It’s the Wi-Fi. It’s always the Wi-Fi.

Bad Wi-Fi isn’t just annoying — it costs you money. Slow EFTPOS terminals mean longer queues. Dropped connections mean staff waste time retrying. And if you’re running any kind of cloud-based system (which most businesses are now), unreliable Wi-Fi means unreliable business.

The good news: you don’t need to spend thousands to fix it. You just need to stop treating Wi-Fi like it’s magic.

Why Small Business Wi-Fi Is Usually Bad

Most small business Wi-Fi setups follow the same pattern:

1. ISP provides a modem/router combo
2. It gets plugged in wherever the phone/fibre line enters the building
3. Everyone connects to it
4. It works fine for 3 people and falls apart at 10

The ISP-provided router is designed to be “good enough for a house.” A shop, office, or warehouse is not a house. The walls are different, the area is bigger, the number of devices is higher, and the expectations are different.

The Basics: What You Actually Need

1. Separate your networks

At minimum, you need two Wi-Fi networks:

• Staff network — for your computers, POS systems, printers
• Guest network — for customers and visitors

Why? Because every device on your network is a potential problem. A customer’s phone with malware, a visitor’s laptop doing updates in the background — these shouldn’t be on the same network as your POS terminal.

Most decent routers support multiple SSIDs (network names). Set this up. It takes 10 minutes.

2. Put the router somewhere sensible

The ISP router usually ends up in the corner of the building where the phone/fibre line comes in. That’s often the worst possible location for Wi-Fi coverage.

Wi-Fi signals spread out in a sphere from the router. If the router’s in the corner, half the signal is going outside your building. Ideally, the router (or access point) should be centrally located, elevated, and not hidden in a metal cabinet.

If you can’t move the router, that’s what access points are for (more on that below).

3. Use 5 GHz for business devices

Most modern routers are dual-band — they broadcast on 2.4 GHz and 5 GHz.

• 2.4 GHz: longer range, slower speeds, more interference (everything from microwaves to Bluetooth uses this band)
• 5 GHz: shorter range, faster speeds, less interference

For your business devices — POS terminals, staff computers, printers — use 5 GHz. It’s faster and more reliable. Reserve 2.4 GHz for devices that are further away or don’t need the speed.

4. Get the right equipment

If you’ve got a small office (under 150 square metres, under 15 devices), a good consumer router might actually be fine. Look for:

• Wi-Fi 6 (802.11ax) — current standard, better with multiple devices
• Multiple SSIDs (for staff/guest separation)
• Gigabit Ethernet ports (for wired devices)

Brands like TP-Link (Deco series), ASUS (ZenWiFi), or Netgear (Orbi) have solid options in the $200-$400 range.

If you’ve got a larger space, multiple floors, or more than 20 devices, you need a proper access point setup. This is where it gets more serious:

• Ubiquiti UniFi — the go-to for small business. A UniFi access point ($150-$250 each) managed by free controller software. One AP covers about 100-150 square metres. Add more as needed.
• TP-Link Omada — similar concept to Ubiquiti, slightly cheaper, also good.
• MikroTik — powerful but steeper learning curve. Best if you’ve got some networking knowledge.

5. Wire what you can

Wi-Fi is convenient, but wired is always better for reliability. If a device doesn’t move — a desktop PC, a POS terminal, a printer — run an Ethernet cable to it. It’s faster, more reliable, and it takes load off the Wi-Fi for devices that actually need wireless.

Yes, running cables is a pain. But for fixed devices, it’s a one-time job that pays off forever.

How to Do a Basic Site Survey

Before spending money on equipment, understand what you’re working with:

1. Walk the space with your phone. Use a free Wi-Fi analyzer app (like WiFi Analyzer on Android or Airport Utility on iOS).
2. Check signal strength in every area where you need Wi-Fi. You want at least -65 dBm (the number is negative — closer to 0 is stronger). Below -75 dBm and you’ll have problems.
3. Note dead zones — areas where the signal drops off completely.
4. Check for interference — how many other Wi-Fi networks are visible? If you’re in a busy area (strip of shops, office building), the 2.4 GHz band is probably congested. That’s another reason to use 5 GHz.

This takes 15 minutes and tells you exactly what you’re dealing with.

Common Mistakes

• Too many devices on one router. ISP routers are not built for 30+ devices. If you’ve got a busy shop, they’ll struggle.
• Wi-Fi extenders. These are usually a bad idea. They cut your speed in half and create a separate network your devices have to switch between. A proper access point on a wired backhaul is always better.
• Ignoring the guest network. Customers on your business network is a security risk and a bandwidth hog.
• Never changing the default password. If your Wi-Fi still has the password from the sticker on the router, fix that today.
• Forgetting about uploads. Most internet plans are asymmetric — fast download, slow upload. If you’re doing video calls, cloud backups, or VoIP, upload speed matters. Check your plan.

The Bottom Line

Reliable Wi-Fi isn’t about spending the most money. It’s about understanding what you need, putting the right equipment in the right place, and separating your networks properly.

Start with the basics: separate staff and guest networks, use 5 GHz for business devices, wire what you can, and if the ISP router isn’t cutting it, invest in a proper access point. For most small businesses, $300-$500 in equipment solves 90% of Wi-Fi problems.

I’ve put together a site survey guide and router configuration walkthrough on Patreon — including a site survey template, recommended settings for common router brands, and a step-by-step guide for setting up separate staff and guest networks. Get it here.

Intune lets you manage every Windows computer in your business from a single web page. No server required. No on-site IT person required. Just a browser and a couple of hours to set it up.

I know what you’re thinking: “That sounds complicated.” It’s not. It’s just unfamiliar. Let me walk you through it.

What Intune Actually Does

Think of Intune as a remote control for your computers. From the Intune admin centre, you can:

• Enrol devices — connect them to your management system
• Push software — install applications automatically
• Enforce policies — require encryption, set password rules, control settings
• Manage updates — control when Windows Updates install (we covered this in a previous post)
• Remote wipe — if a laptop gets stolen, erase it remotely
• See compliance — at a glance, which machines are up to date and which aren’t

For a small business without a dedicated IT person, this is transformative. Instead of walking around to each machine to check settings, you do it all from your desk.

What You Need

• M365 Business Premium (includes Intune — ~NZ$36/user/month, excl. GST, annual billing)
• Windows 10/11 Pro on each device (Home edition doesn’t support Intune enrolment)
• An Intune Administrator or Global Administrator role in M365
• About 2 hours for initial setup

Step 1: Enable Intune

If you’re on Business Premium, Intune is already included. You just need to start using it.

1. Go to https://intune.microsoft.com
2. If it’s your first time, it’ll take a few minutes to provision
3. You’ll see the admin dashboard — this is your new best friend

Step 2: Set Up Automatic Enrolment

This is the magic bit. Once configured, any user who signs into a Windows device with their M365 account automatically enrols it in Intune. No manual setup per machine.

1. In Intune, go to Devices > Enrolment (then the Windows tab)
2. Click Automatic Enrolment
3. Set the scope to All (or a specific group if you want to test first)
4. Set the MDM user scope to All

That’s it. From now on, when someone joins a Windows PC to your Entra ID and signs in, it enrols automatically. Note: the device must be Entra ID joined — simply signing into an app with a work account registers the device but doesn’t fully enrol it for MDM.

Step 3: Create a Compliance Policy

A compliance policy defines what “healthy” looks like for your devices. If a device doesn’t meet the policy, it shows as non-compliant and you can restrict its access to company data.

1. Go to Devices > Compliance > Policies > + Create policy
2. Choose Windows 10 and later
3. Configure the basics:

4. Click Create

Now any device that doesn’t meet these requirements shows as non-compliant in your dashboard.

Step 4: Deploy Your First App

Let’s install something. 7-Zip is a good test — it’s free, small, and useful. It’s available in the Microsoft Store, so this is the easy path:

1. Go to Apps > All apps > Add
2. Select Microsoft Store app (new)
3. Search for “7-Zip”, select it
4. Assign to a group (start with a test group)
5. The app will install automatically on enrolled devices

For apps that aren’t in the Store, you’ll need the Win32 wrapping method:

1. Go to Apps > All apps > Add
2. Select Windows app (Win32)
3. Wrap the installer (.msi or .exe) into the .intunewin format using Microsoft’s Win32 Content Prep Tool, then upload it
4. Set the install command and uninstall command
5. Assign to a group

Yes, Win32 wrapping is the fiddliest part of Intune. Always check the Store first.

Step 5: Set Up a Configuration Profile

Configuration profiles let you control device settings. Here are the ones I’d set up first:

Wi-Fi profile: Push your office Wi-Fi settings so devices connect automatically.

1. Go to Devices > Configuration profiles > Create profile
2. Platform: Windows 10 and later
3. Profile type: Templates > Wi-Fi
4. Enter your SSID, security type, and password
5. Assign to your device group

BitLocker profile: Ensure all drives are encrypted.

1. Go to Endpoint security > Disk encryption > Create policy
2. Platform: Windows 10 and later, Profile: BitLocker
3. Enable BitLocker, set encryption method
4. Assign to your device group

Note: The older path Templates > Endpoint protection still works, but Microsoft now steers toward Endpoint security > Disk encryption.

