What eDirectory actually is

eDirectory is a directory service that began life as Novell Directory Services in the early 1990s. It is built around a replicated, multi-master tree model that treats every replica as equally authoritative. It speaks LDAP for the modern world, NDS for legacy Novell clients, and a long list of authentication protocols for the systems that came and went around it. The tree is partitioned for scale, replicated for resilience, and managed through a combination of graphical tools (iManager, ConsoleOne), command-line utilities, and a comprehensive schema that has been extended to cover essentially every directory use case an SME is likely to have.

What eDirectory is genuinely better at

• Multi-master replication: every replica can take writes. There is no single-master fail-over story to design, no catastrophe scenario in which the entire directory goes read-only.
• Schema richness: eDirectory has a richer schema than either Active Directory or Entra ID by default, with strong support for location, organisational and class-of-service extensions that map naturally to complex SME structures.
• Protocol coverage: LDAP, NDS, Kerberos, RADIUS, NMAS, NTP — eDirectory speaks more authentication protocols out of the box than any competing directory and has done for years.
• Operational maturity: the tooling, the well-understood failure modes and the operational patterns around eDirectory are deeper than for newer directories.
• Local control: eDirectory runs on hardware the SME owns, in a location the SME chooses, administered by people the SME employs.

Identity sovereignty as a strategic choice

Identity sovereignty is the property of being able to authenticate, authorise and audit your people without depending on a third-party service that could change its terms, raise its prices, lose its accreditation or have an outage on the morning of your board meeting. For most SMEs in 2026 that is not a strong enough requirement on its own to override the productivity advantages of moving identity into the cloud. But for a meaningful minority — regulated sectors, defence-adjacent supply chains, sites with strict data-residency requirements — it is. eDirectory is one of the few mature, supported identity platforms that delivers that sovereignty without requiring the SME to build it themselves from scratch.

Bridging eDirectory to the modern world

The criticism that eDirectory cannot talk to the modern SaaS world is no longer accurate. The current generation of OES runs eDirectory comfortably alongside Active Directory, including as a side-by-side identity source for GroupWise, file and print services. Identity bridges — including the OpenText-branded tools and a number of mature third-party solutions — synchronise eDirectory trees with Entra ID, give modern SaaS applications a usable identity, and let the SME keep eDirectory as the authoritative store while migrating consumers gradually. The integration pattern is well understood and is one of the more elegant answers in identity architecture for SMEs with a Novell heritage.

MFA, conditional access and the modern security stack

The honest gap in 2026 is in the modern security story above the directory itself. Cloud-native directories now ship with conditional access, MFA enforcement, identity protection, risk-based policies and the full Microsoft XDR loop wired in. eDirectory has to be bridged into that stack, typically via Entra ID as a consumer. The work is well understood but adds operational complexity compared with an organisation that has identity and modern security in the same platform. The right conversation is always: do you have the operational skill to bridge eDirectory into the modern security stack cleanly, or is your team struggling to keep the tree healthy on its own?

When to keep eDirectory as the authoritative identity

Three signals say the authoritative identity should stay in eDirectory rather than being consolidated into Entra ID. The first is that the SME genuinely needs identity sovereignty as described above and is not willing to give that up for productivity gain. The second is that the existing identity tree still contains authoritative data — security clearances, complex group memberships, custom schema for line-of-business systems — that the SME has no appetite to migrate. The third is that the team looking after the estate is genuinely fluent in eDirectory and would lose operational grip if forced to migrate. None of those signals is permanent, but all of them are real reasons to keep eDirectory in the role it is doing well.

When to admit the consolidation call

Three other signals point the other way. The first is that the eDirectory tree is genuinely aging — schema drift, partition imbalance, replica servers running on hardware past its support horizon. The second is that the people who know the tree are retiring or moving on and the team that replaces them is no longer fluent. The third is that the rest of the estate is consolidating into Microsoft 365 anyway and the operational complexity of running two parallel identity stores outweighs the sovereignty benefit. In all three cases the right move is a deliberate migration to Entra ID as the authoritative store, with eDirectory kept in a transitional role that is itself documented and time-bounded.

We help SMEs across Hertfordshire, Bedfordshire and London design identity architectures that genuinely fit their operational, security and sovereignty requirements — including the eDirectory implementations that are still earning their place in 2026 and the consolidation projects that make sense when they no longer do. If you are weighing the case for keeping eDirectory authoritative against the case for consolidating into Entra ID, get in touch for a short, practical conversation.

The three workloads OES is good at

File services on OES are served from NSS volumes. The protocol story covers NCP for the legacy Novell client base and CIFS for Windows and most macOS users. Print is iPrint, with web-based driver delivery and a much lower operational burden than the equivalent Windows print server on a small site. Shared storage runs on NSS as well, with clustering for higher availability on sites that need it. None of that is glamorous. All of it has been quietly improving for over a decade and is well-understood by the small but committed community that runs it.

Where the economics win

A single OES licence covers the file, print and storage services for an entire server, with users counted at the directory level rather than per service. The bill grows with the number of servers and the number of users but does not grow per workload. A Windows Server estate serving the same functions tends to bundle multiple licences across multiple server roles, with CALs per user and per device across the stack. For an SME in the 50-to-300 user range with a single primary file and print estate, the cumulative cost of running OES is materially more predictable than the cumulative cost of running the Microsoft equivalent. The shape of that cost curve is the reason OES is still being chosen on financial grounds in 2026.

Mobile and remote access: Filr

The historical weakness of any on-premise file estate was mobile access. OpenText Filr is the answer: a file-access layer that talks NCP and CIFS at the back end and presents a modern mobile and web experience at the front. For SMEs whose staff genuinely need to read, edit and share OES-hosted files from phones, tablets and laptops away from the office, Filr deployed well closes most of the gap with OneDrive, SharePoint and the equivalent SaaS tools. It is not a replacement for those tools in every workflow, but for the file-and-print workload specifically it is genuinely capable.

iPrint and the small details that matter

iPrint is the OpenText answer to network printing and it is genuinely better than the equivalent Windows print stack on a small site. Driver delivery is centralised, queues are easier to manage, mobility printing works without the friction that print servers usually cause. For SMEs whose teams still print — design firms, manufacturers, logistics offices, schools, healthcare practices — that daily experience matters more than the licensing model and is one of the harder things to give up if you move to a cloud-first stack without an equivalent in it. The honest comparison is that OES makes printing pleasant; cloud-first stacks make printing a project.

Identity flexibility in the current generation

A meaningful criticism of older OES releases was that they assumed eDirectory as the identity store. The current generation explicitly supports using Active Directory as the identity source, including for sites that want to retain OES as the file and print tier on top of an Entra ID / Active Directory identity estate. That single change has made OES a much easier sell for SMEs that have already moved identity into Microsoft 365 but want to keep the file and print services they have always trusted running locally. The choice is no longer "either/or" — it is "both, deliberately".

What the cloud stack does that OES does not

Honesty still matters. Cloud file and print tools offer tighter integration with productivity suites, browser-only editing in many cases, real-time co-authoring, and the cross-device sync that mobile teams now expect. OES plus Filr can do most of that, but the integration depth is shallower and the user-experience polish a generation behind. If your SME has decided that real-time browser collaboration is the single most important workload, OES is the supporting tier, not the lead one. The case for keeping OES is the case for keeping the file and print tier you trust, not the case for replicating Microsoft 365 inside OES.

We help SMEs across Hertfordshire, Bedfordshire and London design file, print and storage estates that genuinely match how their teams work — including the Open Enterprise Server deployments that still earn their place in 2026. If you are weighing the cost and operational shape of your file and print estate against a cloud-first alternative, get in touch for a short, practical conversation.

What Open Enterprise Server actually is

At its core OES is a Linux-based services platform for SMEs and mid-market sites. It delivers file services via the NSS (Novell Storage Services) file system and NCP and CIFS protocols, shared printing through iPrint, mobile and remote file access through Filr, identity through eDirectory, and a cluster stack for high availability. It runs on SLES (SUSE Linux Enterprise Server) and is sold as a per-server or per-user subscription. The current generation explicitly supports using Active Directory as the identity source alongside — or in place of — eDirectory, which materially changes the integration story for sites that have already moved some workloads into Microsoft.

A short history

• 1980s–2000s: Novell NetWare dominates SME and education file and print. eDirectory (then NDS) becomes one of the most replicated directory trees in production anywhere.
• 2000s–2010s: Novell Open Workgroup Suite bundles GroupWise, eDirectory, iPrint and ZENworks. The Novell stack becomes the default mid-market IT environment.
• 2011: Attachmate acquires Novell. The product lines continue, including OES.
• 2014: Micro Focus acquires Attachmate. Open Enterprise Server becomes a Micro Focus product line.
• 2023: OpenText acquires Micro Focus. OES is published under OpenText branding, on a quarterly release model with explicit LTS branches.
• Today: OpenText OES 24.x is the current generation. OES 23.4 remains the LTS track. A Community Edition of recent releases is available for evaluation, home and small-business use.

Where OES still makes sense in 2026

There is a category of SME for whom OES is still the obvious answer. Schools and colleges who built their admin estates on Novell twenty years ago and have never had a reason to leave — the directory, the file shares, the print queues and the GroupWise mailbox have all worked consistently and quietly across multiple IT team handovers. Professional services firms whose case file shares, document management and identity are deeply embedded in eDirectory trees no-one wants to disturb. Manufacturing and logistics sites whose file and print services have run on OES for over a decade with negligible downtime. Government-adjacent SMEs whose customers and contracts expect on-premise file and identity by design. None of these are particularly fashionable reasons to choose a platform in 2026. They are, however, real reasons and they keep showing up in actual renewals.

