IT for growing businesses

What works at 10 staff breaks at 30. What works at 30 breaks at 60.

IT doesn't get harder gradually. It changes in steps, usually when a second team, a second office or a leaver with too much access appears. Here is what each stage needs, in our experience, and a stage finder that shows what's missing now and what to plan next.

Stages are our view from client work. Microsoft details from Microsoft Learn, checked 31 October 2026.

Plan our next stage Find your stage 07 3114 2808

Five stages
What to add at each
Stage finder

Reviewed by Blake Bath, General Manager, on 31 October 2026.

A manager and an IT technician unpack new laptops onto rows of empty desks in a larger office. — **Plan one stage ahead**Fix the next stage's gaps before the headcount arrives.

At a glance

Five stages, and what each one adds.

Each builds on the one before.

Under 10: simple and cloud

MFA everywhere, a password manager, cloud-managed laptops, a one-page policy.

MFA
Password manager
No server

IT stage finder

Where are you, and what's missing?

Pick your size and tick what you have. You get the gaps for your stage and what to plan before the next one.

Pick your size and tick what you already have. You see what's missing for where you are now, and what to plan before the next stage.

How many staff?

What do you already have? (pick all)

Your stage

10 to 30 staff: add structure

Missing for this stage or earlier

A password manager
Conditional Access
Planned SharePoint structure
An MSP

MFA on every account
Cloud-managed laptops

Plan before 30 to 60 staff: Essential Eight assessed, Security training.

Plan our next stage

Under 10 and 10 to 30

Up to 30 staff: get the foundations right.

MFA on every accountAuthenticator app or passkey, not SMS. From day one.
One password managerShared logins to cloud tools are the hardest habit to undo later.
Cloud-managed laptopsNo on-site server. Enrol devices in Intune early.
Business Premium from about 10Conditional Access, Intune and Defender for Business in one plan.
A planned SharePointA site per team, permissions by role, off personal OneDrives.
A standard laptop and buildAutopilot sets new devices up on first sign-in.

Governance and co-management

30 to 100 staff: add governance and ownership.

Essential Eight assessedKnow where you stand, and work towards Maturity Level Two.
Phishing-resistant admin sign-inPasskeys or security keys for admins first.
Security trainingRegular, short, with phishing practice.
Insurance with evidenceControls documented, so proposal answers are backed up.
An internal IT leadOwns the roadmap, suppliers and reporting, with the MSP doing day-to-day.
Risk register and continuity planReviewed quarterly, tested yearly.

Strategy

Over 100 staff: strategy and specialisation.

IT manager or CIOStrategy, governance and suppliers, not tickets.
A certification pathSMB1001 for Australian SMBs, ISO 27001 for international clients. The controls are the goal.
24/7 detectionSomeone watching sign-ins and endpoints outside business hours.
Quarterly steeringIT hears about new sites, markets and acquisitions early.

Our view

Fix the next stage before you reach it.

The pain of growth almost always shows up in identity first: shared logins, personal drives, and a leaver who still has access. Fixing those at 15 staff takes a week. Fixing them at 50 takes a project.

So we look one stage ahead. If you're at 25 and hiring, we put Conditional Access, device management and a SharePoint structure in now, while it's still easy.

How we work

Moving up a stage in five steps.

Step 1Assess
Identity, devices, security and support model.
Step 2Plan
The controls the next stage needs, in order.
Step 3Approve
Scope and budget agreed before work starts.
Step 4Deploy
Configure, test with real work, adjust.
Step 5Review
A month in, then quarterly.

Related guides

Growing well. Foundations, structure, plan.

The guides that go deeper on each stage.

Get help your way

Six ways to reach us. Pick whichever suits you.

Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.

Questions

What growing businesses ask about IT.

When should we move from break-fix to managed services?

Usually somewhere between 10 and 30 staff, once you have a second team, shared files and regular new starters. At that point the gaps and downtime of doing it yourself start costing more than a per-user service.

When should we hire an internal IT person?

Around 60 staff is common, as an IT lead who owns the roadmap, suppliers and risk register, working with an MSP for day-to-day support. It depends on how much of your business runs on technology.

What Essential Eight level should we target?

ASD's model suggests most organisations target Maturity Level Two. Smaller businesses often get there in steps, starting with MFA, backups and patching. Check what your insurer and customers expect.

Do we need an on-site server as we grow?

Usually not. Microsoft 365 and cloud apps cover email, files and most business systems. Keep a server only for an application that genuinely can't run in the cloud, and back it up off-site.

When does Business Premium make sense?

Usually from the point you need to manage devices and enforce sign-in rules, often around 10 staff. It adds Entra ID P1 for Conditional Access, Intune for devices and Defender for Business, for up to 300 users.

Should we keep our MSP as we grow?

Review the fit at each stage change. Outgrowing a provider is normal. If the scope, reporting or response no longer match your risk, it's time for a conversation.

Next step