If your business relies on Microsoft 365, weak control can cut uptime, raise risk, and slow staff across email, Teams, SharePoint, and identity. Many New Zealand SMBs need more than basic IT support. They need Microsoft 365 managed services that protect productivity and reduce compliance gaps.
The right service can cover Microsoft 365 tenant management, Microsoft 365 security management, support, endpoints, and outsourced Microsoft 365 administration, while some approvals or strategy stay in house. Cost can vary with user count, security scope, Microsoft 365 backup and recovery, and Intune endpoint management services. Clear SLAs, support scope, and provider fit matter before you shortlist a Microsoft 365 managed service provider.
What are Microsoft 365 managed services for SMBs?
Microsoft 365 managed services are an ongoing operational service for your entire Microsoft 365 environment. A provider handles the administration, support, and risk management needed to keep your systems running smoothly. This approach provides proactive oversight, routine updates, and clear accountability for your tenant.
This service is different from basic IT support, which usually only fixes problems as they appear. With the New Zealand NCSC responding to 1,369 incident reports in a single quarter, managed Microsoft 365 support ensures your provider owns core operational tasks and documents service level agreements, or SLAs. They also establish clear change control and escalation paths to ensure issues receive prompt attention.
This proactive management ensures that changes follow best practices and do not cause disruptions. Key areas typically covered by a managed service include:
- Email management and Exchange Online
- Files, collaboration, and SharePoint administration services
- Teams governance and management
- Identity and access, including conditional access management
Choosing to outsource IT services for Microsoft 365 administration allows your team to focus on core business activities instead of IT administration. This is especially important for New Zealand SMBs in sectors like finance, legal, insurance, and accounting, where compliance and governance needs require steady attention. These services support productivity and help avoid costly security gaps.
What a managed Microsoft 365 support plan typically includes
A comprehensive Microsoft 365 managed services plan provides the control, security, and support that SMBs need for stable operations. A clearly defined scope helps avoid gaps in service and ensures each part of your business gets the right level of protection. This clarity is essential for aligning the service with your specific business requirements.
Tenant administration and change control
A managed plan includes full Microsoft 365 tenant management. This covers the initial configuration, ongoing health monitoring, licence allocation, and regular policy updates. Your provider documents all changes, which maintains a clear and auditable record of administrative activity.
Routine updates are performed to keep your environment secure and compliant with the latest standards. Managed change control means that every adjustment is properly approved and tracked. This process reduces the risk of service disruption or compliance issues and prevents unauthorised changes that could lead to downtime.
Exchange Online, Teams, and SharePoint management
Exchange Online management covers all critical email functions. This includes mailbox operations, setting up mail flow rules, applying spam filters, and configuring mailbox security. Managed Microsoft 365 support also handles shared mailboxes, manages distribution lists, and helps restore deleted items when needed.
Effective team governance and management involve setting clear policies for team creation, application use, guest access, and data retention. This structured approach helps control Teams sprawl, maintain order within collaboration spaces, and protect sensitive information from being shared improperly. Similarly, SharePoint administration services address permissions, external sharing rules, and site hygiene to ensure files are secure and accessible only to authorised users.
Identity, access, and endpoint management
Identity and access management is a central component of any strong managed services plan. Providers set up and continuously monitor conditional access management policies, enforce multi-factor authentication, or MFA, and manage roles within Entra ID. This work ensures that the right users have the right level of access at all times, protecting your data.
Some managed service providers also include device management through Intune endpoint management services. This service covers device compliance checks, applying security baselines to all endpoints, and enforcing endpoint patch management to keep software up to date. Regular reviews of these settings help keep all endpoints secure, which reduces the risk of breaches caused by lost or compromised devices.
A strong support plan combines these elements to deliver reliable Microsoft 365 support services. Clear documentation, regular reviews, and expert guidance help your business maintain compliance, improve productivity, and reduce risk across the entire Microsoft 365 environment.
Security and compliance management responsibilities to confirm
Security and compliance are foundational to effective Microsoft 365 managed services. You should start by confirming how the provider handles baseline security hardening and continuous monitoring for your tenant. The provider should enforce MFA across all users, regularly review conditional access policies, and check for risky sign-ins.