Where OES shows its age

Honest list of weaknesses: the SME-facing talent pool for OES is smaller than the talent pool for Windows Server, and that talent pool skews older and retires faster than it grows. Management is overwhelmingly Linux-based and tools-fluent, which excludes a chunk of the Windows-trained SME IT population. The browser and SaaS-integration story has improved but is not as automatic as the Microsoft equivalents. The mobile experience depends on Filr being deployed well, which many sites have not done. None of these disqualifies OES. They do mean OES works best where there is a named eDirectory-fluent engineer, internal or contracted, who can keep the estate healthy.

What to do if you still run it

• Get onto a supported release. Running an OES version that is past committed support is the single biggest risk we see on long-running OES estates.
• Pick the LTS line deliberately. The 23.4 LTS branch is the right starting point for almost every SME that values stability over feature velocity.
• Document identity. If your eDirectory tree has not been actively audited in years, that is the single biggest operational risk you have.
• Make sure your backup and restore story is tested. OES estates tend to have working backups and untested restore procedures, often for years.
• Decide whether OES is a permanent choice or a deliberate transition. Either decision is fine; the worst outcome is the choice being made for you by an unplanned incident.

OpenText is committed to the Open Enterprise Server product line and the roadmap continues to ship on a quarterly cadence. For SMEs that have a genuine operational, financial or strategic reason to keep OES in production, the platform remains a sensible and supported choice. If you would like an independent review of your OES estate, get in touch for a short, practical conversation.

What cloud email actually assumes about your link

Cloud email is engineered to tolerate ordinary packet loss — Exchange Online, Outlook and the Office web apps cope well with the flaky coffee-shop Wi-Fi of the modern mobile worker. What they do not do well is disappear. If the WAN connection between a remote site and the rest of the world is offline, the people on that site cannot read mail they have already received, cannot search their mailbox, cannot read thread history, and cannot work offline in any meaningful way. Outlook's cached mode is helpful but is not a substitute for a local mailbox. There is a category of SME for whom that is not an acceptable failure mode.

Where GroupWise still wins on resilience

• Manufacturing and logistics sites: a factory floor, a distribution centre or a warehouse operation that genuinely cannot depend on consumer-grade broadband for normal operation.
• Agriculture, marine and field-research SMEs: sites where the best available internet is a contended LTE connection shared with the surrounding geography.
• Construction and infrastructure SMEs: temporary sites where connectivity is set up by project and may not be present in the early days of a contract.
• Rural professional services: solicitors, accountants and surveyors in genuinely remote towns whose premises-grade broadband is materially worse than central London equivalents.
• Branch offices with poor uplink quality: a town where every leased line is contended and the secondary 4G connection is the only realistic path.

Why "just add more bandwidth" is not always the answer

For some sites adding bandwidth is straightforward and cheap. For other sites it is neither. A leased line to a rural manufacturing site may take six months to install and cost more per month than the GroupWise licence. A reliable 4G or 5G solution in a metal-framed warehouse may require a survey, an external antenna and ongoing signal-management work. In those cases the honest answer to "should we move to Microsoft 365" is often "yes, but only after the connectivity story is fixed, and even then some sites will continue to need on-premise resilience". The SME that makes the prudent choice is the one that refuses to pretend the WAN is reliable when it is not.

How GroupWise behaves when the WAN goes away

A GroupWise mailbox, served by a Post Office Agent sitting in the same datacentre, keeps working when the WAN does not. Users keep their cached mail, their local client behaves sensibly against the local server, web access continues to work over any local network the site still has, and the gateway queues outbound mail until connectivity returns. There is no dependency on a remote service that the SME cannot reasonably operate locally. For sites with genuine availability requirements — a production planning team that must read yesterday's shift reports, an account handler who must check inbound mail at 7am — that local resilience is the deciding factor.

Designing the topology to make the most of it

The strongest GroupWise deployments for resilience-hungry sites are the ones where the messaging tier has been moved to a small local server rather than centralised. The pattern looks like this: a central eDirectory tree for identity and policy, one Post Office Agent per site that genuinely needs local resilience, site-level SMTP queuing through GWIA, and a synchronised copy of the user data that is small enough to live comfortably on a modern small-form-factor server. Total cost of ownership for that pattern is competitive with the connectivity cost of doing it the cloud-only way, and availability in practice is markedly better.

Pairing GroupWise with cloud elsewhere

A few of the strongest GroupWise deployments we encounter use cloud tooling elsewhere by deliberate design: Microsoft 365 for productivity, files and chat through OneDrive and Teams, and GroupWise as the resilient messaging tier. The pattern works when the on-premise estate is seen as a deliberate platform choice rather than as legacy, and when the cloud usage above it does not assume the messaging tier is also in the cloud. Not every SME can make that argument cleanly, but the ones that can find it genuinely durable.

We help SMEs across Hertfordshire, Bedfordshire and London design messaging topologies that match the operational reality of their sites — including the GroupWise deployments that keep working when the WAN does not. If you are weighing the cloud-first assumption against the resilience you actually need, get in touch for a short, site-aware conversation.

What residency is really being asked for

When a customer asks "where is our data held" they are usually asking three things at once. First, that the data does not leave the UK at rest. Second, that it does not leave the UK in transit on the way to a service or a backup. Third, that the people who can read it cannot be moved to a non-UK team without your consent. Cloud platforms can answer the first two of those questions, but only with careful configuration and ongoing tenant management. GroupWise answers all three by construction — the data sits on your hardware, the replication topology is yours to design, and the administrators with read access are the ones you hired.

Where the question gets asked most often

• Public sector and suppliers to public sector: contracts increasingly require UK-hosted email as a baseline, with named exception processes for anything outside that.
• Legal and professional services: client confidentiality duties, professional regulator guidance and a long-standing cultural preference for self-hosted document and message storage.
• Health-adjacent SMEs: anything touching identifiable patient data, even indirectly, has been pushed firmly into the on-premise or carefully-scoped-cloud end of the spectrum.
• Defence, policing and security-cleared supply chains: the National Cyber Security Centre guidance and the contractual flow-down from prime contractors keep this conversation alive.
• Financial services suppliers: smaller firms in the regulatory perimeter often find on-premise email easier to evidence than a cloud tenant with jurisdiction questions.

What residency by design actually delivers

In GroupWise the mail store, indexes, post office and gateway live on hardware inside your datacentre or a UK colocation facility you control. Backups go to a destination you choose — your own tape library, your own offsite store, or a UK-supplied cloud backup service. Replication is your decision, your topology, your SLA. There is no secondary copy held by the platform vendor in another jurisdiction that you have to remember exists. For an SME under regulatory or contractual pressure, that is a much simpler story to tell and to prove, both at tender time and at audit time.

Why this is not just a marketing point

The cloud platforms have improved materially over the last five years. UK and EU data residency is now available at the licence level on Microsoft 365, customer-key encryption exists, and a competent partner can configure a tenant that genuinely satisfies most UK data-residency requirements. The honest comparison is no longer "cloud cannot do this" but "cloud requires more configuration, more governance, more ongoing tenant management to do this". On GroupWise, the configuration is the design. That difference shows up the most clearly when a customer asks, in writing, who can read our mailbox metadata at three in the morning on a Sunday — and the SME has to answer without consulting a vendor.

What to put around it

Residency by design is only useful if the rest of the estate is up to the same standard. That means TLS-strict on every SMTP, IMAP and Web Access path with current ciphers; restricted administrative access to the GroupWise servers with named humans and named change-control; tested, restorable backups with documented UK-only destinations; and a written data-handling policy that any auditor or customer can be walked through without notes. None of this is exotic; all of it is the difference between a residency claim that survives scrutiny and one that does not.

The honest boundary

Residency by design does not mean GroupWise is the right answer for every residency-led conversation. If the rest of the business is going to live in Microsoft 365 for productivity, chat, file storage and identity, running GroupWise alongside it becomes a complexity rather than a clean architectural decision. The strongest residency arguments for GroupWise come from SMEs whose wider stack is compatible with an on-premise messaging tier — usually because their wider stack is itself modest, or because their on-premise identity is already deeply embedded in eDirectory.

We help SMEs across Hertfordshire, Bedfordshire and London design messaging estates that genuinely satisfy UK data-residency requirements, including the on-premise GroupWise deployments we encounter in regulated supply chains and professional services. If you are answering a residency question in a tender and want a short, practical review of your estate, get in touch.

What "predictable TCO" actually means

Total cost of ownership for email includes more than the licence line. It includes the server you run it on, the storage it consumes, the backup infrastructure, the licences for any third-party components you bolt on, the human time to keep it healthy, and the way each of those behaves over years. A platform that gives you a steady, well-understood number across all of those for a five-year horizon is more valuable than a platform with a low sticker price that quietly grows as users are added, add-ons are layered on, and security features that used to be free become paid tiers.

The line items that surprise people on the cloud side

• Price rises: Microsoft 365 list prices historically step up every three to five years. A Business Premium seat at £20 this year is not guaranteed to stay there.
• Tier creep: the security feature that protects against the threat you actually worry about tends to live in the next licence tier up. Defender for Endpoint P2, Entra ID P2, the E5 compliance stack — all of these become "essential" once you read the questionnaire carefully.
• Audit storage: Exchange Online archive storage beyond the default allowance is metered. For SMEs that genuinely need long-term archive, the metered bill grows with retention.
• Add-ons: every decent compliance or migration tool — third-party backup, eDiscovery, advanced mail-flow filtering — costs extra on top of the licence.
• Per-user growth: cloud bills grow linearly with every new joiner. An SME that doubles in headcount doubles their email line, exactly when other costs are also rising.

Where GroupWise holds the line

GroupWise is licensed per concurrent user on a multi-year agreement that does not, in practice, experience the same year-on-year step-ups. The server you run it on is depreciating hardware you already own. Backup and storage scale with usage but are owned outright. Once the platform is up and stable, the marginal cost of adding a user is the licence plus a small amount of disk — there is no parallel cloud bill growing in the background. For a 60-person professional services firm with a five-year IT plan and a finance team that prefers to know what they are spending, that predictability has real value.

