Microsoft 365 for Professional Services Firms: Are You Actually Using It?
You’re paying for Microsoft 365 every month. But if your firm is like most in professional services, you’re using about 30% of it. Email. Word. Excel. Maybe Teams for the occasional call. The rest of the platform, SharePoint, Defender, Intune, Conditional Access, sits there, licensed and idle, on an invoice nobody questions. This post covers what Microsoft 365 for professional services firms should actually look like, what most firms are missing, and what it’s costing them in real terms. Why Most Professional Services Firms Underuse M365 It usually starts the same way. Licences were set up at the start, by a supplier, during a growth phase, or because someone made a recommendation at the time. Nobody came back to finish the job. The team adapted. Workarounds became habits. New starters learned the broken version of things from whoever sat next to them. The platform never got configured for how the firm actually works. It got configured once, loosely, and then left. This isn’t a technology problem. It’s a configuration problem. And it’s almost universal across firms in legal, accountancy, consultancy, and financial services. What Microsoft 365 Business Premium Actually Includes If your firm is on Business Standard or Business Premium, the following is already in your licence. No upgrade required. SharePoint for client file management. Every matter in a structured, permission-controlled library. Version history built in. No more shared drives with six copies of the same document. No more emailing attachments between colleagues. Microsoft Defender for Business. Endpoint protection across every device, included in Business Premium. Most firms have it assigned. Almost none have it configured. Assigned and configured are not the same thing. Microsoft Intune for device management. Enforce security policies across every laptop, desktop, and mobile that touches your network. Remote wipe a lost or stolen device before the data on it becomes a problem. Most firms discover they need this capability when someone leaves unexpectedly, not before. Teams channels per client or project. All messages, files, and notes for a matter in one place. Searchable. Accessible to the right people. Not scattered across email threads, WhatsApp groups, and someone’s local desktop. Conditional Access and MFA policies. Multi-factor authentication on for some users is not the same as a properly configured security baseline. Conditional Access is where the real protection sits, blocking sign-ins from unrecognised devices, enforcing compliant endpoints, restricting access by location. Most firms haven’t touched it. What Does Poor M365 Configuration Actually Cost a Professional Services Firm? The idle licence fee is one number. The bigger cost doesn’t appear on any invoice. Fee earners in professional services lose between 45 and 90 minutes a day to tasks Microsoft 365 is already built to handle. Hunting for the right version of a document. Chasing a file buried in a colleague’s inbox. Rebuilding work after a leaver’s account was removed and their files went with it. At a £60,000 salary, 45 minutes a day is roughly £6,000 per person per year in lost productive time. Across a 20-person firm, that’s £120,000 annually in hours that could be billable, or at minimum, better spent. Then there’s the compliance risk. Firms in legal and financial services operate under SRA Principle 7, FCA SYSC requirements, and ICO registration obligations, all of which carry expectations around how client data is stored, accessed, and protected. A SharePoint environment that hasn’t been set up correctly, combined with Defender sitting unactivated, is a gap that won’t show up until something goes wrong. According to the NCSC, the most common cause of data breaches in professional services is compromised credentials, typically from phishing. Properly configured Conditional Access and MFA policies are the most direct defence. Both are included in Business Premium. Both are consistently under-configured. Four Checks You Can Run This Week You don’t need an IT firm to tell you where your gaps are. These four checks take under an hour and will surface most of what you need to know. 1. Pull your licence report. Microsoft 365 Admin Centre, then Billing, then Licences. Check what’s assigned against what’s available. If you’re on Business Premium and Defender and Intune aren’t configured, that’s the gap confirmed in one screen. 2. Check your MFA status. Admin Centre, Users, Active Users, then Multi-factor authentication. Any user showing “Disabled” or “Not registered” means that account is one convincing phishing email away from being compromised. 3. Look at your SharePoint usage. Admin Centre, Reports, Usage, SharePoint. If active file count is low relative to your headcount, your team is storing files somewhere else, shared drives, local machines, inboxes — and you have no central visibility over any of it. 4. Ask what happens when someone leaves. When a member of staff exits, what happens to their files? If the answer is “IT removes their account,” ask specifically where their OneDrive and SharePoint content goes in that process. If nobody knows, that’s the answer, and it’s a risk worth understanding before it becomes a problem. What a Properly Configured M365 Environment Looks Like A professional services firm running Microsoft 365 properly looks like this. Client files live in SharePoint, structured by matter, with permissions set so only the right people can access them. Teams channels are set up per client or project. Defender is active and monitored across all endpoints. Intune enforces a security baseline on every device. MFA is on for every user, with Conditional Access policies blocking anything that doesn’t meet the firm’s baseline. When someone joins, they’re set up in minutes with access to everything they need and nothing they don’t. When someone leaves, their account is disabled, their files are transferred, and their access is revoked, with a full audit trail. That’s not a complicated setup. It’s what the licence is designed to deliver. It just needs to be configured. If you want to see what this looks like for a firm your size, our professional services IT page covers how we approach it. Is Microsoft 365 Enough for a Professional Services Firm on Its Own?