Email protection remains an essential security function. With New Zealand organisations losing $5 million to business email compromise in a single quarter, your managed Microsoft 365 support plan must cover advanced threat protection, a clear process for phishing response, and the use of tools for safe links and safe attachments. Your business also needs clear and enforceable rules for external sharing, data loss controls, and sensitivity labels to keep information secure.
You should also check that the Microsoft 365 compliance management on offer includes configuring and maintaining retention policies, legal holds, and audit readiness steps. This ensures your business can meet its privacy and regulatory requirements without extra effort from your team. This is particularly important for businesses that handle sensitive client data.
Incident response is another key area to clarify. You need the provider to define clear roles for evidence capture, user communication, and prompt remediation in the event of a security breach. Ask for clear documentation that outlines who owns each action during a security incident to ensure a coordinated and effective response.
A strong Microsoft 365 managed service provider will document all security controls, keep detailed audit trails, and support regular security reviews. These proactive steps reduce security gaps, maintain trust with your clients, and ensure your business meets its obligations with confidence.
Which Microsoft 365 security settings should you turn on first?
Turn on multi-factor authentication for every account first. It closes the single largest gap, the stolen or guessed password, before anything else is worth configuring. From there, the order that reduces risk fastest is conditional access, then locking down admin roles, then email threat protection, then data loss prevention, then device compliance through Intune.
- Multi-factor authentication, on every account. No exceptions for admin accounts or for “the one account nobody wants to disrupt.” An account without MFA is the fastest route in, regardless of how well anything else on this list is configured.
- Conditional access policies. Once every account has a second factor, conditional access decides when that is enough: blocking legacy authentication protocols that skip MFA entirely, and requiring a compliant or recognised device before granting access to email or files.
- Privileged role review. Cut the number of Global Administrator accounts to the minimum genuinely needed, and confirm every one of them has MFA enforced without exception. Admin accounts are the highest-value target in the tenant, so they get reviewed before anything downstream of them.
- Email threat protection. Safe links, safe attachments and anti-phishing rules, because email remains the most common way an attacker reaches a user in the first place, and it sits downstream of who can already sign in.
- Data loss prevention and sensitivity labels. Once access itself is under control, this is what stops data leaving the tenant through external sharing, a misdirected email or an over-permissioned link.
- Device compliance through Intune. Baseline security policies, encryption and patch enforcement on every device that touches the tenant. This closes the list rather than opens it, because a compromised identity or an unprotected mailbox is the more common way in than an unmanaged device.
This order follows the same sequence OxygenIT’s own Microsoft 365 managed services and Microsoft 365 migration content already treats as the priority: identity and access first, then the mail channel, then the data itself, then the device.
When outsourced Microsoft 365 administration becomes necessary
Outsourced Microsoft 365 administration often becomes necessary when your internal team can no longer keep up with the demands of governance, security, and change control. With attackers creating threats that are increasingly difficult to detect, many SMBs in New Zealand face growing pressure from multiple directions. If you notice frequent user onboarding and offboarding or constant access requests, your team may struggle to maintain operational efficiency.
The uncontrolled growth of Teams and SharePoint can also create problems. Without clear policies, permissions become inconsistent, and staff can lose track of important files and collaboration spaces. These issues directly impact compliance and productivity, especially in regulated sectors like legal, finance, accounting, and insurance, where data governance is critical.
Recurring outages, slow fixes for technical issues, and poor escalation from your current IT provider are clear signals that you need more reliable Microsoft 365 managed services. As security and compliance requirements increase, or as your organisation grows, managed Microsoft 365 support ensures your business continues to run smoothly. A strong Microsoft 365 managed service provider can help restore control, standardise processes, and reduce risk.