What you give up for that predictability

Honesty matters. The case for GroupWise on cost comes with three costs it does not include. The first is the human cost: someone has to look after the platform, even on LTS, and that someone has to be paid for and retained. The second is the security-feature gap: you do not get Bundle A in GroupWise. You build equivalent outcomes with whatever stack you put in front of it, and you have to keep that stack current. The third is the strategic cost: while you are paying less and predicting more accurately, your team may be missing out on the productivity features Microsoft 365 is now bundling, and you have to account for that in your broader IT plan. None of those caveats disqualifies GroupWise. They just mean the cost case has to be weighed honestly against the strategic case.

The financial framing that usually decides it

For SMEs under about fifty users the honest answer is usually cloud. The per-seat economics combined with the operational simplicity beat on-premise in most cases. For SMEs between fifty and three hundred users the answer depends on whether you can find and retain the operational skills to run it well — at that headcount the cost lines cross and the deciding factor is operational. For SMEs above three hundred users with mature IT estates, the financial case for GroupWise tends to strengthen again: the cloud bill compounds, the on-premise cost amortises, and a stable platform that you control starts to look like an asset rather than a liability.

When to model both sides

Two situations make a proper five-year TCO model worthwhile. The first is when you are about to renew a multi-year IT contract and the choice between on-premise and cloud is genuinely live. The second is when you have a finance team that plans on rolling three-year horizons and is asking real questions about which path leaves them with the most predictable cost basis. In both situations, build the model with the line items in this article, not with the headline licence number — that is the level at which the answer becomes useful, and that is the level at which GroupWise often surprises people.

We help SMEs across Hertfordshire, Bedfordshire and London build honest five-year cost models for both Microsoft 365 and on-premise GroupWise estates. If you are weighing the two in a renewal cycle and want a model that withstands scrutiny, get in touch for a short, practical conversation.

LTS versus quarterly: the trade-off

The LTS track gives you fewer mandatory upgrades, longer support windows and a more predictable change calendar, in exchange for slower access to new features. The quarterly track gives you nearer-term access to new capabilities at the cost of an upgrade every few months and a faster end-of-support horizon. For most SMEs with a small IT team and no appetite for constant change, LTS is the right call — version 23.4 is the LTS to be on in 2026, and the expectation is that the next LTS branch will be available when this one approaches its end of committed support. For SMEs with a competent in-house team and genuine feature need, quarterly is fine, provided the team genuinely has the calendar to keep up with it.

Upgrades without surprises

• Plan upgrades around your business cycle, not around the vendor release schedule. Quarterly does not mean "do it the day it ships".
• Read the OpenText release notes end to end before scheduling the upgrade. Most surprises in GroupWise upgrades come from changed default behaviour, not from broken behaviour.
• Stage the upgrade in a lab post office that mirrors production. Run a representative set of clients — Windows client, Web Access, mobile — against it for at least a week.
• Take a verified, restorable backup immediately before the cutover. Verify the backup by actually restoring a sample mailbox, not by trusting the backup software's success message.
• Schedule the production upgrade in a planned outage window. GroupWise is still email: any downtime is felt by the whole business.

Security posture in 2026

GroupWise in 2026 sits inside an estate that almost certainly has Microsoft 365 or Google Workspace for at least some workloads, modern endpoints, and a managed firewall. The security job is to make sure GroupWise does not become the weakest link. That means enforcing MFA on the identity store in front of GroupWise — typically eDirectory combined with Entra ID or a third-party SSO bridge — turning on TLS for SMTP, IMAP and Web Access with current ciphers, restricting Web Access by source network where practical, and making sure the GroupWise Anti-Spam and Anti-Virus modules are running with current rulesets. None of this is complicated in principle; all of it tends to drift in practice without a named owner.

Disaster recovery and backups

Most ageing GroupWise estates we encounter have a backup product running and a recovery plan that nobody has actually tested. The minimum viable disaster-recovery story is: a backup of the Post Office Agent database, a backup of the GWIA configuration, a backup of the Web Access server configuration, a backup of eDirectory, and a documented restore procedure with measured recovery times. The single most valuable habit is restoring a sample mailbox — different from restoring from last night's incremental — at least twice a year. Until you have done a real restore, every quoted recovery time is a guess.

Identity and the long-term problem

The single biggest operational risk on long-running GroupWise estates is almost always the identity store. People left, retired, or moved on, and eDirectory trees grown organically over fifteen years become difficult to administer and risky to change. If your GroupWise authenticates against a tree no-one feels confident touching, that is the place to start the lifecycle review. Modernising the identity layer — whether that means cleaning eDirectory, federating with Entra ID through a third-party SSO bridge, or both — gives you options later. Identity strain is the thing that turns "we are keeping GroupWise" into "we have to migrate urgently" without warning.

When to admit it is time to plan the move

Three signals tell you that the on-premise decision has aged out, even if the original reason for it still holds. The first is that the upgrade cadence has slipped — if you are more than one release behind tracked LTS, the cost of catching up is itself material and growing. The second is that the people who know the platform internally are no longer available and the only vendor left who can help is on a multi-week lead time. The third is that the rest of the business has moved to SaaS tooling that assumes modern authentication and GroupWise is the thing that prevents those tools being used. None of those signals is a surprise; all of them are the right time to start a deliberate migration conversation rather than a forced one.

We help SMEs across Hertfordshire, Bedfordshire and London build and run sensible lifecycle plans for legacy platforms — including the GroupWise estates that are still serving a real business purpose — and we help the same businesses prepare and execute Microsoft 365 migrations when the time comes. If you would like an independent review of where your GroupWise estate sits on that lifecycle, get in touch for a short, practical conversation.

Discovery — know what you are actually moving

Before any tooling touches a mailbox you need a clean inventory: how many post offices, on which versions of GroupWise, how many mailboxes in total, broken down by user, resource, and shared folder. Capture mailbox sizes, the size of the on-disk archive if you have one, the number of delegated mailboxes, the number of GroupWise rules and the volume of documents held in shared folders. Capture it again from the Microsoft 365 side: how many licences you have, which plan, whether you have the right Entra ID P1 or P2 features for conditional access from day one. The aim is to know exactly what you are moving, how big it is, and which edge cases will need human handling.

The migration tool landscape

• CloudM Migrate: a mature SaaS tool with strong GroupWise support, well-suited to IMAP-style or API pulls into Exchange Online.
• Transend: a long-standing on-premise migration engine with explicit GroupWise connectors, useful for complex cutovers where you want full control of the pipeline.
• Shoviv GroupWise to Office 365: a lower-cost tool aimed at smaller migrations and one-off mailbox moves; capable but light on enterprise features.
• Microsoft FastTrack Partner-led: Microsoft-funded partner time for onboarding Microsoft 365 at scale, including migrations from competing platforms.
• PowerShell and Graph scripting: appropriate for small numbers of resource mailboxes or bespoke shared-folder mapping, but not a substitute for a real migration tool at scale.

Pick the tool based on the inventory you built in discovery. For most SMEs between fifty and three hundred mailboxes the answer is CloudM or Transend with a partner running the engagement. For projects with heavy shared-folder usage, complex delegate chains or regulatory evidence requirements, the on-premise Transend approach gives more control. Tools are not interchangeable: each handles calendar quirks differently and each has a slightly different model for handling GroupWise rules and signatures.

Mail, contacts, calendar, free/busy, rules and signatures

Email migration itself is usually the easy bit — modern tooling moves years of mailbox content reliably, including folder structure and metadata. Contacts migrate cleanly when the source GroupWise contacts are well-maintained; expect to do a small amount of dedup work at the Exchange Online end. Calendar data is the most likely source of cutover-day surprises: recurring meetings with exceptions, shared calendars across multiple users and resource booking calendars all behave differently between GroupWise and Exchange. Free/busy data between users on the same platform migrates well in our experience; free/busy between migrated and not-yet-migrated users during the pilot phase does not, and that is one reason pilots are useful.

Shared folders and delegated mailboxes

Shared folders are the part of GroupWise that most resembles an old-fashioned file share inside the email client. Modern equivalents in Microsoft 365 are a combination of shared mailboxes, SharePoint document libraries and Microsoft 365 Groups. The mapping is not one-to-one and the design conversation is the most valuable part of the project: which shared folders genuinely remain shared mailboxes in Exchange Online, which become SharePoint sites, which become Microsoft 365 Groups with attached Teams channels, and which really should be retired because the business no longer needs the volume of historic data they contain. Delegate relationships — boss and PA setups — usually migrate cleanly if they were modelled correctly in the first place.

Pilot, cutover and order of operations

• Pilot with five to ten representative users across two or three teams. Include at least one heavy shared-folder user and one heavy calendar user.
• Run the pilot in parallel with GroupWise for a week or two. Users keep both clients and report on differences, missing data and odd behaviour.
• Decide on a wave plan for the rest of the business, typically grouped by team or by post office. Avoid migrating the whole company in one weekend.
• Schedule cutover out of hours for each wave, with rollback to GroupWise kept open for at least one business cycle.
• Decommission GroupWise formally only once every mailbox has been migrated, the shared folders have been validated, and the legal hold / archive requirements have been confirmed in writing.

Common pitfalls to avoid

Three patterns account for most of the projects we have had to rescue. The first is starting the migration before the Microsoft 365 tenant is properly set up — domain verification, licence assignment, conditional access baseline and the security defaults you actually want are not optional. The second is leaving GroupWise DNS records in place too long after cutover, which results in a confusing period where mail lands in the wrong place and the helpdesk gets buried. The third is forgetting the on-disk GroupWise archive: it is rarely needed in the live migration because users have already moved what matters into the current mailbox, but it has to be retained for the legal retention period your business is committed to.

We help SMEs across Hertfordshire, Bedfordshire and London land on Microsoft 365 cleanly, including the GroupWise migrations we encounter most often in education, local government suppliers and long-established professional services firms. If you are weighing a move and would like a fixed-price scoping conversation, get in touch.

