RemoteManaged Microsoft 365
Microsoft 365, secured the same way in every tenant we run.
Tenants are often set up once and never revisited: shared admin logins, SMS codes, sign-ins allowed from anywhere. We apply one tested baseline, keep it current, and get your people onto passkeys before Microsoft switches SMS off.
Built on Microsoft 365 Business Premium, managed with Inforcer, and supported by the same engineers who answer your calls.
- One baseline, tested on our own tenant first
- Australia-only sign-in by default
- Passkeys before 1 February 2027
Reviewed by Blake Bath, General Manager, on 30 October 2026.
What actually matters
Five settings decide how safe your tenant is.
Microsoft 365 has hundreds of settings. These are the ones we check first, because they are where breaches start.
How people sign in
Microsoft describes SMS and voice codes as among the most vulnerable sign-in methods, and it is retiring its own delivery of them. Passkeys, Windows Hello and the Authenticator app are what staff should be using.
- Move staff to passkeys or Windows Hello
- Phishing-resistant sign-in for every admin
- Finish before 1 February 2027
Where sign-ins can come from
Our standard geolock policy allows sign-ins from Australia only. It stops sign-in attempts from other countries before MFA is even asked.
- Australia-only by default
- Named exceptions for people who travel
- Review exceptions when trips end
Who holds admin rights
Tenants often collect several Global Administrators over the years, some of them old staff or shared accounts. Each is a way to lose everything.
- Named admins with their own accounts
- Two break-glass accounts, excluded from policies and watched
- Admin access for us through delegated admin, not a shared password
Whether devices are trusted
A correct password on an unknown laptop should not get the same access as one on a managed device. Intune and compliance rules make the device part of the check.
- Company laptops enrolled in Intune
- Compliance checked before access
- Personal phones handled with app protection
What happens to the data
Retention settings are not a backup. A compromised admin can change them, and a deleted mailbox is gone once retention runs out.
- Separate backup of mail, files and Teams
- Restores tested, not assumed
- Sharing and guest access reviewed
Tenant check
Eight things every Microsoft 365 tenant should have.
Tick what is true for your tenant today. The gaps are the ones we would close first. Copy the list for your current provider, or send it to us.
Tick what is already true for your tenant. If you are not sure, leave it unticked: that is usually the answer.
Where you stand
0of 8 basics in place
8 gaps to close.
- Nobody relies on SMS or voice codesMicrosoft retires its own SMS and voice sign-in for most users on 1 February 2027, and for Global Administrators and external users on 1 July 2027.
- Admins use phishing-resistant sign-inA stolen admin session is the fastest way to lose a whole tenant.
- Sign-ins limited to the countries you work inOur standard is Australia only, with named exceptions for people who work or travel overseas.
- Legacy sign-in protocols blockedThey let a stolen password work even with MFA switched on.
- Two break-glass accounts, excluded and watchedIf a policy locks everyone out, these are how you get back in.
- Few Global Administrators, all namedEvery extra Global Admin is another account that can delete everything.
- Devices enrolled and checked before accessA healthy device is part of who you are, not just the password.
- Mail, files and Teams backed up outside MicrosoftRetention settings are not a backup, and a compromised admin can change them.
Engineer's take
One baseline, tested on us first.
Blake Bath, our General Manager, runs Microsoft 365 for Real Bytes and for our clients the same way: one set of security policies, pushed through Inforcer to the tenants connected to it, and applied by hand where a tenant is not.
Every new policy is built and tested on the Real Bytes tenant before it goes anywhere near a client. The aim is that no client is ever the first place a change is tried.
His standard sign-in policy is simple and strict: Australia only, with named exceptions for people who travel. Combined with phishing-resistant sign-in, it closes off a common route to a compromised mailbox: a stolen password used from overseas.
How we actually do it
What is behind the monthly fee.
- Policies pushed with Inforcer
Our security policies are deployed to connected client tenants with Inforcer, so one tested change reaches every tenant.
- Tested on our own tenant first
New Conditional Access and security policies run on Real Bytes' own tenant before any client tenant.
- Alerts that become tickets
We are setting up Microsoft Defender so suspicious activity raises a service desk ticket, rather than waiting in a portal.
- Email security on top
Every plan includes our email security gateway and email authentication setup, on top of Microsoft's own filtering.
Email security
The Microsoft deadline
SMS and voice sign-in codes are being retired.
From Microsoft's own documentation, checked 30 October 2026.
| Date | What happens | What to do |
|---|---|---|
| 1 Sep 2026 | Passkeys switched on and prompted for users still on SMS or voice. | Tell staff it is coming and why. |
| 1 Feb 2027 | Microsoft-provided SMS and voice retired for all users except Global Administrators and external users. Users with no other method must register a passkey to sign in. No opt out. | Have everyone on passkeys, Windows Hello or a security key first. |
| 1 Jul 2027 | The same retirement for Global Administrators and external users. | Move admins and external users before this date. |
Businesses that genuinely need SMS can keep it by buying a telephony provider through Microsoft Security Store. For most of our clients, passkeys are the better answer and cost nothing extra.
The Australian guidance
Identity is phase 1 in ASD's Essentials.