What This Looks Like Day-to-Day

Once set up, your workflow is:

1. New employee starts — they get a Windows PC, sign in with their M365 account, and Intune automatically enrolls it, installs your apps, and applies your policies. Done.
2. Someone loses a laptop — you go to Intune, find the device, and click Wipe. You’ll be prompted for a 6-digit Recovery PIN. The laptop is erased the next time it connects to the internet.
3. A compliance issue pops up — you see it in the dashboard, and you know exactly which machine and what’s wrong.
4. You need to deploy new software — add it in Intune, assign it, and it installs automatically.

No driving to the office after hours. No walking around to each machine. No “I’ll do it Monday.”

The Honest Limitations

Intune isn’t perfect. A few things to know:

• It needs internet connectivity. Devices check in with Intune periodically — they don’t need to be online 24/7, but they do need to connect now and then to receive policies and report status.
• Mac and iOS management is possible but the experience isn’t as polished as Windows.
• The reporting is basic. It tells you if something’s compliant, but it won’t give you deep diagnostics.
• There’s a learning curve. The first few hours are confusing. It gets easier.
• Windows Home edition doesn’t work. You need Pro. If you’ve got Home edition machines, that’s a problem.

The Bottom Line

If you’re paying for M365 Business Premium and not using Intune, you’re wasting money. It’s not enterprise-only software — it’s designed for exactly your situation: a small business that needs to manage devices without a dedicated IT team.

Set it up once, and it pays for itself in time saved every single week.

I’ve put together a complete Intune enrollment walkthrough on Patreon — with screenshots for every step, recommended compliance policies for small business, and a device enrollment checklist you can follow for each new machine. Get it here.

When I ask, I usually get: “It runs our accounting software” or “That’s where our files are.” Sometimes it’s: “Honestly, I’m not sure what it does. Bob set it up before he left.”

Let’s fix that. If you’re paying for a server you don’t need, that’s money wasted. And if you’re not using a server when you should be, that’s a risk. Here’s how to tell the difference.

What a Server Actually Does

First, let’s clear something up. A server is just a computer that provides a service to other computers on the network. That’s it. It doesn’t have to be a $5,000 rack-mounted Dell. It could be a mini PC running Linux. The concept is what matters.

Servers typically handle:

• File storage and sharing — everyone’s documents in one place, with permissions
• Centralised backups — all machines back up to one location
• Running shared applications — accounting software, databases, line-of-business apps
• User management — Active Directory for login credentials and policies
• Email — if you run your own mail server (rare for small business)
• Print sharing — managing printers across the network

When the Cloud Replaces the Server

For a lot of small businesses, the cloud already does most of this. Here’s the mapping:

If your business runs on M365 and Xero, and your files are in OneDrive, you might not need a server at all. Seriously.

When You Still Need a Server

There are legitimate reasons to keep a server on-premises:

1. Line-of-business software that requires it. Some older (or niche) applications need to run on a local server. If your industry-specific software requires a Windows Server backend, that’s not something you can just cloud away.

2. Internet reliability. If your business is in an area with unreliable internet, relying entirely on the cloud is a gamble. A local server keeps things running when the connection drops.

3. Large file workloads. If you’re working with large files — video editing, CAD, large databases — transferring everything to the cloud and back is slow and expensive. Local storage is faster and doesn’t eat your bandwidth.

4. Data sovereignty or compliance. Some industries have requirements about where data physically lives. If you can’t put data in the cloud due to regulatory requirements, on-premises is your only option.

5. Latency-sensitive applications. If an application needs ultra-low latency to a database or file server, a local machine will always beat a cloud connection.

The Hidden Cost of “Free” Servers

That old server under the desk isn’t free. Here’s what it’s actually costing you:

• Power: A server running 24/7 draws 100-400W depending on load. At NZ electricity rates, that’s roughly $500-$1,600/year.
• Hardware replacement: Servers last 5-7 years. When they die, a replacement is $2,000-$5,000.
• Maintenance: Updates, patches, troubleshooting. If you don’t have in-house IT, that’s an MSP callout every time something goes wrong.
• Backup: You need to back up the server itself. That’s another cost.
• Security: An unpatched server on your network is a liability. It needs monitoring, firewall rules, and regular updates.
• Noise and space: It’s under someone’s desk. It’s hot. It’s loud. That’s not nothing.

Add it up and a “free” server is costing you $1,000-$3,000 per year, minimum.

The Cloud Isn’t Free Either

On the flip side, cloud services have ongoing costs:

• M365 Business Premium: ~NZ$36/user/month (excl. GST, annual billing)
• Cloud backup: ~$5-$10/device/month
• Cloud accounting (Xero): ~NZ$35-$125/month (excl. GST)
• Cloud storage beyond included tiers: varies

For a 10-person business, you’re looking at roughly NZ$450-$600/month in cloud subscriptions. That’s NZ$5,400-$7,200/year.

Neither option is free. The question is which set of costs and tradeoffs makes sense for your business.

The Decision Framework

Ask yourself these questions:

1. What does our server actually do? If you can’t answer this, that’s your first problem.
2. Can each of those functions move to the cloud? List them out. Check.
3. What’s the total cost of the server (power + hardware amortised + maintenance + backup)?
4. What’s the total cost of the cloud alternative (subscriptions for each service)?
5. Do we have compliance or connectivity constraints that prevent cloud migration?
6. What happens if the internet goes down? Can the business function for a day without cloud access?

If the cloud alternative is cheaper, your internet is reliable, and nothing requires on-premises — decommission the server. Redirect that money and attention elsewhere.

If you’ve got a genuine need for a local server, keep it. But maintain it properly. A neglected server is worse than no server at all.

The Bottom Line

The default assumption in 2026 should be cloud-first for small business. If you can do it in the cloud, do it in the cloud. Only run a server on-premises if you have a specific, identified need that the cloud can’t meet.

And if you do run a server, know what it does, keep it updated, and budget for its replacement before it dies at the worst possible time.

I’ve put together a full Server vs Cloud decision guide on Patreon — including a cost comparison template you can fill in with your actual numbers, a migration checklist for moving services to the cloud, and a “decommissioning plan” for when you’re ready to turn that dusty tower off for good. Get it here.

“Update and restart now.”

So you click “Remind me tonight.” Tonight comes. You click “Remind me in 4 hours.” You keep clicking it until it forces the restart at the worst possible time, and now you’re annoyed at Microsoft.

I get it. I really do. But here’s the thing — that prompt is trying to save your business.

What Updates Actually Do

There’s a misconception that Windows Updates are just Microsoft adding features you don’t want and changing things that work fine. Sometimes that’s true — the occasional feature update does change the look and feel, and it’s annoying.

But the critical updates? The ones that interrupt your work? Those are usually security patches (delivered as part of monthly cumulative updates).

Here’s what that means in practice:

Microsoft’s security team (and independent researchers) find vulnerabilities in Windows. These are flaws that a criminal could use to get into your computer. Some vulnerabilities require no interaction at all — in some cases, just being on the same network with an unpatched machine is enough. Others rely on phishing or user action.

Microsoft releases a patch to fix the vulnerability. That patch gets delivered via Windows Update.

If you install the patch, you’re protected. If you don’t, the door stays open. And criminals know exactly which doors are still open — the patches are public. When Microsoft releases a fix, attackers can reverse-engineer the patch to figure out exactly what to exploit on machines that haven’t updated yet.

Not updating is like locking your front door but leaving the key in it.

The WannaCry Problem

In 2017, a vulnerability called EternalBlue was used to spread the WannaCry ransomware. It infected over 230,000 computers across 150 countries in a few days. Hospitals, businesses, government agencies — all hit.

Microsoft had released a patch for the vulnerability nearly two months before the attack.

Most of the businesses that got hit weren’t running ancient unsupported Windows. Mostly Windows 7 and Server 2008 R2 systems — the same versions many businesses were still running. They just hadn’t installed the update.

WannaCry didn’t care that you were busy. It didn’t care that the update prompt was annoying. It just encrypted everything and demanded $300 in Bitcoin.

The majority of successful ransomware attacks exploit known vulnerabilities with available patches. The gangs aren’t using fancy zero-days — they’re exploiting the updates people didn’t install.

“But Updates Break Things!”

This is the counter-argument, and it’s not wrong. Sometimes updates do break things. A driver stops working. An app compatibility issue pops up. Something that worked yesterday doesn’t work today.

This was more of a problem in the Windows 7/8 era. It still happens occasionally, but Microsoft has gotten significantly better at testing updates before broad release. The “update broke my computer” scenario is far less common than it used to be.

Here’s how to manage the risk without leaving yourself exposed:

Don’t install updates on day one. But don’t wait three months either.

Let the early adopters find the problems. Wait a week or so after “Patch Tuesday” (the second Tuesday of each month — that’s when Microsoft drops their big security updates). Then install.

You can configure this in Windows through Windows Update for Business or Intune (if you’re on M365 Business Premium). Set a deferral period — give feature updates a longer deferral (30-60 days), but keep security updates shorter (7-14 days).

How to Set Up a Basic Update Policy

If you’re running Windows 10/11 Pro (most business machines do), you can configure this without any extra tools:

1. Open Settings > Windows Update > Advanced options
2. Enable Receive updates for other Microsoft products (keeps Office updated too)
3. If available on your version of Windows, under Choose when updates are installed, set:
   • Feature updates: defer by 30 days
   • Quality updates: defer by 7 days

That’s the “set and forget” level. You’ll get security updates within a week of release (early adopters have found any problems by then) and feature updates within a month (plenty of time for news about any issues).