Ransomware has not gone away — it has just changed shape

The big shift in the last two years is away from noisy, mass-distributed ransomware and towards quieter, more targeted operations. Attackers spend longer inside the network before they encrypt anything, often weeks. They map backups first. They exfiltrate data, then threaten to leak it as a second lever even if the encryption is paid off. The classic "we got hit, the servers are encrypted, we pay the ransom" story has been almost entirely replaced by a longer, more patient process that ends in double extortion. For SMEs the practical implication is the same: detect early, isolate fast, and assume the leak is part of the attack whether you pay or not.

Exploits are increasingly targeting edge devices

FortiGuard again flags firewalls, VPN concentrators, remote-access appliances and other internet-facing devices as the highest-volume target class. These devices are often managed by a third party, run firmware that is months out of date, and sit in the DMZ as the trusted edge of the network. The reason is simple: a working exploit against a perimeter appliance gives the attacker network-level access to everything behind it, often without triggering endpoint detection. The mitigation is equally simple and almost universally neglected: enable automatic firmware updates on every managed appliance; have a documented quarterly review for those that cannot auto-update; and remove from production any device that has been end-of-life for more than 90 days.

OT and ICS activity keeps climbing

Activity against operational technology — the kit that runs factories, building management systems, smart-building climate controls, even commercial kitchen and refrigeration equipment — is now a regular finding in the threat data, not a one-off. Most SMEs do not think of their OT estate as part of the cybersecurity conversation because it is run by facilities or operations, not IT. That gap is the attack. The minimum sensible response is a network-segmentation review: physically or logically separate the OT network from the IT network, restrict inbound and outbound traffic to an explicit allow list, and make sure someone in the business is accountable for patching the OT kit on the manufacturer’s schedule.

Credential abuse is still the easiest path in

Phishing, password reuse and credential leaks remain the single largest attack vector in the data, ahead of every zero-day combined. For SMEs that means the boring stuff is still the most valuable: enforced multi-factor authentication on every account (including service accounts where technically possible), conditional access policies that challenge sign-ins from unusual locations or unmanaged devices, dark-web exposure monitoring for corporate credentials, and an annual review of who actually has admin rights. None of this is glamorous. All of it materially reduces the chance of being the next incident.

What we change for our clients as a result

• Tighten edge-device firmware management — automatic updates where possible, scheduled manual updates for the rest, with a written register of what is in production.
• Add a quarterly review of OT/ICS segmentation into the standard managed-service cadence.
• Expand phishing simulation and security-awareness training throughout the year, not as a single annual exercise.
• Review credential exposure monthly for the executive team and any user with admin or finance authority.
• Validate backup immutability and an actual restore against ransomware-grade scenarios, at least once a year, on every managed tenant.

If you would like to see how this maps to your own environment, talk to us. We help SMEs across Hertfordshire, Bedfordshire and London translate global threat intelligence into a practical, prioritised to-do list — usually under a day’s work and without the need for a dedicated SOC.

What you are actually comparing

Both platforms deliver the four things every business depends on: reliable email, shared calendars, address books, and shared folders. GroupWise does it with a Post Office Agent on your own server, GWIA for SMTP, Web Access for browser clients and optional native clients. Microsoft 365 does the same four things but in the cloud, with Exchange Online, Outlook, the Office web apps and OneDrive. Power and feature parity is much closer than it used to be: GroupWise calendaring is solid, and Outlook plus Exchange Online still represents the gold standard that GroupWise is compared against.

Cost and licensing

GroupWise licensing is a one-off or annual subscription per concurrent user, with no per-mailbox cloud component. Beyond the licence you pay for the server you run it on, the storage it consumes, the backup infrastructure and the human time to keep it healthy. Microsoft 365 is the opposite: a monthly per-user licence that bundles Exchange, Teams, SharePoint, OneDrive, the Office apps and an increasingly large security stack. For an SME under fifty users GroupWise is usually cheaper; for an SME between one and three hundred users the comparison flips once you add the cost of running the on-premise estate properly. Above three hundred users Microsoft 365 wins on cost almost every time we model it.

Security and compliance

• Identity: Microsoft 365 is anchored on Entra ID with conditional access, MFA enforcement, identity protection and risk-based policies. GroupWise relies on the identity store you put in front of it, most commonly eDirectory, with whatever SSO bridge you have built.
• Endpoint: Microsoft 365 Business Premium and E3/E5 ship with Defender for Business or Defender for Endpoint, Intune and the full Microsoft XDR loop. GroupWise is shielded only by whatever endpoint protection runs on the clients connecting to it.
• Compliance: DLP, sensitivity labels, eDiscovery, customer key encryption and audit pipelines are first-class on Microsoft 365. The same capabilities on GroupWise require third-party tooling.
• Insurance: most cyber-insurance questionnaires in 2026 assume cloud email with MFA and conditional access. Running GroupWise is not a deal-breaker, but it is increasingly a question you have to answer.
• Data residency: GroupWise keeps data in your datacentre by construction. Microsoft 365 offers UK and EU data residency at the licence level. For some SMEs the on-premise story still wins on this one point alone.

Mobile, web and modern UX

Outlook on mobile is the most polished email client on any platform, and the web app is the de facto standard against which everything else is judged. GroupWise Web Access is functional and has improved over the years, but it is nowhere near Outlook in fit and finish. Third-party GroupWise mobile clients exist and are competent, but they are not part of a unified Microsoft-style productivity surface. If your team works on phones and tablets for a significant part of the day, that gap matters.

Ecosystem and integrations

Microsoft 365 is the centre of gravity for the modern SME productivity stack: Teams for chat and meetings, SharePoint for intranets and document management, Power Automate for workflow, Power Apps for line-of-business tools, Graph API for custom integrations. GroupWise integrates with its own set of tools and a smaller ecosystem of third-party connectors. If your roadmap includes anything built on Microsoft Teams, Copilot, Graph-based integration with line-of-business systems, or modern identity governance, GroupWise will always be the limiting factor rather than the enabling one.

The honest case for staying on GroupWise

There genuinely is a case. If you are a small organisation with stable headcount, you already have the skills to run Linux, OES and GroupWise well, your data residency requirements genuinely demand on-premise, your internet connectivity is patchy enough that cloud email would be a real risk, and you have no appetite for the AI productivity features that Microsoft 365 is now bundling — GroupWise remains a sensible answer. The mistake is to stay for the wrong reason: because the migration feels expensive or scary, not because staying is genuinely the better choice. That is a decision that ages badly.

We help SMEs across Hertfordshire, Bedfordshire and London design Microsoft 365 migrations that do not break the business, and we help the smaller number who choose to stay build a sensible lifecycle plan for GroupWise. If you are weighing the move, get in touch for a one-hour scoping conversation.

What the questionnaire now asks

• Evidence of multi-factor authentication on every account that can access email, file shares or administrative systems — including admin and break-glass accounts.
• Endpoint detection and response (EDR) deployed across all in-scope devices, with central reporting and a named human or managed service accountable for alerts.
• Tested, immutable backups with a documented recovery time objective for critical systems and an annual restore drill against a real workload.
• An incident response plan that is written, rehearsed and contactable — including out-of-hours escalation and named decision-makers.
• Security awareness training, with evidence of phishing simulations and refresher cadence.
• Email security that goes beyond Microsoft’s defaults — DMARC, SPF and DKIM correctly configured, sandboxing on attachments and links.
• Privileged Access Management: separated admin accounts, no standing domain admin, time-bound elevation.

The common reasons cover is reduced or refused

The single biggest reason for a partial payout is inadequate MFA — typically an environment where MFA is "available" but not enforced, so a single compromised password is enough to walk into corporate data. The second biggest is an untested backup estate: insurers increasingly want evidence of a real restore, not just a backup report. The third is a missing or out-of-date incident response plan: at claim time, the insurer expects you to be able to produce it and to follow it. None of these are hard to fix in advance. All of them are expensive to be missing at claim time.

Cyber Essentials — the cheap shortcut

Most UK cyber insurers will accept a current Cyber Essentials (or Cyber Essentials Plus) certification as evidence of the baseline security controls. It does not waive the questionnaire, but it materially simplifies the answers and removes several of the trickier questions. For an SME that already has the certification, renewal is a paperwork exercise; for one that does not, it is a six-to-eight-week project. The economics almost always work out in favour of getting certified first.

What we recommend ahead of a renewal

• 1. Pull last year’s renewal questionnaire and the answers you submitted. Treat it as the working list of controls to evidence this year.
• 2. Run a gap review against the controls above. Where there are gaps, prioritise the ones that affect cover terms first — MFA enforcement, tested backups, EDR with central reporting.
• 3. Get Cyber Essentials certified if you are not already. The badge is the cheapest evidence an insurer will accept for the baseline questions.
• 4. Test a real backup restore against a critical system in the 90 days before renewal. The restore report is the single most useful artefact for the questionnaire.
• 5. Document the incident response plan in one page. Print it. Rehearse it once. The insurer will not read the plan unless there is a claim, but they will read whether you have one.

The pricing reality

Premiums for SME cyber cover rose sharply through 2023 and 2024 and have stabilised at a higher level since. The SMEs seeing flat or reducing premiums at renewal are the ones with the best questionnaire answers — particularly MFA, tested backups, EDR and a current Cyber Essentials badge. For everyone else, premium increases have been significant and excesses larger. The path to better cover at renewal is the same path as better security in general: stop relying on hope.

We help SMEs across Hertfordshire, Bedfordshire and London prepare for cyber-insurance renewals — both as a one-off gap-review project and as an ongoing managed service. If your renewal is inside the next six months and you would like a free gap review, get in touch.

