Microsoft 365 Business Premium SME

Role & responsibilities

Assess and plan

• Review the current Business Premium configuration, licences, policies, integrations and security posture.
• Map the move from E3, including capabilities gained, retained or lost, unused Business Premium features and any justified add-ons.
• Identify material gaps, risks, dependencies and quick wins.
• Build a ranked delivery plan and agree priorities with stakeholders.
• Review the current virtual desktop, directory and device management setup, and the existing process for retaining leaver mailbox data.
• Own Microsoft 365 design and configuration. Routine user support remains with the operations team.

Build and deliver

• Device management: Intune enrolment, configuration, compliance, application deployment and update controls for Windows, macOS and Azure Virtual Desktop.
• Identity and access: user lifecycle, multifactor authentication, Conditional Access, administrative roles and guest access.
• Security: Microsoft Defender for Business, Defender for Office 365 Plan 1, endpoint protection and alert tuning.
• Data protection: sensitivity labels, retention, Data Loss Prevention for Exchange, SharePoint and OneDrive, eDiscovery Standard and Audit Standard.
• Collaboration: Exchange, Teams, SharePoint and OneDrive configuration and governance.
• Automation and self-service: group-based access, workflows, scripts and reporting.
• Licensing boundaries: document requirements that need add-ons, enterprise capabilities or a different operating control.
• Virtual desktop and identity modernisation: move Azure Virtual Desktop and related devices from hybrid Active Directory to cloud-native Microsoft Entra ID and Intune management, including Group Policy migration.
• Mailbox retention and offboarding: design and implement a governed Microsoft 365 process for retaining and accessing leaver mailbox data, aligned with retention and audit requirements.

Run safely

• Test, release and roll back changes through change control.
• Monitor delivered controls and resolve implementation issues.
• Keep settings aligned with agreed security baselines and regulatory requirements.

Govern and sustain

• Establish periodic access reviews with named owners, evidence and tracked remediation.
• Use available Business Premium capabilities and recommend additional licensing only where native automation or broader governance is justified.
• Establish licence, guest-access and external-sharing reviews.
• Define controls for inactive accounts, devices and groups.
• Create reports and dashboards that show control health and audit evidence.
• Run the first agreed control cycles and fix weaknesses found.

Document and hand over

• Write runbooks, as-built documents and user guidance.
• Train named team members to operate each delivered area.
• Contribute to related Microsoft 365, end-user computing, identity and security priorities during the six-month term.

Deliverables

• Current-state and E3-transition review with findings, risks, quick wins and licence boundaries in the first month.
• Agreed and ranked improvement plan focused on using Business Premium effectively.
• Agreed controls built, tested and released with change records and rollback plans.
• Virtual desktop and leaver mailbox processes moved to governed, cloud-managed Microsoft 365 controls.
• Repeatable governance processes in place, including the first agreed access review cycle.
• Reports that show control health and provide audit evidence.
• Current runbooks, as-built documents and a trained owner for each delivered area.

Preferred candidate profile

Must have

• At least seven years of hands-on Microsoft 365 administration, including strong Business Premium experience.
• Experience delivering Microsoft 365 work from assessment and design through release and handover.
• Experience managing Windows and macOS devices with Intune.
• Strong identity, access and security skills across Microsoft 365.
• Experience with Azure Virtual Desktop and with migrating from hybrid Active Directory to Microsoft Entra ID and Intune, including Group Policy migration.
• Experience in a regulated industry and a clear understanding of audit evidence and compliance needs.
• Automation experience using PowerShell and Microsoft Graph.
• Clear written and verbal communication with technical and non-technical stakeholders.
• Ability to work independently and own outcomes.

Nice to have

• Relevant Microsoft certifications.
• Experience applying ISO 27001 or CIS Benchmarks to Microsoft 365.
• Experience with Exchange Online retention and eDiscovery, and with Power Automate.