Outcomes and KPIs to measure value month to month
Measuring the value of Microsoft 365 managed services requires clear, relevant KPIs that reflect business outcomes. A strong service agreement should deliver measurable improvements across support, security, productivity, change control, and cost.
| Category | Key Performance Indicators |
|---|---|
| Service Desk Performance | Response times, resolution times, and repeat incident rates. |
| Security Posture | MFA coverage, reduction in risky sign-ins, and blocked phishing events. |
| Change Management | Change success rate, number of rollbacks, and documented approvals. |
| User Productivity | Faster onboarding times, fewer access issues, and quicker file restores. |
| Cost Control | Licensing optimisation savings, removal of unused seats, and right-sized plans. |
These metrics help SMB leaders determine if their managed Microsoft 365 support is delivering better uptime, reducing risk, and supporting compliance needs. Regular reporting and transparent data keep your provider accountable and prevent hidden issues from developing. When you see steady improvement in these areas, you can trust that your Microsoft 365 managed service provider is protecting your business.
Tracking real results gives you confidence that your investment in Microsoft 365 managed services leads to tangible business benefits every month. This data-driven approach allows you to make informed decisions about your IT strategy and ensure that your technology supports your business goals.
Scope gaps and risks that create hidden costs
Hidden costs can affect any Microsoft 365 managed services plan if you overlook certain areas in the agreement. For example, Microsoft 365 backup and recovery services are often excluded or limited. This can leave your business unable to restore critical data after accidental deletion or a ransomware attack.
Endpoint coverage gaps are another common issue. If Intune endpoint management services are not part of your agreement, it can create significant weak spots in your device security. This is especially risky for businesses with remote or hybrid work arrangements.
Undefined change control processes can also lead to costly after-hours work or confusion about project scope. Limited governance for guest access, external sharing, and data retention can expose sensitive information or lead to non-compliance in regulated industries. Poor documentation, missing runbooks, and unclear admin access ownership can slow down issue resolution and complicate future provider transitions.
Before you select a Microsoft 365 managed service provider, ask about these potential scope gaps:
- Microsoft 365 backup and recovery limits
- Endpoint and device management coverage
- Defined change control and project inclusions
- Guest and data governance standards
- Documentation and admin access clarity
Addressing these risks upfront ensures your managed Microsoft 365 support delivers reliable value without costly surprises down the road.
Which Microsoft 365 licences does a New Zealand business actually need?
Most New Zealand small businesses fit into one of four Microsoft 365 tiers: Business Basic, Business Standard, Business Premium, or, once a business outgrows the Business tier’s scope, the Enterprise E3 or E5 plans. Which one fits depends on whether staff need the installed desktop apps and how much device and identity security the business has to enforce, not on headcount alone.
| Tier | What it adds over the tier below | Fits | Supports the Microsoft 365 Copilot add-on |
|---|---|---|---|
| Business Basic | Web and mobile versions of Word, Excel and Outlook, plus Exchange Online, Teams and SharePoint. No installed desktop apps. | Staff who work mostly in a browser and do not need Office installed on a device | Not listed among the plans OxygenIT names as Copilot-eligible |
| Business Standard | The full installed desktop versions of Word, Excel, Outlook and Teams. | The common default for an office-based team using Office day to day | Yes |
| Business Premium | Intune device management, conditional access and Microsoft Defender for Business, on top of everything in Standard. | Businesses that need to enforce security policy on devices, not just licence the apps. OxygenIT standardises on this tier for every user on its own Complete IT band. | Yes |
| Enterprise E3 / E5 | The security and compliance ceiling raised further, for organisations that have outgrown the Business tier’s scope. E5 adds a deeper layer of compliance and threat protection over E3. | Larger or more complex organisations, or where a Business plan’s scope genuinely is not enough | Yes |
Per-user pricing on the base tiers is confirmed at quote time rather than fixed on this page, because it moves with Microsoft’s own pricing and with the Cloud Solution Provider relationship it is bought through, see the section below on buying through a Microsoft CSP. What is fixed is how OxygenIT bills for it: itemised separately at a published 23 percent margin on every band except Complete IT, where Business Premium is already inside the fixed monthly fee.
If AI drafting and summarisation across email, documents and Teams is part of the decision, Business Standard, Business Premium, E3 and E5 all support the Microsoft 365 Copilot add-on, at an indicative NZ list price of around $49.60 per user per month on an annual commitment. Business Basic does not appear among the plans OxygenIT names as eligible for it.