What GroupWise actually is

At its core GroupWise is a messaging system: email, calendar, contacts, tasks and shared folders, served by a Post Office Agent, a gateway (GWIA) for SMTP, and a Web Access component for browser clients. It runs on Linux or Windows, traditionally on top of Novell Open Enterprise Server (now OpenText eDirectory), and it holds its own against Exchange and its cloud successors on the basics — reliable email delivery, sensible calendaring, long-term on-premise stability and no per-seat cloud bill. The platform is mature, well-documented and considerably less resource-hungry than the cloud equivalents for organisations that already have the skills to run it.

A short history

• 1990s: Novell GroupWise launches as a companion to NetWare and Novell Directory Services (NDS). Becomes the default workgroup system across thousands of education, government and mid-market sites.
• 2011: Attachmate acquires Novell. GroupWise continues as a core Attachmate product line.
• 2014: Micro Focus acquires Attachmate. The Novell heritage, including GroupWise, becomes part of Micro Focus.
• 2023: OpenText acquires Micro Focus. GroupWise lands inside the OpenText Content Cloud portfolio alongside Information Management, Cybersecurity and other enterprise lines.
• Today: OpenText runs both a quarterly release track (currently 24.3, with 24.4 in late-cycle) and a long-term support track (currently 23.4 LTS), with security updates and bug fixes published on a published cadence.

Where GroupWise still makes sense

Despite the gravitational pull of Microsoft 365 and Google Workspace, there are still scenarios where GroupWise is the sensible answer. Schools and colleges that have run NetWare or OES for two decades often keep GroupWise because of existing directory structure, predictable cost, and the ability to host it on hardware they already own. Small legal and accounting firms with poor internet connections value the on-premise model because email keeps working when the WAN does not. Government and defence-adjacent sites with strict data-residency rules use GroupWise because the data stays inside their own datacentre. None of these are particularly fashionable reasons to choose a platform, but they are real reasons and they keep showing up in actual buying decisions.

Where it shows its age

The honest list of weaknesses: the native GroupWise Windows client is no longer the default for most users, who now use the Web Access interface or third-party clients. Mobile clients have improved over the years but they are still behind Outlook and Gmail in polish and reliability. The integration story with modern SaaS — SSO providers, SIEM tools, conditional access, modern MFA — is workable but not first-class. If your business is buying AI features, browser-based productivity suites and SaaS integrations in 2026, GroupWise will be forever in catch-up mode. For most SMEs the question is therefore not "is GroupWise good?" — it is "for how much longer is on-premise messaging the right shape for us?"

What to do if you still run it

• Get onto a supported release. Running 18.x or earlier is the single biggest risk we see on GroupWise estates today.
• Decide deliberately between the LTS track (23.4) and the quarterly track. LTS trades newer features for longer patch windows and fewer mandatory upgrades.
• Sort out identity. If your GroupWise still authenticates against an old eDirectory tree that no-one understands, that is your single biggest operational risk.
• Document the disaster-recovery story. Most ageing GroupWise estates we visit have a backup that has not been restored in five years and a recovery time that nobody has actually measured.
• Have a written migration plan, even if you do not act on it. Knowing how you would move off, and roughly what it would cost, is the difference between a deliberate decision and a forced one.

OpenText is committed to the product and the roadmap is active, but no on-premise messaging platform is a permanent decision in 2026. If you would like an independent review of where your GroupWise estate sits on that lifecycle, get in touch for a short, practical conversation.

Zero trust in one sentence

Stop trusting the network. Trust the identity, the device, the application and the context of every request — and verify them on every attempt, not just at sign-in. That is the whole idea. Everything a vendor sells under the zero trust label is some combination of those four checks applied to a specific part of the environment.

The five controls worth doing first

• Multi-factor authentication on every account, enforced — not optional, not just for admins, but every human and every account that touches production data.
• Conditional access: challenge sign-ins from unmanaged devices, unusual geographies or impossible travel patterns; block legacy authentication outright.
• Device compliance as a hard gate: only Intune- or equivalent-managed devices that meet the patch, encryption and endpoint protection bar can access company data.
• Network segmentation: stop trusting the corporate Wi-Fi as if it were the company. Segment by function and restrict east-west traffic between segments with explicit allow lists.
• Application-level access controls: prefer SaaS apps that support per-app conditional access over VPN tunnels into the corporate network.

The controls you can safely defer

A full microsegmentation project, a next-generation access broker for every legacy line-of-business app, a software-defined perimeter overlay — these are real zero trust building blocks but they are also large projects. For an SME without a security team, the right sequencing is: do the low-cost identity and device controls above well, then look at the bigger network and application-layer work when there is budget and a clear scope. None of the enterprise-grade zero trust architecture matters if the basics are not enforced.

What zero trust typically saves you

For SMEs that genuinely implement the five controls above, the practical benefits are concrete: simpler offboarding (revoke the identity and access follows), cleaner BYOD policy (managed apps only on personal devices, no corporate data ever stored locally), removal of the need for a traditional VPN in most cases, and a much better answer to the cyber-insurance questionnaire. The controls also produce real telemetry — sign-in risk, device compliance, conditional-access denials — that you can use to investigate incidents without paying for a separate SIEM.

We help SMEs across Hertfordshire, Bedfordshire and London design and deploy zero trust in a staged, right-sized way. If you would like a one-hour session to look at where you are now and what the realistic next six months look like, get in touch.

What a passkey actually is

A passkey is a cryptographic credential stored on a device — your phone, laptop or a hardware security key — that authenticates you to a website or app using the same standard as a physical security key. There is no password to type, no second factor prompt to approve, and the credential is phishing-resistant by design: it will only authenticate against the genuine site, never a fake one.

The three flavours of passwordless an SME will meet

• Microsoft passwordless sign-in via the Authenticator app — the entry point most SMEs will use first. Number-matching prompt replaces the password, with the phone as the second factor. Easy to deploy; no extra hardware.
• FIDO2 security keys (YubiKey, Feitian and equivalents) — a small USB-A, USB-C or NFC key that registers with the identity provider and authenticates on tap. Phishing-resistant by design. Recommended for admins, executives and anyone handling payments.
• Platform passkeys stored in iCloud Keychain, Google Password Manager or Windows Hello — the most user-friendly experience, increasingly the default for third-party SaaS applications.

What it replaces in your estate

Passkeys replace the password, not MFA. The passkey itself is already two factors. For most users this means the daily sign-in prompt becomes a fingerprint or a tap on a security key, with no password to forget and no second prompt to approve. The fall-back — what happens when the user has lost their phone — still has to be designed, but in practice it is rarely needed because the credentials are synced across the user’s own devices.

Practical advice for getting started

• 1. Roll out Microsoft Authenticator passwordless to general users first. It needs no hardware and removes the weakest factor (the password) from the daily sign-in.
• 2. Issue FIDO2 security keys to admins, executives and any user with payment authorisation. This is the smallest population with the highest target value.
• 3. Make platform passkeys the default for new third-party SaaS applications you adopt. Most modern providers now offer passkey sign-in alongside traditional passwords.
• 4. Keep a recoverable account (a managed password, in a vault, with brief time-limited access) as a last-resort fallback for break-glass scenarios. Test it once a year.
• 5. Monitor sign-in telemetry for users still relying on passwords, and gently migrate them away.

The honest limits

Some legacy applications do not support passkeys. For most SMEs these are now the minority, but they exist — old VPNs, line-of-business apps written ten years ago, and a handful of legacy cloud services. The right answer is usually to replace them; the next-best answer is to wrap them in conditional access with compensating controls. There is no scenario in which a shared or weak password on a legacy app should remain the only defence.

We help SMEs across Hertfordshire, Bedfordshire and London deploy passwordless sign-in in a way that genuinely improves the workday, not just the policy document. If you would like a scoping conversation, get in touch.

What "OT" actually means in an SME

Operational technology covers the dedicated hardware and software that monitors or controls physical processes: PLCs, SCADA systems, HMIs, building management systems, industrial sensors, modern refrigeration and HVAC controllers, IP cameras, badge-access systems and similar. It excludes the general-purpose IT estate (laptops, servers, networks) that runs the office, even though they share physical cabling and increasingly share IP networks too. The reason this distinction matters is that OT kit has different priorities: availability usually trumps confidentiality, downtime costs money per minute, and many devices cannot be patched because the vendor controls firmware and the upgrade window is constrained.

The threat has changed

Five years ago the realistic threat to OT for an SME was almost zero. The kit was isolated, the threat actors were focused on financial services and government, and most OT incidents involved accidental disruption rather than malicious actors. That has changed. Ransomware crews routinely attack manufacturing and logistics targets because downtime translates directly into ransom leverage. Nation-state groups have pre-positioned tooling in critical-infrastructure OT for geopolitical reasons. Insurance claims for OT incidents have grown noticeably year on year. The threat is real, it is here, and it disproportionately affects organisations that have not done the basic hygiene work.

Sensible segmentation and access controls

• Physically or logically separate the OT network from the IT network. At minimum, route between them through a stateful inspection firewall with an explicit allow list of permitted traffic.
• Document every device on the OT network: what it is, what firmware it runs, who supports it, what its patching cadence is, who to call if it fails.
• Restrict outbound internet access from OT devices. The vast majority of OT kit does not need the internet at all; if it does (for vendor telemetry, for example), allow only the specific destinations the vendor specifies.
• Replace shared and default administrator credentials on every OT device. Most come with vendor-default credentials documented in the manual.
• Establish a written change-control process for anything that crosses the IT/OT boundary — a new HMI, an external vendor who needs remote access, an edge analytics box that needs to read PLC data.

Patching in an environment where downtime is costly

OT vendors often test firmware updates for months before recommending them, and applying them frequently requires a planned maintenance window. That is fine — the discipline is to schedule those windows, not to skip them forever. Build a rolling OT patch register that records what was reviewed, when it was applied, and any deliberate deferrals with a reason. For devices that genuinely cannot be patched (because the vendor has gone out of business, for example), the answer is compensating controls: tighter segmentation, stricter firewall rules, more frequent vulnerability scans, and a written decision to accept the residual risk signed off by someone senior.