ASD's Essentials for enterprise IT, published 15 October 2026, puts Identity services in priority phase 1 alongside Boundary services, because they are common ways in. For most small businesses, Identity services means Microsoft 365 and Entra ID.
ASD's transition guide asks for phishing-resistant MFA domain by domain, default and unused accounts removed, legacy sign-in protocols turned off, and secrets kept in an approved vault. The tenant check above covers the parts that apply to a typical Microsoft 365 business.
Mistakes we see
Five things that put a tenant at risk.
- Shared or forgotten Global AdminsFormer staff, old contractors or a shared admin login that nobody owns.
- SMS as the only MFAEasily phished, and soon no longer delivered by Microsoft itself.
- Sign-ins allowed from anywhereNo country restriction, so password spraying from overseas reaches the MFA prompt.
- Legacy protocols still onOld mail protocols that let a password work without MFA.
- No backup outside MicrosoftRetention settings mistaken for a backup until something is deleted.
How we take it on
From first review to managed, in six steps.
- Step 1Tenant review
Admins, sign-in methods, Conditional Access, licences, sharing and backup, written up for you.
- Step 2Fix the urgent
Remove stale admins, set up break-glass accounts and block legacy sign-in.
- Step 3Apply the baseline
Our tested policies applied through Inforcer, or by hand where needed.
- Step 4Move to passkeys
Staff and admins off SMS and voice before Microsoft's dates.
- Step 5Devices and backup
Laptops into Intune, and mail, files and Teams into a separate backup.
- Step 6Run and check
Baseline drift checked, alerts handled, and a monthly view of what changed.
Related work
Microsoft 365 is the centre. These sit around it.
Most of our clients use several of these together, run by the same engineers.
- Identity and accessPasskeys, admin access and leavers on the day.
- Email securityStop fake invoices and spoofed mail.
- Detection and response24/7 watch on devices and sign-ins.
- Device managementLaptops and phones enrolled and compliant.
- SharePointFiles, permissions and sites that make sense.
- ASD EssentialsWhere Microsoft 365 sits in the new framework.
Get help your way
Six ways to reach us. Pick whichever suits you.
Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.
- Call 07 3114 2808
An engineer answers Monday to Friday, 8am to 5pm AEST. After hours, weekends and public holidays, Chip, our AI agent, answers on the same number or on 07 3180 0965, logs it and escalates urgent incidents to the on-call engineer.
Call now - Email the helpdesk
Send it to helpdesk@realbytes.com.au and a ticket is logged straight away, with a reference number you can quote.
Email us - Client portal
Log and follow your tickets, see what we are working on and who has it.
Open the portal - Remote support
When an engineer asks to see your screen, start a secure session here. You start it, so nobody sees your screen until you do.
Start a session - Chat in Microsoft Teams
Clients can message Chip, our AI assistant, in Teams to log a request without leaving their desk.
How clients reach us - Service status
Check whether Microsoft 365 or another cloud service is down before you lose an hour troubleshooting.
See live status
Questions
What people ask about managed Microsoft 365.
Is Microsoft really turning off SMS codes?
Microsoft-provided SMS and voice sign-in retires on 1 February 2027 for most users, and on 1 July 2027 for Global Administrators and external users. After that, anyone whose only method is SMS or voice has to register a passkey before they can sign in. Microsoft says there is no opt out from that step. Organisations that must keep SMS can buy it through a telephony provider instead.
How do you manage our tenant alongside your other clients?
We use Inforcer to apply and check a standard security baseline across client tenants, so a change is made once and confirmed everywhere. New policies are built and tested on our own tenant first. Our admin access to your tenant uses Microsoft's delegated admin model rather than a shared password.
What does your standard sign-in policy do?
Our standard geolock Conditional Access policy allows sign-ins from Australia only. If you have staff overseas or people who travel, we add named exceptions rather than opening the whole tenant.
Which licence do we need?
Most of our clients run Microsoft 365 Business Premium, which includes Intune, Entra ID P1 and Defender for Business. We add security on top as part of the plan. We check your current licences first, because many businesses pay for seats nobody uses.
Does Microsoft back up our data?
Microsoft keeps the service running and offers retention settings, but retention is not the same as a backup you control. Our plans include a separate backup of mail, OneDrive, SharePoint and Teams.
How much does it cost?
Microsoft 365 management is part of every Real Bytes managed plan, from $150 per person a month ex GST. One-off project work, such as a migration, is quoted separately at $195 per hour ex GST.
Next step
Want to know what your tenant looks like?
Book a tenant review. We will show you the admins, sign-in methods and gaps we find, and what we would fix first.
Keep reading
- Moving to passkeys How to get staff off SMS before February 2027.
- Conditional Access library The policies most businesses need.
- Identity and access management Admin access, leavers and passkeys.
- ASD Essentials tracker Where Microsoft 365 sits in the new framework.
Reviewed by Blake Bath, General Manager, on 30 October 2026. SMS and voice dates from Microsoft Learn. Essentials phases from ASD. Baseline, sign-in policy and testing practice are Real Bytes' own. Microsoft, SMS and voice retirement; Microsoft, SMS and voice retirement FAQ; ASD, Essentials for enterprise IT; ASD, Transitioning from the Essential Eight