Let's start with an honest question: how much of your Microsoft 365 subscription are you actually using?
If the answer is "Teams for meetings, Outlook for email, and Word and Excel occasionally" — you're in the majority. In our experience working with SMEs across Nottingham, Derby and Leicester, the typical business uses fewer than a quarter of the features included in their M365 plan. They're paying for enterprise-grade tooling and using it as a slightly more expensive version of what they had fifteen years ago.
That's a missed opportunity on the productivity side. But on the security side, it's something more serious. Several of the most important security controls available in Microsoft 365 — tools that would meaningfully reduce your exposure to phishing, ransomware and account takeover — are switched off by default. They require configuration. And if your IT provider hasn't configured them, you're paying for protection you're not receiving.
The Security Features Most Businesses Have But Haven't Turned On
Microsoft 365 Business Premium — the tier most SMEs are on — includes a suite of security features that, fully configured, provide enterprise-grade protection. Here's what most businesses have access to but aren't using:
Microsoft Defender for Business
Included in Business Premium, Defender for Business provides endpoint detection and response (EDR) for all managed devices. It monitors device behaviour in real time, flags threats that traditional antivirus would miss, and gives your IT team a centralised view of security across the organisation. Most SMEs have it available and either haven't activated it or have activated it without configuring it properly.
Conditional Access Policies
Conditional Access lets you set rules about when and how users can access Microsoft 365. For example: only allow sign-in from corporate devices, require MFA when signing in from outside the UK, block access from known high-risk IP addresses. These policies are powerful and, set up correctly, significantly reduce the risk of account compromise. They're included in the subscription. They require configuration to work.
Microsoft Intune Device Management
Intune lets you manage every device in your organisation from a central console — enforcing encryption, pushing software updates, applying security policies, and wiping devices remotely if they're lost or stolen. For businesses with remote or hybrid workers, this is essential. For businesses that haven't configured it, remote devices are unmanaged and unprotected.
Safe Links and Safe Attachments
These features, part of Microsoft Defender for Office 365, scan every link and attachment in incoming emails in real time before they reach your users. Safe Links rewrites URLs and checks them at the point of click — even if a link was safe when the email was delivered, it's checked again when someone clicks it. Safe Attachments opens attachments in a sandbox environment before delivering them. Both are highly effective against phishing. Both require configuration to activate.
A common finding: When we audit a new client's Microsoft 365 environment, we almost always find at least one of these security features inactive or misconfigured. The most common gap is Conditional Access — businesses that believe they have MFA enforced because they've switched on the "Security Defaults" setting, without realising that Security Defaults is a basic starting point, not a comprehensive policy. A properly configured Conditional Access setup offers substantially stronger protection.
The Productivity Tools You're Probably Ignoring
Beyond security, there's a significant productivity dividend available to businesses that use Microsoft 365 properly. The tools that tend to go unused:
SharePoint and OneDrive — Done Properly
Most businesses use OneDrive as a simple file storage location. Few have set up SharePoint properly as a shared document management system — with organised library structures, version history, co-authoring, and access controls that mean the right people can access the right documents from anywhere, and sensitive files are protected from inappropriate access.
When SharePoint is configured well, it replaces messy shared drives, reduces email attachments, and makes document collaboration significantly faster. When it's not configured at all, files live in individuals' OneDrive accounts and disappear when they leave.
Microsoft Teams — Beyond Video Calls
Teams is widely used for video meetings. It's far less widely used as a full collaboration hub — with organised channel structures by project or department, integrated apps, shared documents, and persistent chat that means your team isn't starting every conversation from scratch in an email thread.
Businesses that use Teams properly report significant reductions in internal email volume and faster decision-making. But it requires intentional setup. A Teams environment where everyone dumps everything into a single general channel is actually less efficient than email.
Microsoft Copilot
If you're on a qualifying M365 plan, you may already have access to Copilot — Microsoft's AI assistant integrated directly into Word, Excel, Outlook, Teams and PowerPoint. Copilot can draft documents, summarise email threads, generate meeting notes, build Excel formulas, and create PowerPoint presentations from a brief. For the right business tasks, it's a genuine time saver.
Whether Copilot is worth the additional licence cost depends on your team's workflows. For businesses with a lot of document generation, email management or data analysis, the productivity return is significant. For businesses that primarily use M365 for communication, the case is less clear-cut. Either way, it's worth understanding what's available before deciding.
Why This Happens: The Licensing Trap
Microsoft 365 is sold on a per-user, per-month basis. Resellers and IT providers profit on the licence volume. There's no financial incentive for a provider to spend time configuring a client's environment to unlock features they've already sold — the revenue is the same whether those features are active or not.
This creates a common situation: businesses have the right licences, pay the monthly fee, and assume everything is set up correctly because their IT provider hasn't told them otherwise. The reality is that proper M365 configuration is a project in itself — it requires analysis of your business's needs, a structured deployment, policy configuration, user training, and ongoing management.
At CloudHost, our M365 management includes a full environment review, security configuration against a defined baseline, SharePoint and Teams setup, Intune deployment for device management, and ongoing licence optimisation to ensure you're not paying for seats or features you don't need. We see this as fundamental to the managed IT service, not an optional extra.
How to Know If Your M365 Is Set Up Correctly
There are a few quick indicators that your Microsoft 365 environment may not be configured to the standard it should be:
- You're not sure whether Conditional Access policies are configured
- Some users don't have MFA enabled or it's not consistently enforced
- Devices aren't enrolled in Intune (or you're not sure whether they are)
- You don't have a named Microsoft 365 Global Admin account separate from day-to-day user accounts
- You've never had a formal M365 security review
- Your M365 licences haven't been reviewed in over 12 months
If any of these are true, a proper M365 review is worth doing. In our experience, almost every business that comes to us from another provider has at least two or three meaningful gaps in their M365 configuration — security gaps that leave them exposed, or unused features that would make their team more productive.
The tooling is already there. The question is whether it's been set up to work for you.