When to bring in a specialist

If your OT estate is large, regulated or genuinely safety-critical — pharmaceutical, food production, water, any environment with HSE implications — bring in an OT cyber specialist for at least a first review. For most smaller SMEs a competent IT partner, working from a sensible segmentation and asset-register template, can get you 80% of the way without the cost of a specialist engagement. The right conversation to have first is always "what is the worst that happens if this stops working for 24 hours" — the answer drives both the budget and the urgency.

We help SMEs across Hertfordshire, Bedfordshire and London bring their OT estate into the same risk-managed conversation as the rest of their IT. If you have recently added any new connected equipment, or if you have never audited what is sitting on the OT network, get in touch for a one-day review.

Why the gap is structural, not cyclical

The shortfall is not a temporary blip. The volume of regulatory and contractual pressure on SMEs has grown faster than the training pipeline can produce qualified people. Public-sector tenders increasingly require Cyber Essentials Plus, insurance questionnaires expect EDR and tested backups, large customers demand evidence of supplier security from their smaller suppliers. Meanwhile the university and apprenticeship pipeline produces a fraction of the graduates the industry needs. Even businesses with budget to hire often wait six to nine months for an experienced candidate and frequently settle for someone less senior than the role requires.

The four roles an SME actually needs

When we map the work to be done, an SME that wants to take security seriously needs four distinct skill sets: an identity and access person who can run Microsoft 365 or Google Workspace properly, including conditional access, MFA enforcement and policy hygiene; a network person who can segment the estate, manage firewalls and VPNs, and keep firmware current; an endpoint person who can deploy EDR, manage patching and respond to alerts; and an incident-response lead who knows what to do when something goes wrong. In a small team, that is four roles compressed into one or two people, often with neither the time nor the specialism to do any of them well.

Outcomes versus hires

• Managed identity: a partner that owns your Microsoft 365 or Google tenant end-to-end, including policy, licensing, conditional access, joiners and leavers.
• Managed network: a partner that owns the firewall, switching and Wi-Fi estate with a documented configuration standard and quarterly review.
• Managed endpoint: a partner that owns EDR deployment, patch management and the alert response process, with named humans accountable for triage.
• Managed response: a partner that holds the incident response plan, rehearses it with you annually, and is the first call when something goes wrong.

Each of these is a fraction of the cost of an equivalent in-house hire and bundled into a single monthly invoice. For an SME the result is coverage across all four skill areas from day one, with predictable cost and no recruiting risk. The genuine tradeoff is that you do not own the knowledge internally — if you ever want to bring it back in-house, plan a deliberate handover period rather than ending the managed contract cold.

What still has to live inside the business

Even with full managed coverage, three things still need an owner inside the business: an executive sponsor who signs off on policy and has authority at incident time, a primary contact who can make fast decisions about access, communications and business interruption, and a culture of cyber awareness that is not outsourced. Training, phishing simulations, clean-desk policy and clear reporting lines for anything suspicious all need to live with the people, not with the partner. The partner provides the technical capability; the business provides the culture in which it gets used.

We provide managed security services to SMEs across Hertfordshire, Bedfordshire and London — including a fully managed SOC adjacent service for businesses that want outcomes without the hiring problem. If you would like to compare the cost of an in-house security hire with fully managed coverage, get in touch for a short scoping conversation.

What Intune is actually for

Intune is Microsoft 365’s cloud-native mobile device management (MDM) and mobile application management (MAM) platform. It is the place where an SME’s standard build lives — the Win32 and Microsoft Store apps a workstation should have, the policies a device must comply with, the certificate and Wi-Fi profiles users should pick up automatically. Done well, you can wipe, redeploy or lock a device from a single console; done badly, you can do exactly that to a user at the worst moment.

The five configuration areas to set up first

• Windows device configuration — BitLocker, Windows Hello for Business, firewall, SmartScreen, account and lock-screen policies. One profile, applied to all corporate Windows devices.
• Compliance policies — the rules a device must meet to access corporate data. Use this to gate Exchange and SharePoint access from non-managed devices.
• App deployment — the standard Office, Edge, Teams and line-of-business apps. Required apps deployed automatically; optional apps available in the Company Portal.
• Autopilot — for new device provisioning. The user receives a laptop, signs in, and emerges minutes later with a fully configured standard build.
• Conditional access — the bridge between Intune and Microsoft Entra ID. Compliance status from Intune drives access decisions in real time.

Where SMEs typically go wrong

The two failure modes we see most often are opposite ends of the same spectrum. At one end, an over-keen IT team turns on every knob on day one and locks half the company out — restricted store access, mandatory reboots during the working day, passwordless sign-in rolled out before the helpdesk is ready. At the other end, Intune is enrolled but never enforced, so devices show "compliant" by default and the platform never actually protects anything. The right answer sits in the middle and is rolled out in deliberate phases.

A realistic 6-week rollout

• Week 1 — discovery and policy design. Audit the existing estate, agree the compliance baseline, document the standard build.
• Week 2 — pilot tenants. Build the configuration profiles in a ring, test on a small group of friendly devices, iterate on what breaks.
• Week 3 — pilot users. Enrol twenty or thirty real users from a friendly department. Measure time to set up a new laptop; measure helpdesk tickets.
• Week 4 — staged rollout, department by department. Communicate the change in advance, with clear fall-back to the old support path.
• Week 5 — tightening. Move from audit to enforce on the policies that proved safe. Expand to BYOD if required.
• Week 6 — operational handover. Document the runbooks, hand them to the service desk, and schedule a tune-up review in three months.

The ROI of doing it properly

Intune done well pays back in three places you can measure. First, time to set up a new laptop drops from half a day of engineer time to zero — Autopilot ships the standard build direct to the user. Second, security incidents drop, because the standard build includes the policies that block the common attacks. Third, Cyber Essentials and cyber-insurance questionnaires go from a half-day scramble to a green tick on the form. For an SME that has already paid for the licence through Business Premium, those are the gains that justify the project.

We deploy Intune for SMEs across Hertfordshire, Bedfordshire and London, typically sized to deliver measurable payback within the first quarter. If you have Intune licences but no clear policy, talk to us about a focused deployment engagement.

Phase 1 — audit before you migrate

• Inventory every Windows device: model, CPU, TPM version, BIOS version and current OS build. Anything below an 8th-generation Intel / Zen 2 AMD will not pass Windows 11.
• List every line-of-business application and call out the ones still running on Windows 7 or Windows 8 assumptions. These are the projects the migration will uncover.
• Identify the devices you intend to redeploy versus replace. Refresh budget should be planned alongside the migration, not after it.
• Capture the security baseline you want to land on: BitLocker on every disk, Defender with EDR enabled, Intune-enrolled, Standard user accounts as the default.

Phase 2 — choose your deployment method

For most SMEs, Microsoft Intune with Windows Autopilot is the right answer. New devices ship from the supplier to the user, the user signs in with their work account, and Autopilot applies the standard build — apps, policies, BitLocker key escrow, Defender onboarding — without an engineer ever touching the device. Re-deployments of existing in-house devices go through a wiped-and-rebuilt Autopilot flow as well, which guarantees the standard build and removes years of accumulated drift.

Phase 3 — standard build, not bespoke

• A single Intune device configuration profile covering BitLocker, Windows Hello, firewall, SmartScreen and account configuration.
• A single compliance policy that a device must meet before it can sync email or access SharePoint. No compliance, no corporate data.
• A standard user account by default — no local admins except a controlled break-glass group.
• Edge as the default browser, with SmartScreen and the Defender Application Guard enabled.
• Conditional access that blocks sign-ins from non-compliant devices, even with valid credentials.

Phase 4 — pilot then sequence

Pilot with a friendly team — typically IT first, then a small department that does simple work. Catch application compatibility problems before they hit finance or production. Sequence the rest of the business by risk: low-risk users first, customer-facing and regulated roles last. Communicate the sequence with dates, not vague windows. People appreciate knowing when their laptop will be touched.

Phase 5 — decommission the Windows 10 estate

Once a team is on Windows 11, retire the old Windows 10 hardware immediately. Devices that sit on a shelf "just in case" become the next ransomware foothold. Wipe the disks, remove from Intune, recycle through a certified IT asset disposal partner. Capture the asset register update for insurance and accounting.

We help SMEs across Hertfordshire, Bedfordshire and London plan and execute Windows 11 migrations using Intune and Autopilot, typically completing a 50-seat rollout in 6 to 10 weeks including training. If your Windows 10 deadline is approaching and you would like a free audit and costed plan, get in touch.

What actually changes on 14 October 2025

• No more free security updates from Microsoft for Windows 10 Home, Pro, Enterprise or Education.
• No more free technical support from Microsoft for Windows 10 issues.
• No more feature updates — Windows 10 is essentially frozen.
• Cyber Essentials requires all in-scope software to be in-support. Out-of-support Windows 10 will fail certification.
• Most cyber-insurance policies require supported, patched operating systems. Running out-of-support Windows 10 can void cover at claim time.

Your three options

Option one is upgrade in place: if the device meets Windows 11 hardware requirements (TPM 2.0, supported CPU, 4 GB RAM minimum, 64 GB storage), you can move it to Windows 11 for free. About 70 to 80 percent of business-grade laptops bought in the last four years qualify. Option two is replace the hardware: any device that does not qualify either gets retired or replaced with a Windows 11 device. Option three is buy Extended Security Updates from Microsoft, at a price that doubles each year — sensible as a short-term bridge for a few stragglers, expensive as a long-term plan.

The migration plan we use with clients

• Audit every Windows 10 device against the Windows 11 hardware requirements (we use Microsoft Endpoint Manager or a free script).
• Sort into three buckets: upgradeable now, replace within budget cycle, retire.
• Stage upgrades by team and risk — start with low-risk users to validate driver and application compatibility.
• Plan replacement purchases against your existing refresh budget so this is not a surprise cost.
• Use the migration as an excuse to tidy up Intune / autopilot, conditional access and standard build images.

