourteen to twenty-one days covering executive, finance and any specialist workstation. Quality updates and feature updates deferred separately, because they carry different risk.
Hybrid identity
Where an on-premises Active Directory remains, Entra Connect synchronisation health is a genuine single point of failure and it fails quietly. Monitor sync status, staleness and error counts. Password hash synchronisation is the more resilient authentication method for most organisations because it survives an on-premises outage, and pass-through authentication does not.
Mail flow
Where a third-party gateway sits in front of Exchange Online, enhanced filtering for connectors must be configured or Microsoft’s own filtering evaluates the gateway’s IP rather than the true sender, which degrades the protection you are paying for on both sides. SPF, DKIM and DMARC should all be published, with DMARC moved from monitoring to enforcement on a planned schedule rather than left at p=none indefinitely.
Licensing note
Feature availability changes and so do the bundles. Anything we tell you about what your subscription includes is verified against your tenant at the time of assessment rather than quoted from a comparison table.
Common questions about Microsoft 365 Management
What does Microsoft 365 management include?
Identity and user lifecycle, conditional access and multi-factor authentication, Intune device management, Exchange Online, SharePoint, OneDrive and Teams governance, data retention and protection, backup of Microsoft 365 data, and licence reconciliation.
The distinction worth drawing is between support and management. Support answers tickets when something breaks. Management keeps the tenant configured deliberately: policies reviewed, licences reconciled, devices compliant, access controlled. A tenant with support and no management drifts, and the drift is invisible until it is expensive.
Is Microsoft 365 backed up?
Microsoft 365 provides service resilience and native retention features, and Microsoft also offers Microsoft 365 Backup as a separate backup service for supported workloads. The right question is whether your configured recovery options meet your required restore points, retention periods and recovery times.
For some organisations, retention plus native backup is sufficient. Others choose a third-party platform for different coverage, retention, export or recovery requirements. We define the requirement first and test the restore rather than assuming that cloud location alone provides the recovery history the business needs.
We already have Microsoft 365. What would you actually do?
Assess the tenant first. In most mid-market tenants the highest-value work is switching on and configuring security features that are already licensed, closing legacy authentication, reviewing conditional access exclusions and reconciling licence assignment against real usage.
That work requires no purchase. It is the reason we lead with an assessment rather than a proposal. If the assessment finds a well-run tenant, we will tell you that and the conversation is a short one. That has happened and it is a better outcome than a manufactured project.
What is conditional access and do we need it?
Conditional access is the policy engine that decides whether a sign-in is allowed, based on user, device, location, application and risk. It is how you require multi-factor authentication for administrators, block legacy authentication and require a compliant device for sensitive applications.
It is included in Entra ID Plan 1, which is part of Business Premium, E3 and E5. If you hold any of those you already have it. Security defaults are the simplified alternative and they are adequate for very small organisations. Beyond about twenty users, or wherever you need exceptions and nuance, conditional access is the right tool and it is usually sitting unused.
Can you manage Microsoft 365 without managing the rest of our IT?
Yes. Microsoft 365 management is a standalone service and it is a common starting point, particularly where an internal team handles everything else.
It is also the most frequent entry into a broader arrangement, because the tenant touches identity, devices, mail, files and security, and problems in those areas rarely stay inside the tenant. We are content either way and we do not use the engagement to lobby for more.
How much can we save on licensing?
In tenants we assess, reclaimable and right-sizeable licence spend is commonly in the range of ten to twenty percent. It varies substantially and any figure quoted before looking at your tenant is a guess.
The savings come from unassigned licences still billing, users on a higher tier than their role requires, and separately purchased products that duplicate something already included. The last category is often the largest single item. Reconciliation is a report and a conversation, and it usually pays for a meaningful part of the management arrangement.
Do you support hybrid environments with on-premises Active Directory?
Yes. Hybrid identity with Entra Connect, hybrid Exchange where mailboxes remain on premises, and the migration path where you decide to complete the move.
Entra Connect health is worth specific attention because synchronisation failures are quiet and cumulative. A sync that has been failing for three weeks shows up as new starters unable to sign in and leavers still able to. Monitoring sync status, staleness and error counts is part of the standing service.
What is Intune and do we need it if we have antivirus?
Intune is device management: enrolment, configuration baselines, compliance policy, application deployment and update control. Antivirus is one control on a device. Intune governs the device itself and, through conditional access, whether it is allowed to reach your data.
They are complements rather than alternatives. The specific capability that antivirus cannot give you is conditional access referencing device compliance, meaning a device that is not encrypted, not patched or not compliant with policy cannot open your data regardless of who is signed in. If you hold Business Premium, E3 or E5, Intune is already licensed.
How long does a tenant remediation take?
The assessment takes about a week. Remediation typically runs four to eight weeks for a mid-market tenant, driven mostly by change control and user communication rather than by configuration effort.
Conditional access in particular has to be rolled out in report-only mode, reviewed against sign-in logs and enforced in stages. Rushing it locks people out, which damages trust in the whole programme. Intune enrolment similarly moves at the pace of user communication rather than technical capacity.
Can you help with a migration from Google Workspace or on-premises Exchange?
Yes. Mailbox and file migration, identity cutover, client reconfiguration and the coexistence period in between.
The part organisations underestimate is not the mail migration, which is well-trodden, but the file and permission migration and the user change. Shared drive structures and permission models do not map cleanly between platforms, and a straight lift produces a mess that takes eighteen months to clean up. We plan the target structure before moving anything.
What happens to our data if we leave?
It stays yours and it stays in your tenant, which is registered to your organisation rather than to us. We hold delegated administrative access, which is revoked on exit, and we hand over documentation of the configuration.
This is worth confirming with any provider. The arrangement that causes difficulty is where a provider holds the tenant under their own agreement and you are a tenant within it. Ask who the subscription is registered to before signing anything.
When do we not need managed Microsoft 365?
When you have fewer than about fifteen users, no compliance obligations and an internal person who genuinely keeps up with it. Security defaults, a documented licence position and a backup product will cover you.
Microsoft 365 management earns its cost through the volume and pace of change: features arrive, defaults shift, licence bundles are restructured, and staying current is a standing job. Below a certain scale that job is small enough to absorb. If that is where you are, do the tenant assessment once as a project, act on the findings and manage it yourself. We will happily do it on that basis.