If you’ve got M365 Business Premium and Intune, you can do this centrally for all machines — more on that below.

If You’ve Got Intune (M365 Business Premium)

This is where it gets easier. When we covered M365 licensing, I mentioned that Business Premium includes Intune. One of the best things about Intune is centrally managing Windows updates across all your devices.

You create update rings — groups of settings that control when and how updates install. You can set up:

• A pilot ring: 5-10 machines get updates first. If something breaks, you catch it before it hits everyone.
• Everyone else: Gets updates 7-14 days after the pilot group.

The pilot ring should include non-critical machines and tech-comfortable staff who’ll actually report problems. Don’t put your most important server in the pilot group.

I’ve put together a complete walkthrough on Patreon for setting up Intune update rings — including recommended settings for small business, screenshots, and what to do if an update causes problems.

Other Things Updates Cover

It’s not just security. Updates also include:

• Bug fixes: That weird crash in Excel that happens every Tuesday? Might get fixed in a cumulative update.
• Driver updates: New hardware support and better performance on existing hardware (though these can occasionally cause issues, so some businesses manage them separately).
• .NET Framework updates: A lot of business software depends on this. Missing or mismatched .NET versions are a common cause of app issues.

The Bottom Line

I know updates are annoying. I know they always seem to fire at the worst time. But the alternative — running unpatched Windows in a business environment — is genuinely dangerous.

Configure a deferral so you’re not on day one. Test on a couple of machines first if you’re in a managed environment. But actually install them. Every month. Without fail.

The ransomware gangs are counting on you putting it off. Don’t make it easy for them.

For M365 Business Premium users, I’ve put together a step-by-step Intune update ring guide on Patreon — with recommended settings, pilot group setup, and rollback procedures if an update causes issues. Check it out here.

But some of the things I see small businesses do make my eye twitch. And I say that with love.

So here it is. These are the most common (and fixable) mistakes I see. If any of these apply to you — and if you’ve got any IT support at all, whether it’s an internal person or an external provider — please. For the love of all that is good. Stop.

1. Using “password123” (Or Your Business Name, Or Your Dog’s Name…)

I wish I was joking. I have seen all of these. Used by real businesses, with real data.

Here’s the thing: password policies exist for a reason. Every time there’s a data breach — and there’s one basically every week somewhere in the world — millions of username and password combinations get leaked onto the internet. And attackers use these to automatically try those same credentials across other systems.

If your password is Plumbing2024 and your email address is john@plumbing.co.nz, I can guarantee that combination is in a list somewhere. It takes a bot about 0.3 seconds to try it.

What to do instead: Use a password manager. Bitwarden is free, works on every device, and generates strong passwords so you don’t have to think of them. You remember one master password, and it handles the rest.

Yes, it takes 20 minutes to set up. No, it’s not complicated. Yes, it will save you a world of pain.

2. Clicking Links in Emails from “Microsoft” Warning You About a Security Threat

Oh, this one kills me.

You get an email that says something like:

“Your Microsoft 365 account has been compromised. Click here to verify your identity immediately.”

The email looks legit. The branding is right. The logo is there. There’s even a link to “Microsoft” in the text.

It’s not from Microsoft. It’s from Steve in his mum’s basement trying to harvest your credentials.

What to actually do: If you get an email from Microsoft (or your bank, or anyone) asking you to click a link and log in, don’t click the link. Open your browser. Type in the URL yourself (office.com, your bank’s actual URL, whatever). Log in there and check for any actual notifications.

99% of the time, there’s nothing. The email was bait. You didn’t bite. Well done.

How to spot a phishing email:

• Creates urgency (“Act now!” “Your account will be closed!”)
• The sender address is slightly off (support@micros0ft-security.com vs support@microsoft.com)
• You hover over the link and the URL doesn’t match the company
• You weren’t expecting it

When in doubt, bin it. Or ask someone who knows. That’s literally what we’re here for.

3. Installing Random Software From the Internet

“Do you have a PDF?” “Just download any free PDF reader from Google.” Downloads some god-awful toolbar-laden garbage from a sketchy website

Yes, you need a PDF reader. But you get one from Adobe. Or use Edge, which is already installed and handles PDFs just fine. You don’t need to Google “free PDF reader” and click the first sponsored result.

Random software installs are one of the biggest sources of:

• Adware (pop-ups everywhere)
• Spyware (keyloggers, data theft)
• Ransomware (everything’s encrypted, pay up or lose it)
• Bloatware (slows your computer down)

The rule: if you don’t know exactly what it is and where it came from, don’t install it. Period.

If you need help figuring out whether something is safe, ask. That’s not a dumb question. Clicking “next” on an installer without reading it is the dumb thing.

4. Using the Shared Computer as a Junk Drawer

You know the setup. There’s one computer in the office. Everyone uses it. The desktop has 47 shortcuts, half for things you installed once in 2019 and never used again. The browser has 6 toolbars. There’s a folder called “New Folder (3)” sitting on the desktop with who-knows-what in it.

This isn’t just messy. It’s a genuine problem:

• Outdated software doesn’t get security updates
• Random old installs can conflict with things you need now
• Finding anything takes forever
• The computer runs like molasses because it’s doing background tasks for 11 programs nobody uses

What to do: Give everyone their own account on the computer (even basic Windows accounts). Clean up the desktop. Uninstall everything you don’t use. Keep the desktop to a few folders max.

If the computer is genuinely slow, it might just need a cleanup. And by “cleanup” I mean: someone goes through it properly, removes the junk, and makes sure what’s left is current and actually used.

Or buy separate devices. One shared junk-drawer computer for five people ends up costing more in lost productivity than just giving everyone their own cheap laptop.

5. Telling Us It’s “Urgent” When It Isn’t

I know — to you, if you can’t print your invoices right now, it IS urgent. You’ve got work to do and the printer isn’t playing ball.

But I need you to understand: when five people all say their issue is “urgent,” nothing is urgent. That’s just called a Tuesday.

Meanwhile, the person who quietly sends a calm message like “Hey, whenever you get a chance, I’m having trouble with X” — that person is my favourite human. I’ll help them first every single time, because they’re reasonable and I’m only human.

Here’s how IT prioritises (and this is how IT teams prioritise issues):

Actually urgent:

• Nobody can access email/Internet/your main business application
• You think you might have been hacked or have ransomware
• Something is actively losing you money right now

Important but not urgent:

• Printer is doing that thing again
• Computer is a bit slow
• You need help installing something
• Software is “acting weird”

Not urgent (but you’ll ask anyway):

• Can you make the text bigger?
• Can you help me with my home laptop?
• What’s the Wi-Fi password again?

Be honest about the urgency and you’ll get better, faster service. I promise.

Bonus Round: The Stuff You Probably Don’t Even Know You’re Doing

Since we’re here, a few extras:

• Plugging in random USB sticks. Found a USB drive? Don’t just plug it in to see what’s on it. It could be loaded with malware. Ask first.

• Sharing passwords via email or text. If you need to share login details, use a password manager’s sharing feature, or just tell the person verbally. Don’t write passwords in an email. Emails get forwarded, hacked, and sit in inboxes forever.

• Never restarting your computer. Some of you have been running the same session for weeks. Just restart it. Seriously. Once a week. It installs updates, clears out the cobwebs, and fixes weird glitches.

The Common Thread

Every single point on this list comes down to one thing: a tiny bit of care goes a long way.

You don’t need to become an IT expert. You just need to slow down a little, think before you click, and ask when you’re not sure.

And if you’re not sure? That’s fine. That’s what we’re here for. I’d rather answer a “silly” question than recover your data after you click something you shouldn’t have.

Want a printable staff IT policy checklist you can stick on the office wall? I’ve put together a one-page PDF on Patreon covering password rules, email safety, and software install policies. Grab it here.

The email came from the boss’s actual email address. It looked real. The language was right. The urgency was convincing.

They paid $18,000 before anyone noticed.

This isn’t unusual. It’s happening every day, all over the world, to businesses just like yours. And it’s not because the criminals are genius hackers. It’s usually because the basics weren’t in place.

How Business Email Actually Gets Compromised

Forget the Hollywood image of a hooded figure typing furiously. Here’s what actually happens, in order of how common it is:

1. Stolen Passwords (The Big One)

Your password leaks in a data breach. It ends up on a list that gets sold on the dark web. Criminals use automated tools to try that same password on email, banking, accounting software — everything.

This is called credential stuffing, and it works because people reuse passwords. If your email password is the same one you used on that random forum in 2019 that got breached, your business email is one automated script away from being owned.

2. Phishing

Someone sends you an email that looks like it’s from Microsoft, your bank, or a supplier. There’s a link. You click it. You land on a fake login page that looks identical to the real one. You type in your username and password. You’ve just handed your credentials to a criminal.

Modern phishing is good. Really good. The fake pages are pixel-perfect. The sender addresses are close enough to fool you when you’re busy. The urgency (“Your account will be locked in 24 hours!”) pushes you to act before thinking.

3. No Multi-Factor Authentication

Even if they get your password, MFA stops them cold. But if you don’t have it enabled, a password is all they need. Full stop.

4. Session Hijacking

You log into email on a public Wi-Fi at a café. Someone on the same network could intercept your session token. They don’t need your password — they’re already “you” as far as the server is concerned.

Less common for small businesses, but it happens. Especially if you’re checking email at the airport, a hotel, or a coworking space.