Microsoft 365 managed services pricing in New Zealand
Pricing for Microsoft 365 managed services in New Zealand can follow several models. Most providers offer per-user, per-tenant, or bundled managed IT pricing. Each approach is designed to suit different business sizes and operational needs.
What Microsoft 365 management actually costs with OxygenIT
OxygenIT does not charge a separate fee for Microsoft 365 tenant management. It is bundled into all four managed IT bands, from $750 a month for a team of up to ten on Remote IT Support, through to $5,800 a month on Complete IT. Microsoft 365 licences are billed separately from that management fee.
Some providers quote Microsoft 365 tenant management as its own per-user line on top of a base support contract. OxygenIT folds it into the band price instead: a 25 person team on Managed IT Support pays $3,000 a month, and tenant management, licence allocation, mailbox and Teams administration are already inside that figure, not an added item on the invoice.
The licences themselves work differently to the management fee. On Remote IT Support, Managed IT Support and Fully Managed IT, Microsoft 365 licences are billed separately and itemised on your invoice, at a published margin of 23 percent, and that cost moves with Microsoft’s own pricing. On Complete IT, at $5,800 a month, Microsoft 365 Business Premium is included for every user inside the fixed monthly price, and that price is locked for the full 36 month term regardless of what Microsoft charges during it.
For the full band table, the 25 person worked example and what stays fixed versus what moves with Microsoft pricing, see OxygenIT’s managed IT pricing in New Zealand.
What pricing is usually based on
Key cost drivers include the number of users, specific security requirements, and the complexity of your device estate. More users or the need for advanced security controls, such as conditional access management or detailed compliance reporting, will typically add to your monthly cost.
Add-on services also shift the final price. These may include:
- Microsoft 365 backup and recovery
- Intune endpoint management services
- Advanced security features
- Compliance audits or reporting
These additional services provide extra layers of protection and control but need to be factored into your budget.
Licensing and budgeting tips
You should also check if your provider manages licences through a Cloud Solution Provider, or CSP, model or if you are expected to purchase them directly from Microsoft. CSP billing can simplify management by including licence optimisation, seat management, and renewal support.
To budget effectively, align your chosen service tier with your specific risk profile, compliance needs, and required support hours. Do not focus only on the base price. Confirm what is included in the plan, which add-ons create extra costs, and how the provider supports Microsoft 365 licensing optimisation. A clear scope and documented inclusions will help you avoid hidden costs.
Buying through a Microsoft CSP vs direct: what actually changes?
A Microsoft Cloud Solution Provider, or CSP, is a Microsoft partner authorised to sell, bill and support Microsoft 365 licences on Microsoft’s behalf, so a business pays its IT provider directly instead of paying Microsoft. The practical differences are the invoice, who you call when something breaks, and how quickly licences can change, not a fixed price difference either way.
What CSP structurally is. It sits alongside two other ways a business can hold Microsoft 365 licences: buying directly from Microsoft through the online admin portal with a credit card, or, for larger organisations, a Microsoft Enterprise Agreement negotiated directly with Microsoft. CSP is the middle path built for small and mid-sized businesses: a partner, typically the same business’s IT provider, resells and supports the licences under its own Microsoft agreement.
How billing differs. Buying direct from Microsoft is commonly billed in USD, and moves with exchange rate changes even though the business trades in NZD. Buying through a CSP partner puts Microsoft 365 on a single NZD invoice from that partner, usually alongside the rest of the IT bill, with GST handled the normal New Zealand way rather than as a foreign transaction.
What changes day to day. A CSP partner can add, remove or resize licences directly, without the business raising its own support case with Microsoft. Support and escalation run through the partner’s own team rather than Microsoft’s general queue, and licence management sits inside the same relationship as the rest of the business’s IT support instead of being a separate account to manage.
How to tell if a current provider already operates as the business’s CSP. Check where the Microsoft invoice actually comes from: a New Zealand dollar invoice from the IT provider suggests a CSP relationship, a USD charge direct from Microsoft does not. The Microsoft 365 admin center’s billing section shows the account’s “bill-to” partner if one is set. The clearest check is asking the provider directly whether they hold Microsoft CSP status for the account.