Most SMEs we work with can complete the migration in 8 to 12 weeks of calm planning. The ones that leave it until September will be paying premium prices for hardware and rushing the rollout. If you want a free Windows 10 audit and a costed migration plan, get in touch.

Business Standard — the productivity baseline

Business Standard gives every user the full desktop and web apps (Outlook, Word, Excel, PowerPoint, Teams, SharePoint, OneDrive, Exchange Online). It does not include any meaningful security or device management. For a small team that uses cloud email, Teams and shared SharePoint sites — and is comfortable accepting baseline Microsoft security — this is the right starting point. Capped at 300 users.

Business Premium — the SME sweet spot

Business Premium is what most of our clients land on. It bundles everything in Business Standard plus the security and device-management features SMEs genuinely need: Microsoft Defender for Business (EDR), Intune (device management), conditional access via Entra ID P1, data loss prevention, sensitivity labels, and the Windows 11 Pro to Enterprise upgrade. For Cyber Essentials and most cyber-insurance requirements, Business Premium is the cheapest licence that covers you out of the box. Also capped at 300 users.

Enterprise E3 — when you outgrow Business Premium

E3 is the right answer when you exceed 300 users, when you have specialist compliance requirements (eDiscovery, advanced auditing, customer key management), or when you need unlimited archive mailbox storage. It does not include Defender for Business — you add Defender for Endpoint Plan 1 or 2 separately. For SMEs under 300 users, E3 is almost always more expensive than Business Premium for less SME-focused security.

The decision in one paragraph

Under 300 users and want a productivity-only setup? Business Standard. Under 300 users and want Cyber Essentials–ready security included? Business Premium. Over 300 users or need specialist compliance? E3 with the right Defender add-on. We help SMEs across Hertfordshire, Bedfordshire and London size their tenancy correctly — including catching the common mistake of paying for Business Premium and not enabling half of what it includes.

Where Microsoft Teams Phone wins

If your team already lives in Microsoft Teams for chat and meetings, adding Teams Phone means one app, one identity and one set of admin tools. Calls follow the user across desk, laptop and mobile. Voicemail goes to Outlook. Call recording sits in OneDrive. For office-based knowledge workers, the experience is unbeatable and the admin overhead is tiny.

Where dedicated hosted VoIP wins

If you have a busy reception, a sales floor, a contact centre, or any team that handles high call volume, a purpose-built VoIP platform usually beats Teams. The wallboards are better, the call-flow editors are more flexible, and supervisor features (whisper, barge, real-time queue stats) are built for the job. The hardware story is also stronger — most decent IP phones, headsets and DECT systems are designed VoIP-first, with Teams support as a secondary path.

The hybrid pattern we see most often

• Knowledge workers on Microsoft Teams Phone — one app, follow-me calling, voicemail in Outlook.
• Reception, sales and support on a dedicated VoIP platform integrated with Teams presence.
• A single externally published number, intelligently routed to the right system.
• One UK invoice covering both platforms, with consolidated reporting.

We design, deploy and support both Microsoft Teams Phone and dedicated hosted VoIP — including the hybrid setups that get the best of both. If you are facing a PSTN switch-off deadline or your current contract is up for renewal, get in touch for an independent recommendation.

Why prompts matter more than features

Copilot is essentially a translator between plain English and the Microsoft 365 apps your team already uses — Outlook, Word, Excel, PowerPoint, Teams and SharePoint. A vague prompt produces a vague output. A specific, well-scoped prompt produces something you can ship in minutes rather than hours. The trick is teaching people to write prompts the same way they would brief a junior colleague: with context, a clear goal, and an example of the format they want back.

The categories that deliver fastest ROI

• Sales — summarising customer communications, drafting follow-up emails, updating CRM notes from Teams calls.
• Marketing — generating campaign briefs, drafting first-pass copy, pulling insights from analytics workbooks.
• Finance — explaining variances in monthly reports, building Excel formulas, summarising long supplier contracts.
• HR — drafting policy updates, summarising candidate CVs, producing first-pass interview questions.
• IT and operations — converting meeting transcripts into action lists, drafting change-request documents, summarising long incident threads.

Getting started without wasting licences

Copilot licences are not cheap, so the worst outcome is rolling them out without an enablement plan and watching usage fall off after week two. We help businesses pilot Copilot with a focused group of power users, measure the time saved on real tasks, then roll out to the wider team with documented prompts and short training sessions. The result is licences that pay for themselves within a quarter.

If your team has Copilot but is not yet seeing the productivity gains you were promised, talk to us. We help SMEs across Hertfordshire, Bedfordshire and London get measurable value out of Microsoft 365 Copilot.

Where Copilot helps the most

Microsoft 365 Copilot is most valuable in the moments around the customer interaction — the preparation, the summary and the follow-through. It can pull together everything the customer has emailed you about over the last six months, surface relevant SharePoint policies, and draft a context-aware response in seconds. It can summarise a long Teams call into action items and update the case record without anyone retyping anything.

• Auto-summarising long email threads before the agent replies.
• Drafting first-pass responses that match the customer’s tone and history.
• Producing meeting notes and action lists from Teams calls in real time.
• Consolidating customer data scattered across Outlook, SharePoint and OneDrive.
• Translating internal policy documents into plain-English customer-facing copy.

Where it does not — and why that matters

Copilot is not a replacement for a proper customer service platform or CRM. If your case data lives outside Microsoft 365, Copilot cannot see it. If your knowledge base is out of date or scattered across people’s inboxes, Copilot will reflect that mess back at you. The teams getting the biggest wins are the ones that tidy up their SharePoint and Teams structure first, then add Copilot on top.

We help customer service teams across the UK plan, deploy and adopt Copilot in a way that produces real productivity gains — not just a licence cost. Get in touch to discuss a pilot.

Week 1 — discovery, not action

The first week is almost entirely listening and documenting. We sit down with the leadership team to understand the business, the seasons, the dependencies and the risks. We walk the office, photograph the comms room, label cables, and run automated discovery across the network. We audit the Microsoft 365 (or Google Workspace) tenant, the domain registrar, the line-of-business apps, the backup estate and the licence position. The deliverable at the end of week one is a written "as-found" document — what we inherited, what is good, what is risky, what is missing.

Week 2 — secure the front door

Before anything else, we lock the obvious risks: enforce MFA on every account, rotate shared and admin passwords into a managed password vault, review and trim global-admin and domain-admin membership, deploy our endpoint protection and RMM to every device, and validate that backups actually run and actually restore. None of this is glamorous. All of it is the difference between a quiet first quarter and a 2am phone call.

Week 3 — knowledge transfer and ticketing

By week three the helpdesk takes over day-to-day support. Every user has been introduced to the new portal, the new ticketing email and the new phone number. We hold short floor-walks so people can put a face to the support team. Internally we run knowledge-transfer sessions on the quirky bits of the environment — that one line-of-business app that needs a registry tweak, the printer in finance that only works on Tuesdays — and document them in our knowledge base.

Week 4 — strategic roadmap

The final week is where the relationship shifts from reactive to proactive. We present a 12-month roadmap: the risks we want to close, the lifecycle replacements coming up, the licensing optimisations available, the projects the leadership team has asked us to scope. We agree a monthly or quarterly service review cadence and the metrics we will report against.

Questions to ask any MSP before you sign

• "Walk me through your first 30 days. What is delivered, by whom, and by when?"
• "Who specifically will I deal with day-to-day, and who is the escalation point?"
• "How do you handle out-of-hours? Is it the same team or an overflow?"
• "What does your offboarding look like if we leave in 18 months? Do we get our documentation?"
• "What is included in the monthly fee and what is billed extra? Show me a real invoice."
• "How many clients of our size do you currently support, and can we talk to two of them?"

Switching IT provider should feel like a relief, not a leap of faith. If you would like to see what our onboarding plan would look like for your business specifically, get in touch and we will put one together as part of the proposal — no obligation, and you keep the document either way.

Devices: managed, not borrowed

Company-owned, Microsoft Intune-managed laptops are the foundation. Autopilot ships a new device direct from the supplier to the user’s home; they sign in with their work account and the device configures itself — BitLocker, Defender, conditional access, line-of-business apps, the lot. Personal devices stay personal: if someone needs access from a home PC they get it through a browser, with no company data ever stored locally. This single change eliminates 80% of the data-loss and offboarding pain we see.

Identity and access: MFA, conditional access, no VPN

Identity is the new perimeter. Every user gets multi-factor authentication — ideally via the Microsoft Authenticator app, with passwordless sign-in for the keen. Conditional access policies enforce sensible rules: only managed devices can sync mail, sign-ins from unusual countries get challenged, legacy authentication is blocked outright. For most SMEs this removes the need for a traditional VPN entirely: apps are reached over the internet, protected by identity, not by a tunnel.

Network: business-grade at home, properly at the office

For staff who work from home most days — directors, senior engineers, customer-facing roles — a consumer ISP router is usually the weakest link in the chain. We deploy small business-grade access points and routers (UniFi, Meraki Go) at home, configure a separate work SSID, and where the role demands it we provide a 4G/5G failover so a domestic broadband outage does not stop the day. At the office a proper Wi-Fi 6 deployment, wired uplinks for desk phones and meeting-room kit, and a tidy patch panel are non-negotiable.

Telephony and meetings: one number, anywhere

Hybrid working killed the desk phone. We move clients to a cloud telephony platform — Microsoft Teams Phone where the rest of the stack is M365, a dedicated VoIP platform otherwise — so that one published number rings the user wherever they are, on whichever device. Meeting rooms get a Teams Rooms or comparable system with a proper camera and microphone array; nothing destroys a hybrid meeting faster than a laptop on the boardroom table.