What It Looks Like When You’re Compromised

You might not know right away. Sophisticated attackers don’t change your password (that would tip you off). They just quietly:

• Read your emails to learn how your business works, who your suppliers are, how you talk to your bookkeeper
• Set up email forwarding rules to send copies of certain emails to their own address (you won’t see this unless you check your settings)
• Send emails from your account to your contacts, your bank, your staff — whatever serves their purpose
• Access connected services — if your email is the recovery address for your bank, your accounting software, your domain registrar, they can reset passwords on all of them

The business I mentioned earlier? The attacker watched their inbox for almost a week before making a move. They learned the business’s patterns, who handled payments, what the boss’s writing style looked like. Then they struck.

How to Lock It Down

Here’s your action list. Do these in order.

Step 1: Unique Passwords Everywhere

Every account gets its own password. No exceptions. Use a password manager — Bitwarden (free) or 1Password (paid, excellent). Let it generate random passwords. You don’t need to remember them.

This single step eliminates credential stuffing entirely.

Step 2: Multi-Factor Authentication — Everywhere

I covered this in the security audit post, but it bears repeating: MFA is the single most effective security measure you can take.

Enable it on:

• Email (M365, Gmail, whatever you use)
• Online banking
• Accounting software
• Domain registrar (this one gets overlooked — if someone takes over your domain, they can intercept all your email)
• Cloud storage
• Social media

Use an authenticator app (Microsoft Authenticator, Google Authenticator, Authy) rather than SMS if possible. SMS is better than nothing, but it can be intercepted through SIM swapping.

Step 3: Check for Compromise Right Now

A few things to check today:

• Recent login activity. In M365, go to your account security page and check recent sign-ins. Look for locations or devices you don’t recognise. In Gmail, scroll to the bottom of your inbox and click “Details” under “Last account activity.”
• Email forwarding rules. Check if any rules are forwarding emails to an address you don’t recognise. In Outlook: Settings > Mail > Forwarding. In Gmail: Settings > Forwarding and POP/IMAP.
• Recovery email and phone number. Make sure your account recovery options actually point to your current email and phone number. Attackers often change these so they can regain access even after you change the password.

Step 4: Train Your Staff

This is the hard one. You can have the best technical controls in the world, but if your office manager clicks a phishing link and enters their credentials, the controls don’t matter.

You don’t need a corporate training program. You need a 10-minute conversation:

• Don’t click links in emails that ask you to log in. If Microsoft says your account is expiring, open a browser and go to microsoft.com directly. Don’t click the link.
• Verify payment requests. Any email asking for a bank transfer, especially if it’s “urgent” or “confidential” — verify by phone. Use a number you already have, not one in the email.
• Report weird stuff. If something feels off, tell someone. Don’t feel embarrassed. The businesses that recover fastest are the ones where staff speak up quickly.

Step 5: Have a Response Plan

If the worst happens, what do you do?

• Change passwords immediately — email first, then everything else
• Check forwarding rules and recovery options
• Notify your bank if there’s any chance financial accounts were accessed
• Notify your contacts — if the attacker sent emails from your address, let people know
• Check other accounts — if your email was compromised, assume any account that uses it as a recovery address is also at risk

Write this down. Don’t figure it out in the moment.

The Bottom Line

Email security isn’t complicated. It’s just unglamorous. Unique passwords, MFA, basic staff awareness, and knowing what to do if something goes wrong. That’s it.

The businesses that get hit aren’t the ones with bad luck. They’re the ones that never turned on MFA, never checked who had access, and never talked to their staff about phishing.

Don’t be that business.

I’ve put together a complete MFA rollout guide and staff awareness kit on Patreon — including step-by-step MFA setup for M365, a one-page staff handout on phishing, and an incident response checklist you can fill in with your own details. Get it here.

When was the last time you checked who still has access to your business email?

Do you know if your ex-employee’s laptop still has your files on it?

Could someone walk into your office right now and plug a laptop into your network?

If you hesitated on any of those, this post is for you.

Why Security Audits Get Ignored

Let’s be honest — nobody wakes up excited to do a security audit. It’s not fun. It doesn’t directly make money. And for a small business owner already wearing every hat, it’s the thing that gets pushed to next month every single month.

The problem is that “never” is how breaches happen. Not dramatic Hollywood hacking. Just someone reusing a password they leaked in a data breach three years ago, clicking a link in a voicemail redirecting as an email, or walking away from a computer that doesn’t lock.

Small businesses are the perfect target. You’ve got valuable data — customer details, bank access, supplier accounts — but you probably don’t have the security guardrails that a larger company has. Hackers know this.

The Audit — What to Check Right Now

Do all of these. Today, not tomorrow.

1. Who Has Access to What?

This is the big one.

• List every system your business uses. Email, accounting software, bank accounts, social media, file storage, your website, Point of Sale system — everything.
• For each system, list who has a login. Not just current employees. Former employees too.
• Remove anyone who shouldn’t have access. If “Jake from three years ago” still has admin access to your accounting software, that’s a problem.

Don’t forget:

• Shared Wi-Fi passwords (especially in hospitality/retail)
• Master accounts (the generic “admin” or “office” login everyone uses)
• Third-party access (your accountant, your web developer, your MSP)

If you don’t have a list, that’s problem one. Make the list. Fix it as you go.

2. Passwords — Get Serious

I know. Everyone hates this topic. But it’s still the number one way businesses get compromised.

• Are you reusing passwords? If your QuickBooks password is the same as your email password, and your email gets breached, the attacker now owns your finances.
• Are you sharing passwords? Shared Gmail inboxes, shared logins to the bank — these are common in small business. They’re also a nightmare when something goes wrong and you can’t tell who did what.
• Get a password manager. Bitwarden is free for a single user and has a cheap team plan. 1Password is another option. Either is better than the spreadsheet on Karen’s desktop called “logins.xlsx”.
• Prefer authenticator apps over SMS codes for MFA – SMS can be intercepted via SIM swapping. An authenticator app (like Microsoft Authenticator or Google Authenticator) is stronger protection.

The goal: every person has their own login. Every system has a unique password. Nobody’s writing passwords on a Post-it note stuck to their monitor. (You know who you are.)

3. Multi-Factor Authentication — Turn It On

If you only do one thing from this entire post, make it this.

Turn on multi-factor authentication (MFA) on:

• Email (M365, Gmail — whichever you use)
• Online banking
• Accounting software
• Cloud storage (OneDrive, Google Drive, Dropbox)
• Social media accounts
• Anything with customer data

MFA means even if someone gets your password, they still can’t log in without approving it on your phone. It blocks the vast majority of automated attacks.

Microsoft 365 makes this relatively straightforward — we covered MFA setup in a previous post. email me if you need help.

4. Backups — Test Them

We covered backups in a previous post, so I won’t rehash the whole thing. But the audit question is simple: When did you last test a restore?

If the answer is “never” or “I don’t remember,” your backups might not actually work. Backups that you haven’t tested are just hope with extra steps.

Pick a file from three months ago. Restore it. Confirm it works. Do the same thing next month. Build it into your routine.

Make sure at least one backup is offline or protected from deletion – ransomware that gets into your network can also wipe cloud backups.

5. Devices — What’s Connected?

Walk around your office. Count every device that connects to your network — computers, printers, phones, tablets, that random Raspberry Pi someone installed for a project two years ago.

Ask yourself:

• Are they all running current software? (Windows Updates, macOS updates, firmware on the router)
• Do they all have passwords/PINs?
• Do they lock automatically after a few minutes of inactivity?
• Are they encrypted? (BitLocker on Windows, FileVault on Mac)
• Is security software active on all devices? (Microsoft Defender is free and built into Windows)

That old Windows 10 machine in the back office that “still works fine”? It’s a liability. If it’s running an unsupported operating system, it has known vulnerabilities that will never be patched. Replace it or isolate it from the network.

6. Physical Security — The Forgotten Layer

You can have the best passwords in the world, but if someone can walk into your server room, none of it matters.

• Is your server cupboard locked?
• Do you have a guest Wi-Fi network separate from your business machines?
• What happens when a stranger walks in and says “I’m here to fix the printer”? (Social engineering is real — verify, don’t just trust)

This sounds paranoid until the day it isn’t.

How to Make It a Habit

Don’t try to fix everything in one day. Prioritise:

1. This week: Access audit and MFA everywhere. These are the highest-impact fixes.
2. This month: Passwords sorted, backups tested, device inventory done.
3. Ongoing: Quarterly review. Every three months, run through the checklist again. New employees, new devices, new software — things change.

The goal isn’t perfection. It’s raising the bar high enough that automated attacks move on to an easier target.

The Bottom Line

You don’t need a $50,000 security consultant or enterprise-grade tools. You need to spend a few hours going through a checklist and fixing the obvious stuff. Most small business breaches come from the same handful of basic failures — old passwords, no MFA, ex-employees who still have access, unpatched machines.

Fix the basics. You’ll be ahead of 80% of small businesses overnight.

Want a printable security audit checklist you can work through with timestamps and sign-off fields? I’ve put together a full template on Patreon — covering every point above with checkboxes, priority ratings, and quarterly review trackers. Grab it here.

That’s wasteful. And expensive.

The fix is virtualization — running multiple “virtual machines” on one physical server. Instead of buying three servers for three jobs, you buy one decent box and run three virtual servers on it. Less hardware, less power, less cooling, less stuff to break.

