What's included, explained.

When something stops someone working, they call, email or raise a ticket and we fix it remotely - usually without anyone leaving their desk. Support runs 9am to 5pm, Monday to Friday, and covers every named user and every device they use for work.

• ✓Phone, email and remote-session support, 9am-5pm Monday to Friday
• ✓Problems that stop someone working, fixed remotely
• ✓Password resets, permissions, mailbox and Teams changes
• ✓Joiners and leavers, and new devices set up on our standard build

Microsoft 365 is where your email, files, chat and security settings live. We take over the day-to-day administration of your tenant, keep it tidy and secure, and make sure you only pay for the licences you actually use.

• ✓Users, groups and shared mailboxes set up and maintained
• ✓Teams, SharePoint and OneDrive structure and permissions
• ✓Licence assignment, with unused licences spotted and removed
• ✓Licences supplied at Microsoft's list price and right-sized as you change

We enrol your team's Windows PCs, Macs, iPhones, iPads and Android devices in Microsoft Intune and apply our standard security settings. That means encrypted disks, enforced screen locks, the right apps installed, and the ability to lock or wipe a device the moment it goes missing.

• ✓Windows, macOS, iOS/iPadOS and Android managed from one place
• ✓Disk encryption (BitLocker and FileVault) enforced
• ✓Compliance rules: only healthy, up-to-date devices reach company data
• ✓Business apps installed automatically

Many successful attacks use weaknesses that already have a fix available. We apply operating system and common third-party application updates across every managed device, check they installed, and monitor devices so problems are spotted early.

• ✓Operating system updates applied on a managed schedule
• ✓Common third-party apps, such as browsers and PDF readers, kept current
• ✓Installs checked, and failed or missed devices followed up
• ✓Devices monitored, with alerts handled in support hours

Traditional antivirus looks for known bad files. Endpoint detection and response (EDR) also watches what's happening on a device - suspicious scripts, unusual processes, ransomware-like behaviour - and helps stop it. We deploy Microsoft Defender for Business on every managed device and monitor it in support hours.

• ✓Next-generation antivirus on Windows, Mac, iOS and Android
• ✓Endpoint detection and response on supported devices
• ✓Attack surface reduction rules that block common attack techniques
• ✓Automatic investigation and remediation of many alerts

Email is still one of the most common ways attacks start. We configure Exchange Online Protection and Microsoft Defender for Office 365 Plan 1 to filter spam, phishing and malware, and to check links and attachments before they can do harm.

• ✓Spam, phishing and malware filtering on every mailbox
• ✓Safe Links: web links checked when they're clicked, not just on arrival
• ✓Safe Attachments: attachments checked in a sandbox before delivery
• ✓Suspicious mail quarantined, not silently lost

Many Microsoft 365 break-ins start with a stolen or guessed password. Our baseline sign-in rules make a password on its own far less useful: every user signs in with multi-factor authentication, older sign-in methods that skip MFA are blocked, and admin accounts get extra protection. It's on every plan.

• ✓Multi-factor authentication required for every user
• ✓Legacy sign-in methods that can't do MFA blocked
• ✓Extra protection on admin accounts
• ✓Enforced with Conditional Access, not a patchwork of per-user settings

Plenty of small businesses can't say how many laptops they have, who has them, or how their Microsoft 365 is configured. We keep a register of every managed device, updated from our device monitoring, and a written record of your setup that's kept current as we make changes.

• ✓Register of every managed device: hardware, operating system and installed software
• ✓Kept up to date automatically from our device monitoring
• ✓Written record of your Microsoft 365, sign-in rules and device settings
• ✓Changes recorded as we make them

Attackers don't keep office hours. Many strike overnight or at weekends, when nobody is watching. On Secure+, your managed devices and Microsoft 365 accounts are monitored 24 hours a day, 7 days a week by our security operations partner. If they see an attack, they can isolate a device or lock an account straight away, and we follow up.

• ✓24/7 monitoring of managed devices
• ✓24/7 monitoring of Microsoft 365 accounts for suspicious sign-ins and activity
• ✓Alerts reviewed by security analysts, not just automated rules
• ✓Threats contained day or night: devices isolated, accounts locked

When another website is breached, the usernames and passwords stolen from it often end up for sale on the dark web. If staff reused a work password there, attackers will try it on your Microsoft 365. On Secure+, we monitor for credentials from your email domains in known breach data and act when they turn up.

• ✓Monitoring for usernames and passwords from your email domains
• ✓Alerts when credentials appear in known breach data
• ✓Follow-up by us in support hours
• ✓Affected passwords changed and sign-ins checked

Patching handles the updates you know about. Vulnerability scanning finds what's been missed: an out-of-date app, a risky setting, a service left exposed on your internet connection. On Secure+ we scan your managed devices and your internet-facing IP addresses and websites every month.

• ✓Monthly scan of every managed device
• ✓Monthly scan of your internet-facing IP addresses
• ✓Your websites included in the external scan
• ✓Findings fixed through patching where we can

Every plan includes our baseline sign-in rules. Secure+ adds a wider set of Conditional Access policies that make stolen credentials much harder to use - for example blocking sign-ins from countries where you don't operate - set up around how your team actually works.

• ✓Everything in the baseline: MFA for all, legacy sign-in blocked, admin protection
• ✓Sign-ins blocked from countries where you don't operate
• ✓Access tied to compliant, managed devices where it suits your business
• ✓Tighter rules for admin and other high-value accounts

Azure bills have a habit of growing quietly: a test server left running, storage nobody uses, resources sized for a peak that never came. On Secure+ we manage your existing Azure subscriptions, handle routine changes, and review your costs at every quarterly review.

• ✓Monitoring of your existing Azure subscriptions
• ✓Routine changes handled through the helpdesk
• ✓A cost review at every quarterly review
• ✓Unused and oversized resources flagged

Secure+ requests are worked ahead of Essentials and Complete requests with the same business impact. A place at the front of the queue, not a fixed response time.

Quarterly reviews keep things on track. Once a year on Secure+, we step back and look at your security as a whole - what's changed in your business, what's changed in the threats you face, and what to prioritise next - and give you a written summary with recommendations.

• ✓Your security controls checked against our security baseline
• ✓Incidents and trends from the past year
• ✓Vulnerability scan and sign-in trends
• ✓Changes in your business that affect your risk