What it actually does to cost. There is no fixed CSP markup to quote, because it depends on the partner’s own margin, not a rule Microsoft sets. Most providers do not publish theirs. OxygenIT does: Microsoft licences are supplied at a published margin of 23 percent on every band, itemised on the invoice so it is visible rather than folded into a bigger number. See OxygenIT’s published managed IT pricing for the full band breakdown.
How to choose a Microsoft 365 managed service provider
Selecting the right managed service provider directly impacts your business uptime, data security, and compliance outcomes. For SMBs in New Zealand, the best choice starts with finding a clear match for your operational, security, and governance needs. A good provider will act as a strategic partner, not just a vendor.
Provider capability and coverage
First, confirm that the provider has proven expertise in Microsoft 365 managed services. Look for demonstrated depth in security management, governance, automation, and tenant administration. A capable provider should have extensive experience with managed Microsoft 365 support, conditional access management, and Microsoft 365 compliance management.
Support model and onboarding
Next, check the provider support hours, escalation paths, and on-call options. Ask about helpdesk coverage for Microsoft 365 support services and how urgent issues are resolved. You should also review the onboarding plan, which should include a thorough tenant assessment, a strategic roadmap, and a remediation backlog to address existing issues.
Reporting, contracts, and ownership
Strong providers deliver regular monthly reviews, live risk registers, and transparent reporting on key outcomes. They should be committed to continuous improvement and be able to adjust their services as your business needs grow. Finally, carefully review the contract terms for clear SLAs, a defined offboarding process, and documented admin access ownership.
When shortlisting, use these criteria:
- Capability across security, governance, and automation
- Transparent support and escalation process
- Detailed onboarding and roadmap
- Consistent reporting and risk management
- Clear contracts, SLAs, and admin access records
Choosing a provider with these strengths will help you avoid hidden costs, weak escalation processes, and compliance gaps.
Co-managed vs fully managed M365 services
Co-managed M365 managed services split responsibility between your in-house IT team and the external provider. In this model, your team might handle user support, approvals, and daily queries. The provider then manages tenant administration, advanced security, and complex change control.
This approach is well-suited for SMBs that have some internal IT capacity but need additional expertise and depth. It allows you to leverage your existing resources while benefiting from specialised skills.
Fully managed Microsoft 365 support services are a better fit for leaner SMB operations that need end-to-end coverage from a single partner. In this model, the provider owns all support, change windows, documentation, and policy enforcement. This provides a hands-off solution for businesses that want consistent governance without dedicating internal staff to IT management.
Both models require clear hand-off points for tickets, escalations, and reporting to function effectively. As your business grows, you should review your scaling needs for compliance, device count, and security scope to ensure your chosen model still fits.
Microsoft 365 managed services: frequently asked questions
What is included in Microsoft 365 managed services versus standard IT support?
Managed services include tenant management, security, compliance, user support, and lifecycle tasks, while standard IT support only covers basic helpdesk issues. Our IT support services page explains where that boundary usually sits.
Which Microsoft 365 areas are typically managed?
Providers manage Teams, Exchange, SharePoint, security, identity, and devices, often using Intune endpoint management services alongside broader IT infrastructure services.
How do managed services improve security and compliance?
They apply security baselines, monitor threats, enforce MFA, manage data retention, and support compliance audits.
How is pricing structured?
Pricing depends on users, device scope, security needs, and add-ons like backup or compliance. See our managed IT services pricing guide for typical ranges.
What criteria should SMBs use to shortlist a provider?
Shortlist based on clear scope, SLAs, support quality, security expertise, and reporting transparency.
Improve uptime and risk control with OxygenIT
OxygenIT is Christchurch based and has operated here since 2005. We are ISO 27001 and ISO 42001 certified. To get the most from Microsoft 365 managed services, confirm inclusions for tenant admin, security, compliance, and support. Review pricing drivers, user count, device scope, and add-ons like backup or Intune to avoid hidden scope gaps. A provider with clear SLAs, strong governance, and monthly reporting is essential.
OxygenIT stands out for New Zealand SMBs with an under-15-minute response time and a 98 per cent client retention rate, ensuring your business receives reliable support.
Contact us to discuss your needs and see how we can help protect your operations, or call us on 0800 101 095.