But when you start looking into it, you hit a wall: VMware or Hyper-V? Everyone has an opinion. Most of the internet swears by VMware (or they did before Broadcom bought VMware, now everyone is looking to jump ship). Hyper-V doesn’t get as much attention, but it’s widely used and perfectly capable. And nobody explains it in a way that actually helps a small business owner decide.

So let’s fix that.

What Is Virtualization, Quick Version?

A virtual machine (VM) is a computer that runs inside another computer. It thinks it’s real — it’s got its own operating system, its own memory, its own network connection — but it’s actually sharing the physical hardware with other VMs.

The software that makes this happen is called a hypervisor. VMware and Hyper-V are both hypervisors. They’re the layer between your physical hardware and the virtual machines running on top.

Why bother? Three reasons:

1. Consolidation. One physical server doing the work of three or four.
2. Isolation. If one VM crashes, the others keep running. Your file server doesn’t take down your accounting app.
3. Recovery. You can back up an entire VM — operating system, apps, data, all of it — as a single unit. When something goes wrong, you restore the whole thing in minutes instead of reinstalling from scratch.

VMware vSphere (ESXi)

VMware is the big name in virtualization. They’ve been doing it the longest, and their product — vSphere ESXi — is what most enterprises run.

The good:

• Mature and rock-solid. This thing has been battle-tested in data centres for nearly two decades. It just works.
• Excellent performance. VMware’s hypervisor is lean and efficient. You get more out of your hardware.
• vSphere Client. The web interface is clean and intuitive. Managing VMs, checking performance, setting up networks — it all makes sense.
• Snapshots. Take a point-in-time snapshot of a VM before you make changes. If it goes sideways, roll back. Invaluable.
• Huge ecosystem. Every backup tool, monitoring system, and management platform supports VMware. It’s the default.

The not-so-good:

• It’s expensive. VMware vSphere licensing isn’t cheap, and since Broadcom acquired VMware, pricing has gotten worse. The free version (ESXi Free) exists but is severely limited — no vMotion, no central management, no backup API access. You basically can’t use it properly in production.
• Broadcom uncertainty. Since the Broadcom acquisition, VMware has been killing off free tiers, raising prices, and generally making people nervous. A lot of businesses are actively looking for alternatives right now.
• Overkill for small setups. If you’re running two or three VMs, you probably don’t need enterprise-grade virtualization.

Microsoft Hyper-V

Hyper-V is Microsoft’s hypervisor. It’s built into Windows Server and Windows 10/11 Pro/Enterprise etc… Windows 10/11 Home edition doesn’t include Hyper-V.

The good:

• It’s included with Windows Server. If you’re already running Windows Server (and most small businesses are), Hyper-V comes with it. No extra licensing cost.
• Windows integration. If your business runs Windows — and it does — Hyper-V fits right in. Same management tools, same Active Directory, same update cycle.
• Hyper-V Manager is decent. It’s not as polished as VMware’s interface, but it works. For a small number of VMs, it’s perfectly fine.
• No vendor lock-in anxiety. Microsoft isn’t going to buy themselves and triple the price. Hyper-V isn’t going anywhere.

The not-so-good:

• Linux VM support is ok, but VMware and Proxmox still tend to offer a smoother experience.
• The interface feels dated. Hyper-V Manager looks like it was designed in 2010 and never updated. It works, but it’s not pretty.
• Snapshots are called “checkpoints.” They work fine, but they’re easy to misuse — especially if you leave them in place for too long. Like VMware snapshots, they’re not backups
• Less third-party support. Some backup tools and management platforms support Hyper-V, but the ecosystem isn’t as deep as VMware’s.

What About Open Source? Proxmox and XCP-ng

I’d be doing you a disservice if I didn’t mention the open-source options. If you’re reading this blog, there’s a decent chance you’re the kind of person who’d rather run free software than pay for a licence — I know I am.

Proxmox VE is the one to watch. It’s a full virtualisation platform built on Debian Linux, with a proper web interface, built-in firewall, software-defined storage, and support for both VMs and containers. The base platform is completely free and open source (AGPLv3). They offer a paid subscription for enterprise support and access to a more stable package repository, but the free community repo works fine. Proxmox has been around since 2008 and it’s mature, well-documented, and genuinely good.

The kicker: Proxmox includes backup built in. No separate Veeam licence, no API restrictions. You get scheduled backups, replication, and even built-in clustering — features that cost thousands on VMware. For a small business running a handful of VMs, it’s hard to argue against.

XCP-ng is an open-source fork of Citrix Hypervisor (formerly XenServer), typically paired with Xen Orchestra for management, which is open source with optional paid support. XCP-ng is solid and performant — Xen has powered large-scale cloud infrastructure (AWS relied on it for many years). With XCP-ng, management is typically done via the Xen Orchestra web UI, which is feature-rich, though generally considered less polished and tightly integrated than Proxmox’s interface.

The honest comparison: Proxmox is the better choice for most small businesses. The web interface is excellent, the community is active, the documentation is good, and the backup story is simpler. XCP-ng is technically solid but can take a bit more effort to set up and manage, especially compared to Proxmox’s all-in-one experience.

The catch with open source: You’re your own support. There’s no 1-800 number. If something breaks at 2am, you’re on the forums and the documentation. If you’ve got Linux chops (or want to learn), that’s fine. If you need hand-holding, Hyper-V with its Windows familiarity might be the safer bet.

I’ll cover Proxmox installation in detail on Patreon, with full setup, VM creation, and backup configuration walkthroughs. This one’s worth getting right.

Head to Head

My Honest Take for Small Business

If you’re a small business running a handful of Windows-based VMs — file server, maybe a line-of-business app, maybe a domain controller — Hyper-V is the pragmatic choice.

It’s free (or already included), it’s from a vendor you’re already paying, and it does the job well enough. You’re not running a data centre. You don’t need vMotion and distributed switches and all the enterprise bells and whistles. You need something that runs your VMs reliably and doesn’t cost extra.

But — if you’re comfortable with Linux, or willing to learn, Proxmox is the one I’d actually recommend. It’s free, it’s open source, the web interface is excellent, and the built-in backup alone saves you from needing Veeam. For a FOSS-minded small business, it’s the sweet spot between capability and complexity. XCP-ng is solid too, but Proxmox has the edge in usability and community.

Save the VMware budget for when you’ve got ten VMs, a mix of Windows and Linux, and someone managing it full time. That’s when it earns its keep.

The Real Question Isn’t VMware vs Hyper-V

It’s whether you should be virtualising at all.

If you’ve got a single physical server doing one thing, you’re wasting money. Hardware is cheap compared to the downtime when that one server dies and you’re reinstalling everything from scratch.

Virtualise it. Pick Hyper-V if you want the familiar Windows path, or Proxmox if you’re ready to go open source. Get your VMs running. Set up proper backups — and I mean proper, not “copy the VHD file while it’s running.” Use something that’s VM-aware.

That’s where the real payoff is. Not in which hypervisor you pick, but in actually doing it.

I’ve put together a complete installation and backup guide on Patreon — covering both VMware ESXi and Proxmox VE, with step-by-step VM creation and backup configuration for each. Grab the guide here.

Fair enough. But here’s the thing — if you use Microsoft 365, you’re already using Entra. Whether you know it or not. It’s the system that controls who can log in to your email, your files, your Teams — everything.

So let’s demystify it.

What Is Microsoft Entra, Actually?

Microsoft Entra ID (formerly Azure Active Directory, or Azure AD — Microsoft loves renaming things) is Microsoft’s identity and access management service.

In plain English: it’s the system that decides who gets in and what they can see once they’re in.

Every time you log in to Outlook, OneDrive, Teams, or any Microsoft 365 service, Entra is the bouncer at the door. It checks your username, verifies your password, maybe asks for your MFA code, and then lets you through.

That’s it. That’s the core job. It’s the lock on the front door.

Why the Name Changes?

Quick sidebar because I know someone is wondering — yes, this used to be called Azure Active Directory, and yes, Microsoft renamed it to Entra ID, and yes, it’s confusing.

Here’s the deal: “Azure Active Directory” was a terrible name. While it shared some high-level concepts with the traditional Active Directory you might know from on-premises Windows servers — users, groups, authentication — it was a completely different architecture underneath. The name made people assume it was just Active Directory in the cloud. It wasn’t. That caused endless confusion. So Microsoft split the identity product line into “Entra” and now it’s called Microsoft Entra ID.

Same product. Shiny new name. If you see Azure AD in older documentation, it’s the same thing. Old habits die hard — you’ll still see Azure AD everywhere in older docs, scripts, and PowerShell modules. Just know it’s the same thing with a new label.

What Does It Actually Do?

Let’s get specific about what Entra handles day to day in a small business:

1. User accounts and passwords. Every person in your business who has a Microsoft 365 account — that account lives in Entra. Their username, password, display name, job title, all of it. You manage users through the Microsoft 365 admin centre (which is backed by Entra).

2. Single Sign-On (SSO). If your device is set up with your work account, you’ll often sign in once to your computer and won’t be prompted again when you open apps like Teams. That’s Entra working behind the scenes — one login, access to everything. It’s more convenient and more secure than using separate passwords everywhere.

3. Multi-Factor Authentication (MFA). This is the big one. MFA means that even if someone gets your password, they still can’t log in without the second factor — usually a code from an app on your phone.

