Microsoft 365
The licence was never the hard part.
Microsoft 365 management is part of Managed IT and Co-Managed IT, not a separate product. Layer3 standardises and monitors tenant policy, tracks Secure Score to an agreed target and backs up Microsoft 365 data independently of Microsoft's native retention. It requires Microsoft 365 Business Premium or above; Business Basic and Standard do not include the controls this page describes.
Bundled
Part of Managed IT and Co-Managed IT, not sold on its own
Business Premium+
The licensing floor this level of management requires
80%
Secure Score target, tracked every vCIO review
Annual to quarterly
Review cadence - annual at Protect, quarterly at Sentinel
01
The case for change
Microsoft 365 ships with real security and governance capability, and most tenants use almost none of it. Nobody owns the drift, nobody is watching the score move, and nobody has checked whether "Microsoft backs it up" is actually true.
Configuration
Conditional access, Defender for Business and Intune all ship inside Business Premium. Left at Microsoft's defaults, most of what you're paying for sits switched off.
Drift
One admin changes a setting to unblock a user, another adds an exception for a vendor, and six months later nobody can say what the baseline actually is any more.
Backup
Microsoft's own retention is short-window and built for litigation holds, not recovery. A deleted SharePoint library or a compromised mailbox can outlast it.
What's included
Part of Managed IT and Co-Managed IT for every customer on Business Premium or above - none of this is an add-on.
Onboarding, offboarding, licence assignment and mailbox management handled as routine, not a ticket queue.
A defined tenant security baseline, deployed and monitored for drift across every user, device and workload.
Tracked continuously against an 80% target and reported at every vCIO review, not measured once and left.
Sign-in policy enforced by role, device and risk level, not left at whatever Microsoft ships by default.
Sharing, guest access and site sprawl kept inside a policy someone actually owns.
Phishing, spoofing and domain-impersonation controls layered on top of Microsoft's own filtering.
Independent backup for mailboxes, SharePoint, OneDrive and Teams, retained to a policy Layer3 sets, not Microsoft's default.
Retention labels and DLP policy aligned to what your industry and your customers actually require.
Unused and duplicate licences found and removed, and licence tier matched to what each role actually needs.
How it is managed
Policy management and backup are both run on dedicated platforms, not through the Microsoft admin centre by hand.
01
Tenant security policy is deployed and monitored through Inforcer, a platform built for standardising Microsoft 365 configuration across a tenant. It's how baseline drift gets caught in days, not at the next audit.
02
Microsoft 365 data is backed up independently through Cove, with retention set to Layer3's policy rather than Microsoft's short-window default - so a deleted mailbox or a corrupted SharePoint library is a restore, not a loss.
Service levels
Target
80%, tracked continuously against Microsoft's own scoring model.
Cadence
Reported and actioned at every vCIO review - annual at Protect, quarterly at Sentinel.
Owner
Movement and remediation priorities are a standing input to your vCIO roadmap, not a one-off audit.
Floor
Microsoft 365 Business Premium or above.
Why
Conditional access, Intune and Defender for Business aren't in Business Basic or Standard.
Below the floor
We'll tell you plainly if a licence upgrade needs to happen before this level of management is possible.
The stack behind it
Two of these carry the argument on this page; the third is part of the wider stack.
Questions
Wondering how this fits with your existing plan? Here's what customers ask before we start.
Book a discovery call
Layer3 is a managed IT provider operating an ISO/IEC 27001-certified ISMS, with offices across New Zealand.
Contact
0508 LAYER3 Book a discovery call Service status Notices
Level 2, CBD Towers
84-90 Main Street
Upper Hutt, Wellington 5018
© 2026 Copyright Layer3.
Layer3
Book a discovery call - 30 minutes, no obligation