The rules that make it sustainable

Technology gets you 70% of the way. The remaining 30% is policy: a written remote-working policy that covers acceptable use, equipment, data handling and incident reporting; a clear offboarding process that wipes managed devices and revokes access the same day; and a regular review of who has admin rights, who has access to which SharePoint sites, and which third-party apps users have connected to the tenant. Done properly, hybrid is not a compromise — it is a recruiting advantage and a productivity uplift. Done badly, it is a slow-burn security incident.

What Defender for Business actually does

• Next-generation anti-malware on Windows, macOS, iOS and Android devices.
• EDR — behaviour-based detection of suspicious activity (ransomware patterns, credential theft, lateral movement).
• Automated investigation and remediation — Defender acts on common threats without waiting for a human.
• Attack surface reduction rules — blocks the techniques attackers use to get a foothold (Office macros, script-based attacks, credential dumping).
• Vulnerability management — continuous scan for missing patches and weak configuration, with prioritised guidance.
• Web content filtering — block phishing and malicious sites at the browser layer.

What to enable first

Out of the box, Defender does the minimum. The real value comes from a handful of policies that we apply on every deployment: enable all attack-surface-reduction rules in audit mode, then move them to block once you have triaged the noise. Turn on automated investigation at full automation. Enforce tamper protection so attackers cannot disable Defender from a compromised endpoint. Push Edge with SmartScreen and web filtering enabled. Onboard servers as well as workstations — most SMEs forget servers exist.

How it compares to third-party EDR

For the average SME, Defender for Business is now a credible alternative to dedicated third-party EDR products from vendors like SentinelOne, CrowdStrike or Sophos. The third-party products usually have better reporting consoles and stronger threat-hunting features — but those benefits only matter if you have someone watching the console. Most SMEs do not. Defender for Business, properly configured and bundled with a managed service, is the right answer for the large majority of SMEs we work with.

We deploy and manage Microsoft Defender for Business as part of our managed IT and managed security services. If you have Business Premium licences but are not sure whether Defender is doing anything useful, we offer a free 30-minute review.

The five controls, in plain English

• Firewalls and routers — every device that connects to the internet must sit behind a properly configured firewall, with the default admin password changed and unused services switched off.
• Secure configuration — devices and software ship with permissive defaults; you have to lock them down (no default accounts, no unused apps, auto-lock enabled, BitLocker on laptops).
• User access control — least privilege. Standard users do day-to-day work; separate admin accounts are used only when needed; multi-factor authentication on every cloud service.
• Malware protection — modern endpoint protection on every workstation and server (Microsoft Defender for Business, SentinelOne, CrowdStrike or similar), kept up to date.
• Security update management — operating systems, browsers and apps must be patched within 14 days of a high-severity update being released. No exceptions for the boss’s laptop.

The gotchas that fail first-time applicants

In our experience the same handful of issues sink most first attempts. Personally-owned (BYOD) phones that access company email are in scope and must meet the controls — most people forget this. Unsupported operating systems anywhere in the estate (a Windows 10 PC after October 2025, an old Server 2012 box quietly running a line-of-business app) are an automatic fail. MFA must be enforced, not just available — a tenant where users can still log in without MFA does not pass. And the scope statement matters: applying for a narrow scope is fine, but everything inside that scope must comply.

Cyber Essentials vs Cyber Essentials Plus

Cyber Essentials is a self-assessed questionnaire verified by an external assessor. Cyber Essentials Plus is the same controls, but independently tested by an assessor who will run a vulnerability scan against a sample of your devices and your external infrastructure. Plus is what most serious procurement processes and insurers actually want. If you are aiming for Plus, do not book the test until your patching, endpoint and MFA picture is genuinely tidy — failures are expensive to re-test.

How we approach it with clients

We treat Cyber Essentials as a side-effect of doing good IT, not as a project in its own right. For managed-service clients we keep an evidence pack that maps each control to the relevant tooling — Microsoft 365 conditional access policies, Intune compliance, Defender posture, patch reports from our RMM — so when renewal comes around the answers are already documented. If you have an upcoming tender, a renewal deadline, or a cyber-insurance question asking whether you are Cyber Essentials certified, talk to us early; the lead time to fix the typical findings is a few weeks, not a few days.

What Microsoft 365 actually retains

• Deleted items in Outlook: 14 days by default, recoverable from Deleted Items, then up to 14 more days in Recoverable Items. Total: 30 days.
• Deleted OneDrive and SharePoint files: 93 days in the recycle bin (first-stage 30 days, then second-stage to 93).
• Deleted user accounts: 30 days before the mailbox and OneDrive are unrecoverable.
• Teams chat and channel messages: governed by retention policies — by default kept indefinitely, but a single misconfigured policy can purge them.
• No version-by-version backup history beyond what Microsoft’s own retention provides.

The scenarios that catch SMEs out

A leaver’s account is closed and 31 days later finance realises they were the only person with three years of client contracts in their OneDrive. A ransomware attack encrypts SharePoint files via OneDrive sync, and by the time it is detected, version history has been cycled. An admin runs a "tidy up" PowerShell script and deletes a SharePoint site that had inherited data nobody had checked. A retention policy is changed and removes three years of Teams chat history overnight. In every one of these cases, Microsoft has done exactly what they promised — and your data is still gone.

What a proper Microsoft 365 backup gives you

• Independent copy of Exchange, OneDrive, SharePoint and Teams data, stored outside the Microsoft 365 tenant.
• Long-term retention well beyond Microsoft’s native windows — typically 7 years.
• Point-in-time restore: rewind a single mailbox, file or site to a specific moment.
• Granular restore — recover one email, one file or one Teams channel without restoring the whole tenant.
• Protection from administrative mistakes, malicious insiders, ransomware and misconfigured retention policies.

Microsoft’s own shared responsibility model is explicit: protecting your data is your responsibility, not theirs. We deploy and manage third-party Microsoft 365 backup for SMEs across the UK — typically using Veeam or comparable platforms — billed per user, per month, with restores included. If you have not validated what happens when one of your users deletes something important and asks for it back six months later, talk to us.

Content and creative

• Draft long-form blog posts from a one-line brief and a target keyword.
• Repurpose a blog post into a LinkedIn carousel, an email and a tweet thread in one pass.
• Generate first-pass image alt text and SEO meta descriptions across an entire content library.
• Translate marketing copy into multiple languages while preserving tone.
• Rewrite jargon-heavy product copy in plain English.

Research and insights

• Summarise long competitor whitepapers into 200-word briefings.
• Extract themes from a SharePoint library of customer research interviews.
• Cluster open-ended survey responses by sentiment and topic.
• Pull insights out of Excel analytics workbooks without writing formulas.
• Produce executive-ready summaries of long quarterly reports.

Campaign delivery and reporting

• Draft full campaign briefs from a single objective statement.
• Generate launch checklists tailored to channel and audience.
• Convert campaign performance data into a board-ready PowerPoint.
• Summarise email campaign performance against goals.
• Build a post-campaign retrospective from Teams meeting transcripts.
• Draft answers to common stakeholder questions about results.
• Update content calendars based on team capacity in Planner.
• Generate a weekly internal update for marketing leadership.
• Produce a polished case study from a Teams call with a customer.
• Draft press releases from a one-page product brief.

We work with marketing teams to roll Copilot out properly — with the right licences, prompt libraries and adoption support so the productivity gains stick. Get in touch to plan your rollout.

The morning: triage and prep

A marketing manager opens Outlook to a queue of 30+ overnight emails. Copilot summarises the lot in under a minute, flags the ones that genuinely need a response, and drafts replies to the routine ones. The time saved on inbox triage alone is usually 30 to 45 minutes a day.

Mid-morning: the campaign review meeting

A Teams call to review last week’s campaign performance. Copilot transcribes the meeting, summarises the decisions, and produces an action list assigned to each attendee. No one is taking minutes. The manager spends the meeting actually thinking about the work instead of typing.

Afternoon: drafting and approvals

A board update is due tomorrow. The manager points Copilot at the campaign performance workbook, the latest brand guidelines, and a previous board deck. Copilot produces a first-pass PowerPoint in the right house style. The manager spends the afternoon refining the strategic narrative rather than wrestling with PowerPoint.

Where Copilot does not help

It will not make a bad strategy good. It will not replace a creative director’s judgement on tone. It will not catch every factual error — the manager still has to review carefully. The teams getting the biggest wins are the ones who treat Copilot as a fast, tireless junior, not as a replacement for human judgement.

We help marketing teams deploy and adopt Microsoft 365 Copilot in a way that actually changes the working day — not just the licence bill. Get in touch to scope a pilot.

The everyday wins

• Draft personalised follow-up emails from a one-line prompt and the prospect’s recent email history.
• Summarise the last six months of communication with an account in 30 seconds before a renewal call.
• Convert a Teams discovery call into a structured opportunity summary, with stakeholders, pain points and next steps.
• Update bid documents and proposals using language pulled from previously won deals.
• Produce a board-ready pipeline review from Excel data without writing a single formula.

What changes for the rep

The teams getting the biggest wins are not necessarily closing more deals per rep — they are closing the same deals faster, with better-prepared conversations, and reps with more time for prospecting. The compounding effect across a year is significant: more time at the top of the funnel, faster cycle times, and a noticeable improvement in the quality of customer-facing output.

The pre-requisites no one talks about

Copilot only works as well as the data it can see. If your customer history is split across personal inboxes, shared mailboxes and SharePoint sites no one has tidied up in three years, Copilot will reflect that mess back at you. Before rolling Copilot out to a sales team, we usually spend a week tightening up email hygiene, mailbox sharing and SharePoint structure. It is unglamorous work that pays for itself the moment Copilot starts producing genuinely useful summaries.

We help UK sales teams plan, pilot and roll out Microsoft 365 Copilot in a way that produces measurable cycle-time gains. Get in touch to discuss a pilot.