Without MFA, your password is the only thing standing between a hacker and your business email, files, and customer data. That’s one lock. MFA adds a second. Simple concept, massive impact.

4. Conditional Access. This is where it gets powerful. Conditional Access lets you set rules about how and where people can log in. For example:

• Only allow logins from New Zealand
• Require MFA if someone is logging in from a new device
• Block logins from countries you don’t operate in
• Only allow company-managed devices to access certain files

Business Premium includes Conditional Access. Basic and Standard rely on Security Defaults, which enforces MFA automatically but with less flexibility.

5. Device management (with Intune). If you add Intune to the mix (Business Premium), Entra tells Intune which devices are trusted and which aren’t. A company laptop that’s been set up properly? Fine. A random personal laptop from a coffee shop? Maybe not.

Why Should You Care?

Because identity is the new firewall.

Old school IT thinking was: build a strong perimeter. Get a good firewall, lock down the network, and you’re safe. That worked when everyone worked in an office and all the computers were plugged into the same network.

That’s not how most businesses work anymore. People work from home. They check email on their phones. They log into SharePoint from their laptop at the airport. The perimeter is gone.

So what’s left? Identity. The only thing that matters now is: is this person actually who they say they are, and should they be allowed to access this thing?

That’s Entra’s job. And if you’re not paying attention to it — if MFA isn’t enabled, if former employees still have active accounts, if you’ve got no control over what devices can access your data — you’ve got a gaping hole in your security and you don’t even know it’s there.

The Scary Bit

Here’s what keeps me up at night when I think about small businesses:

The number one way business accounts get compromised is stolen or phished passwords. Someone gets tricked into entering their Microsoft 365 password on a fake login page. The hacker now has their username and password. They log in. They read emails. They access files. They send from that person’s email to suppliers with new bank account details.

Sound far-fetched? It happens constantly.

And the fix is dead simple: enable MFA. If you do nothing else after reading this post, go turn on MFA for every user in your Microsoft 365 account.

With MFA enabled, the stolen password is useless. The hacker needs the second factor — the code from your phone — and they don’t have it.

It’s not bulletproof. Nothing is. But according to Microsoft, MFA stops over 99.2% of identity-based account compromise attacks dead in their tracks.

What About Business Standard Users?

If you’re on Business Standard, you still get basic MFA and user management through Entra. You just don’t get the fancier conditional access policies and Intune integration.

Here’s what you should still do:

1. Enable MFA for every user. No exceptions. Not just the important ones. Everyone.
2. Use the Microsoft Authenticator app. It’s free, it works well, and it’s easier than SMS codes.
3. Remove accounts for people who’ve left. When someone leaves your business — voluntarily or otherwise — disable their account immediately. Don’t leave old accounts sitting there. They’re an open door.
4. Check sign-in logs occasionally. In the Entra admin centre, you can see who’s been logging in and from where. If you see a login from Nigeria and you don’t have staff in Nigeria, something’s wrong.

How to Enable MFA (Quick Version)

There are two approaches depending on your licence. Pick the one that applies to you.

Option A: Security Defaults (Business Basic / Business Standard)

This is the simplest option. Security Defaults enforces MFA for all users with no configuration needed.

1. Go to entra.microsoft.com
2. Sign in as at least a Conditional Access Administrator
3. Navigate to Entra ID → Overview → Properties
4. Click Manage Security Defaults
5. Set it to Enabled
6. Save
7. Tell your staff to download Microsoft Authenticator and set it up — they’ll be prompted on their next login

Option B: Conditional Access Policy (Business Premium)

If you’re on Business Premium, you have Entra ID P1 and can create Conditional Access policies for more control.

1. Go to entra.microsoft.com
2. Sign in as at least a Conditional Access Administrator
3. Navigate to Entra ID → Conditional Access
4. Click New Policy
5. Under Users, select All users
6. Under Target resources, select All cloud apps
7. Under Grant, select Require multifactor authentication
8. Set Enable policy to On and save
9. Tell your staff to download Microsoft Authenticator and set it up

Note: Microsoft is phasing out the older per-user MFA page. Don’t use it for new setups — use Security Defaults or Conditional Access instead.

Staff grumble about MFA for about a week. Then they forget it’s even there. It becomes second nature. Don’t let a bit of initial pushback stop you from enabling it.

The Bottom Line

Microsoft Entra isn’t just enterprise jargon. It’s the lock on the door of your entire digital business. If you’re on Microsoft 365 — which most businesses are — you’re already using it.

The question is: are you using it well? Is MFA on? Are old accounts disabled? Do you know who has access to what?

If you can’t answer those questions, it’s time to take a look. Not next month. This week.

I’ve put together a step-by-step MFA setup guide on Patreon — covering both Security Defaults and Conditional Access, with a staff onboarding email template you can send to your team and a monthly security checklist. Grab the guide here.

I don’t know about you, but I didn’t get into IT to become a licensing consultant.

Here’s the thing though — picking the right plan matters. Pay too little and you miss out on features your business actually needs. Pay too much and you’re burning cash on stuff you’ll never use. Let’s cut through the noise.

The Three That Actually Matter for Small Business

Microsoft has a lot of plans. There are enterprise plans, education plans, frontline worker plans, non-profit plans… it goes on. But for a typical small business — say, 2 to 50 employees — there are really only three you should be looking at:

Microsoft 365 Business Basic ($9.70 NZD/user/month) Microsoft 365 Business Standard ($20.20 NZD/user/month) Microsoft 365 Business Premium (~$35.60 NZD/user/month) Let’s break them down.

Business Basic — The Essentials

This is the entry point. For about $9.70 per person per month you get:

• Email via Outlook (50GB per user)
• OneDrive storage (1TB per user)
• Microsoft Teams (chat, video calls, meetings)
• SharePoint (shared file storage)
• Web and mobile versions of Word, Excel, PowerPoint

What you don’t get is the desktop versions of Office. No installed Word, no Excel on your actual computer. Just the web versions.

This plan works if your team is happy working in a browser. Some businesses genuinely are. But in my experience, most people want the full desktop apps. They want Excel with all the features, Outlook on their taskbar, and Word that doesn’t need an internet connection to open.

If you’ve got a couple of staff and they just need email, file storage, and Teams, this might be all you need. But if anyone needs to work on complex Excel spreadsheets or use Outlook offline, you’re going to hit limits fast.

Business Standard — The Sweet Spot

For about $22.20 per person per month — double the Basic plan — you get everything above plus:

• Desktop versions of Word, Excel, PowerPoint, Outlook, and OneNote
• Everything installs and runs locally on your computer
• Works offline (you don’t need the internet to open and edit files)

This is where most small businesses should be. You get the full Office experience everyone is used to, cloud file storage, email, Teams — the lot.

For the extra 12 ish dollars per user per month over Basic, you get the actual Office apps. That’s a no-brainer for almost every business.

Business Premium — When You Need the Extras

At about $35.60 per user/month, you get everything in Standard plus:

• Intune (device management — manage laptops, phones, and tablets)
• Entra ID P1 (identity and access management — conditional access, MFA controls)
• Azure Information Protection (control who can open, forward, or print sensitive files)
• Advanced threat protection (safer email, anti-phishing)

This is where it gets interesting — and where most small businesses overpay.

If you’re a business with 5 employees and you’ve got one shared laptop in the office, you almost certainly do not need Intune. You don’t need conditional access policies. You don’t need AIP.

But if you’ve got staff working from home on their own devices, or you handle sensitive data (customer info, financial records, health data), or you’re in a regulated industry, then Premium starts making sense. Intune lets you enforce security policies on every device that accesses your data. Entra ID lets you control who can log in and from where.

If you are choosing this level you really need a dedicated IT support person at the very least. Managing Intune, Entra/Azure is a beast and it takes a person working with it full time to understand it.

Side Quest: The Microsoft Licensing Treadmill

Here’s something that grinds my gears. Microsoft keeps changing plan names, shuffling features between tiers, and making it harder to compare. Features that were in Business Standard get moved to Premium. New plan names appear. Old ones get retired. It’s a deliberate strategy to keep you slightly confused so you just pick a plan and stop asking questions.

Don’t play that game. Know what you’re paying for. If you don’t use Intune, don’t pay for Intune. Downgrade.

So Which One Should You Pick?

Here’s my quick and dirty guide:

If your team just needs email, file storage, and web-based Office: → Business Basic

If your team needs the full desktop Office apps (Word, Excel, Outlook, etc.): → Business Standard

If you have remote staff, handle sensitive data, or need to control who accesses what: → Business Premium

For most small businesses I’d say the answer is Business Standard. It’s the plan where nothing important is missing and you’re not paying for enterprise features you’ll never touch.

Hidden Costs Nobody Talks About

A few things to watch for:

It’s per user, not per device. If someone has a desktop, a laptop, and a phone, that’s still one license. That’s actually good news. But if you’ve got 10 employees and only 5 computers, you still need 10 licenses if all 10 people need email and file access.

Domain name required. You probably want email that’s you@yourbusiness.co.nz, not yourbusiness.onmicrosoft.com. That means you need a domain, which is an extra ~$15-20/year. Worth it for the professionalism alone. In my humble opinion this is one of the things that turns me away from a business. Instead of battler@myplumbing.co.nz they expect me to email myplumbing@gmail.com. That’s a deal breaker for me.

Migration takes longer than you think. If you’re moving from Gmail or another provider, budget for a weekend or two of setting things up properly. Don’t try to do it on a Monday morning.

You’ll almost certainly need help setting it up. Intune and Entra are powerful but they’re not simple. If you’re going Premium, factor in some setup help from an IT person. Even if it’s just a few hours to get the basics configured. Even better, keep them on hand for any changes you need to make, I can’t see someone fighting fires with their biz coming home and expecting to know what to do with Intune and or Entra.

The Bottom Line

Don’t overthink it and don’t overpay. Most businesses need Business Standard, a few can get away with Basic, and Premium is for businesses that actually need the security features.

And whatever you pick, make sure you’re actually using what you’re paying for. I’ve seen businesses on the Premium plan for “the security” and then never configure a single Intune policy. You’re just lighting money on fire at that point.

Need help deciding or want a checklist for setting up your chosen plan? I’ve put together a companion guide on Patreon that walks you through the decision process step by step. Check it out here.

This time, let’s talk about what a proper backup strategy actually looks like. There’s a well-known framework for this, and it’s refreshingly simple.

It’s called the 3-2-1 Backup Rule.

What Is the 3-2-1 Rule?

The concept comes from Peter Krogh, a photographer who was thinking about how to protect his life’s work. It’s since become the gold standard for data protection across every kind of business.

The rule is:

3 copies of your data 2 different types of storage 1 copy stored offsite

That’s it. Three lines. But each one matters, and most grassroots businesses aren’t following any of them.

Let’s break it down.

3 Copies of Your Data

This means the original data on your computer, plus two separate backups. Not one backup — two.

Why two? Because your single backup can fail. Hard drives die. USB sticks get lost. Cloud accounts get compromised. If you only have one backup and it’s corrupted or missing when you need it, you’re in the same position as someone with no backups at all.

The good news: copies don’t all need to be full system images. One could be an image backup of your entire machine, and the other could be a copy of your critical business files — accounting data, customer records, emails, whatever would hurt most to lose.

2 Different Types of Storage

Don’t put both backups on the same kind of device. If both backups are on external hard drives and one fails due to a manufacturing defect, the other might not be far behind — same batch, same usage, same environment.

Instead, use two different storage mediums:

• External hard drive or NAS (Network Attached Storage) at your office — for fast, local restores
• Cloud backup (Backblaze, Wasabi, Azure Blob, AWS S3) — for protection against physical disasters

The point is diversity. Different storage types fail in different ways. Cover more bases.

1 Copy Stored Offsite

This is the one most people skip. Your office has a fire, flood, theft, or power surge — and suddenly your computer and your backup drive are both gone.

An offsite copy means at least one backup lives somewhere physically separate from your business. For a small business, this doesn’t have to mean a data centre. It can mean:

• A cloud backup service (the most practical option for most)
• An external drive you rotate weekly to someone’s home
• A NAS at your house if the business is at your shop

The cloud option is honestly the easiest for a grassroots business. Once it’s set up, it runs automatically. No one has to remember to take a hard drive home on a Friday.

What This Looks Like in Practice

Let’s say you run a plumbing business with one office computer and a server.

Copy 1 (Original): Your live data on the office computer and server.

Copy 2 (Local backup): A NAS device in the office running daily backups of everything. If your server dies, you restore from the NAS. Done in minutes, not days.

Copy 3 (Offsite/Cloud): A cloud backup service running nightly, pushing encrypted backups offsite. If the office burns down, you buy a new computer, connect to the cloud, and start restoring. You’re operational again within a day or two instead of starting from scratch.

That’s the 3-2-1 rule in action. Not complicated, not expensive, but dramatically better than nothing.

What About the Cost?

This is where I expect some pushback: “Yeah, but I’m a tradie with 3 employees. I can’t afford a NAS and a cloud service.”

Here’s the thing — you can’t afford not to. A decent 2-bay NAS runs about $300-400 NZD. A 4TB external drive is around $100. Cloud backup for a small business runs about $50-100/month depending on how much data you have.

Compare that to the cost of losing all your business data. Customer records, invoices, job records, accounting files. The stuff you actually run your business on. What’s that worth?

And you don’t have to do it all at once. Start with an external drive and a cloud backup first. Add a NAS later. The key is to start.

The Bare Minimum

If budget is genuinely tight, here’s the absolute baseline:

• Copy 1: Your computer (original)
• Copy 2: External hard drive plugged in at the office, backing up weekly
• Copy 3: Cloud backup service running automatically

This costs you about $8-10/week for a basic cloud backup and possibly a one-time cost for an external drive. Less than most people spend on coffee.

If that’s still too much, I’d challenge you to think about what your business data is worth. Because the question isn’t really “Can I afford to back up?” It’s “Can I afford not to?”

Automate or Forget

The biggest enemy of backups isn’t cost — it’s forgetting. If backing up requires someone to plug in a drive, click a button, or remember to do something, it will eventually get skipped.

Automate everything you can. Set your backup software to run on a schedule. Cloud backups should be continuous or nightly. A local backup should run at least weekly, ideally daily.

Set it and forget it. Except for one thing: verify.

Test Your Backups. Seriously.

I mentioned this in the last post but it bears repeating: a backup you’ve never tested is just a guess.

Pick a file. Restore it from your backup. Confirm it works. Do this every month or so. It takes five minutes. It’s the difference between “I think we’re backed up” and “I know we’re backed up.”

The 3-2-1 Rule Is a Starting Point

This rule doesn’t cover everything — you also need to think about how often you back up (daily? hourly?), how long you keep old backups (30 days? 90 days?), and what you’re actually backing up (just files? system images? email?).

But the 3-2-1 rule is the foundation. Nail this first. Build on it later.

If you follow nothing else, do this:

1. Buy an external hard drive
2. Set up a cloud backup service
3. Automate both to run on a schedule
4. Test a restore once a month

That’s it. You’re ahead of 90% of small businesses already.

Want a step-by-step walkthrough of setting this up? I’ve put together a companion guide on Patreon that walks you through choosing a cloud provider, setting up automated backups, and creating a restore checklist. Check it out on Patreon.

After my last post, “10 Things IT Pros Don’t Want You to Know”, I did some soul-searching. I realised I might be leaning on AI too much to solve my problems.

Where would I be if AI suddenly imploded and shat itself?

Is AI making me a better, more constructive team member, or is it slowly turning me into a moron like those in Idiocracy (great movie, by the way)?

So, with that said… what’s the plan moving forward?

A Very Real Problem

I’ve dabbled with AI music—both as a consumer and a creator.

At first, I didn’t even realise I was listening to AI-generated music. Like I always do when I find a song I enjoy, I went looking for more tracks from the same artist. The assumption is simple: 

If they’ve got one banger, they must have more.

Well… this artist had banger after banger.

Normally, that’s a good thing—but this time, it became clear that they weren’t a real band.

Not entirely bad, though. I liked the music (if you can call it that), and at the end of the day, it made my commute more enjoyable.

That got me thinking: 

“Alright, let’s try this AI music thing.”

Within 15 minutes, with minimal prompting, I was pumping out some surprisingly passable tracks.

So What’s the Issue?

Here’s where things get murky.

Some AI music platforms may have trained their models on real musicians’ work without permission. That puts us in a bit of a quagmire:

• On one hand:    AI is an incredible tool for quickly mocking up ideas.
• On the other hand:    It’s potentially lifting from real artists without credit, compensation, or acknowledgment.

That’s… not great.

The Aha! Moment

I stumbled across this video: 

👉 Poison Your Data. Fight Back Against AI

Which led me to: 

👉 The Art of Poison-Pilling Music Files

These two videos genuinely shifted my perspective on AI.

Then came the final piece of the puzzle: 

👉 CyberCPU

He talks about stepping back from creating how-to content because AI is scraping and repackaging his work without attribution.

And honestly? That hit home.

What’s the Big Problem?

If AI is pulling its knowledge from everyday creators—musicians, bloggers, YouTubers like CyberCPU—then what happens when those people stop creating?

We end up with a dangerous cycle:

Creators stop → content dries up → AI quality drops → everything gets worse

No fresh ideas. 

No new tutorials. 

No original music. 

Just increasingly mediocre output built on stale data.

In the long run, AI actually depends on humans continuing to create. Without that, the whole system degrades.

The Plan Moving Forward

I’m not ditching AI—but I am changing how I use it.

For example, in Microsoft Copilot, you can define custom instructions:

You can tell it how to respond, what tone to use, and even how to behave. 

(Not that asking it to speak in a Jamaican accent is particularly useful… but it might be good for a laugh.)

My New Rules:

• ✅ Always require references for answers 

• ✅ Double-check outputs instead of blindly trusting them 

• ✅ Use AI as a learning tool, not a crutch 

At the very least, AI should point me toward real sources and creators worth acknowledging.

Final Thought

Don’t trust. Verify.

If I can use AI to learn better, rather than think less, then maybe there’s a balance to strike after all.

When you have a problem and I don’t know the answer I search it. I personally don’t use Google but the term is grandfathered in now and is synonymous with searching. So by using simple logic, if I’m searching for the fix you probably can too. Take the error message if you have one, plug it into your favourite search engine such as Google, Bing (why, just why) or Brave search (the one I use) and hopefully you come up with a solution.

2. Sometimes I just restart machines and they work

You would be amazed at how often a reboot fixes the problem. Actually, a shutdown, give it 30 seconds and then start that bad boy up. You will be off to the races in no time. Why does this work and why should you do this first before bothering someone for help? Well, it’s kinda the same as sleeping. When we sleep all sorts of things downregulate and other things get cleared out. A computer is much the same. Resources like RAM get completely wiped clean, and the system gets a fresh start.

3. I use AI to solve basically everything

This is really the endgame when it comes to getting shit done. Number 1 above was the gold standard but now AI holds that mantle. It can get me 90% of the way there in one or two prompts. You have no idea how much IT teams rely on it to sort issues.

4. We are mortals like you, not IT Gods

When it comes to IT we can come across as being all-knowing beings that can solve IT problems like Gods. What if I told you that your very new problem is something I’ve seen 20+ times. All I am is a pattern recogniser. I’ve seen your problem enough times that it’s ingrained into my muscle memory. We are pattern recognisers.

5. Your “Urgent” is not our urgent

You might think your laptop running slow is a code red. Meanwhile, the email server is down and 200 people can’t work. IT triages like an emergency room — we’re not ignoring you, you’re just in the waiting room with a sore knee while someone else is flatlining.

6. Most IT policies exist because one person ruined it for everyone

Ever wonder why you can’t install apps or plug in a USB stick? That’s because Dave from accounting installed a dodgy toolbar in 2019 and took down half the network. Every annoying policy has an origin story, and it’s always one person.

Side Quest (Rant)

You can skip this part entirely but as I was writing that last one it sent me off on a tangent. The whole reason we can’t have nice things is because some bastard ruined it for everyone else. We have speed bumps on the road because some knob was speeding and nearly took someone out. Now we all have to ruin our suspension. We have speed limits on roads because other people crash and aren’t paying attention. We have all sorts of suppression on various things in our lives because someone ruined it for everyone else.

Everyone should have a blog if for nothing else but to let go of some mental load haha.

7. We break stuff too

We have caused more outages than we’ll ever admit. That “scheduled maintenance” at 2am? Sometimes that’s us quietly fixing something we broke at 5pm. The difference between us and you is we know how to undo it (most of the time).

Another Side Quest

The we break things is too real. In my early days (my 1st full year as a sys admin) I may have accidentally deleted an entire database for a quarter of our users. That quarter could no longer receive any email nor send. It was a very real reminder of how easy it is to get distracted and ruin a lot of peoples day (none more so than myself). All was not lost though, I quickly realised and kicked into gear. Had the database back and running in just over an hour. I learned the importance of taking things slow and if you screw up royally, how to hustle to save face. Biggest learnings.

8. We can see way more than you think

Your browsing history, what’s installed on your machine, how long it’s been since you restarted — we can see all of it. So when you say “I haven’t done anything different”… we know.

9. We have favourite users (and you know who you aren’t)

The person who gives clear details, tries a restart first, and says thanks? Their ticket goes to the top. The person who sends “IT’S BROKEN” with no context for the fifth time this week? Back of the queue, mate.

10. We YouTube and read documentation just like you could

There’s no secret IT knowledge vault. Half the time we’re reading the same vendor documentation or watching the same YouTube tutorial you could find yourself. We’re just better at knowing what to search for and which answer to trust.

With my small business scope in mind, I do worry that there are solid battlers out there, earning an honest dollar with little to no budget or time to spend on adequate backup solutions. I assume they’re running some sort of system like OneDrive, Google Drive or Dropbox thinking they’re backed up to the cloud, job done right? Nah, that’s a sync, not a backup.

That may sound elitist, but this is a critical distinction. It’s the difference between recovering from an IT disaster or losing everything. Let’s crack on to understand the difference and clear it up.

What People Think Backup Means

A backup should never be treated as chore. I think some SMB’s (small medium business) treat backups as a task that once done is completed. Data copied to an external hard drive, maybe some files saved in cloud storage. Tick!

Little care of thought is given to something that, in my humble opinion, is one of the most important things a business can do. In my day to day job, albeit a big multi country company, there is always someone (practically weekly) that asks if I can restore a file/folder because they accidentally overwrote/deleted it.

Side Quest (Rant)

I’m going to take a quick detour here for a rant. Feel free to skip this part but I think I need to dump this so I stay sane.

It really grinds my gears that people are so flippant with their corporate data. “Oh can you restore x, I accidentally deleted it”. What would happen if we didn’t have that backed up? Would you be more careful?

I grew up in the 80’s and 90’s where we had trampolines with exposed springs and no safety nets. You’d do a flip or some munter mate would double bounce you. You would often land, legs between the springs, grazes etc… if you were lucky. Sometimes you would bounce straight off altogether. This taught you to be careful unlike the children today that grow up with zipped up nets stopping them from learning a valuable life lesson.

Anyway the tramp rant is how I see people today. They are so used to having the net (backups) that they are reckless with their files. The assumption is that I can restore it for them. News flash, depending on budget, some things may not be backed up. Take some ownership and be careful with your files!

Anyway, enough of this rant even though it has been quite cathartic

What People Think Backup Means - Continued

What most people think is a backup is actually just file syncing — OneDrive, Google Drive, Dropbox. These tools are great for day‑to‑day use, but they’re not backup systems. That’s not what they were designed for.

Here’s why that matters: if you, your partner, or any staff you may have accidentally delete files or folders, that deletion is synced everywhere. If ransomware encrypts your files, the encrypted versions are replicated across all devices as well.

Most of these platforms do offer some mitigation by keeping a limited number of file versions that you can roll back to. But if you’re not regularly accessing all of those files and folders, there’s a real risk you won’t notice a problem until it’s too late.

Syncing keeps your files available. Backup keeps your files recoverable. Those are two very different jobs.

And files and folders aren’t the only things that need backing up. Locally installed software that’s critical to the business also needs to be considered. Is this software essential to how you operate? Can you recover if your hard drive gives up the ghost? Even if you have a copy, is it as simple as reinstalling and pointing the application back at the data?

So What Is a Real Backup?

To me, a real backup means in the event where you lose a file, delete a folder or you start your computer/laptop up and you have a blue screen of death, you know you are able to recover and get back up and running.

A real backup is a separate, independent copy of your data that can be restored to a specific point in time. The copy doesn’t change when your live data changes. No syncs, it’s just a break glass in case of emergency copy of your data for when you need it.

At a minimum following a 3-2-1 rule is a good starting point. This is a baseline to start with and you can build on it from there depending on how often your files are changing and how much work you want to make for yourself:

• 3 copies of your data (the original plus two backups)
• 2 different types of storage (say, a local device and the cloud)
• 1 copy stored offsite (physically separate from your office)

Remember, this isn’t overkill. It’s the minimum standard that actually protects you when things go sideways — whether that’s a hardware failure, a cyberattack, a fire, or plain old human error.

Where SMBs Commonly Get It Wrong

Blind trust, assumptions and wilful thinking is where most issues arise.

If you are lucky enough to have some IT guru that takes backups for you have you verified them? Do you know how often or what is being backed up? There is a common saying in Crypto Currency circles, “don’t trust, verify” which basically means don’t trust a “trust me bro” person, make sure it is what they say it is.

Some think they are small fish, too small to be a ransomware target. Well, given the current landscape with AI and script kiddies online. It’s not a case of if you will be targeted but a case of when. We are all busy and prone to mistakes especially when you’re grinding hard to make a buck and you mistake a malicious email for a legit one. Never assume you are too small to be a target. Some people just dangle a hook out there with malicious stuff for shits and giggles and you happen to be the fish that latches on.

Lets say you actually do have backups. Have you tested them? This comes back to the “don’t trust, verify”. A backup isn’t a backup until you can verify it will be capable of doing what you need it to do. If you have taken a full backup image of your computer have you restored this in a development location to confirm:

1. You actually know how to restore your computer in a disaster recovery situation
2. That your backups are actually working Verify!!!.

“We back up our files, so we’re fine.” Files are only part of the picture. What about your email? Your accounting software? What about your passwords that you save to your browser (which you shouldn’t but that is another topic later). A proper backup strategy covers your entire business environment, not just the documents folder.

Why This Matters More Than You Think

Data loss isn’t a hypothetical. Hard drives fail. Employees make mistakes. Ransomware is a real and growing threat to every business no matter the size. And when data disappears, the consequences are immediate: operations grind to a halt, invoices can’t go out and customer records vanish

The businesses that recover quickly from these events aren’t lucky — they’re prepared. They have real backups, they test them regularly, and they know exactly what’s protected and what isn’t.

What You Should Be Asking

You don’t need to become a backup expert. But you do need to ask the right questions — of yourself, or of whoever manages your IT:

• What exactly is being backed up? (Files, emails, databases?)
• How often are backups running?
• Where are the backups stored? Is there an offsite copy?
• When was the last time a backup was actually tested by restoring data from it?
• How long would it take to get back up and running after a total loss?

If you can’t answer these questions — or if the answers make you uncomfortable — that’s a sign it’s time to take a closer look.

The Bottom Line

“Backup” isn’t a product you buy or a box you tick. It’s a strategy. It’s knowing that when something goes wrong — and eventually, something will — you can get your business back to where it was, without losing days, weeks, or years of work.

If the only thing standing between your business and total data loss is a OneDrive sync and a prayer, it’s time to have a proper conversation about what backup really means.

What to expect

• Troubleshooting guides
• Automation scripts and tips
• Infrastructure deep dives
• Backups
• General IT guidance gold!

Stay tuned for more!