Moving Your Business Email to Microsoft 365 — What Actually Happens

"We're migrating your email" sounds like open-heart surgery. In reality, it's a well-rehearsed procedure — and when it's planned properly, most of your team won't notice the moment it happens.

GILAD NURIEL · GILADIT KNOWLEDGE BASE

Why businesses do this at all

Many small businesses still run email on an old local server, or on a cheap hosting package that came bundled with their website. Both work — until they don't. The local server ages and becomes a single point of failure sitting in a closet. The hosting mailbox fills up, gets flagged as spam by other providers, and offers no real security controls.

Microsoft 365 (or Google Workspace — the logic is identical) moves your mail to infrastructure that is backed up, monitored, and secured by a company with thousands of engineers. You stop maintaining a mail system and go back to just using one.

The project, step by step

1. Inventory. We list every mailbox, shared address, distribution list, and forwarding rule. Every migration horror story begins with a mailbox nobody remembered.
2. Licensing. We match each person to the right plan — most staff need a modest license; power users may need more. Buying everyone the top tier is the most common way money is wasted here.
3. Pre-copy. Days before the switch, existing mail is copied to the new mailboxes in the background. Your team keeps working normally; nothing changes yet.
4. The cutover. Usually on a weekend evening, one DNS record (called MX — think of it as your street address for email) is changed to point at Microsoft. New mail starts arriving in the new mailboxes. A final sync catches anything sent in between.
5. Monday morning. Phones and laptops get reconnected — ideally prepared in advance so it's a sign-in, not a setup. A support channel is open all morning for stragglers.

What can go wrong (and how it's prevented)

• The scanner and the accounting software. Office devices and old applications often send email too. They're found in the inventory phase, not on Monday.
• Calendar and contacts. Mail gets all the attention, but calendars are what people panic about. They're migrated and verified explicitly.
• Old links and rules. Inbox rules and shared mailbox permissions are rebuilt, not assumed.

MFA: The Cheapest Security Upgrade You'll Ever Make

Most break-ins to business accounts don't involve any "hacking" at all. Someone simply logs in with a stolen password. Multi-factor authentication makes that stolen password nearly worthless.

GILAD NURIEL · GILADIT KNOWLEDGE BASE

The problem with passwords

Passwords leak constantly — from breached websites, from phishing emails, from the sticky note under the keyboard. Attackers buy lists of leaked passwords and try them on business email accounts automatically, day and night. If one of your employees reused their password on a website that got breached, your business inbox may be one login attempt away from being someone else's.

What MFA actually does

Multi-factor authentication (MFA, sometimes called two-factor or 2FA) adds a second check to the login: something you have, on top of something you know. In practice, that's a prompt on your phone — a tap, or a six-digit code. An attacker on another continent may have the password, but they don't have the phone.

"But my team will hate it"

This is the real obstacle — and it's solvable. A good rollout looks like this:

• Use an app, not SMS. An authenticator app is both safer and less annoying than text-message codes.
• Trusted devices. Configure it so people confirm once per device, not on every single login. Done right, most people see an MFA prompt once every few weeks.
• Roll out in waves. Management first (they're the biggest targets), then team by team, with a two-line explanation of why.
• Prepare for lost phones. Decide in advance how someone recovers access — that's a ten-minute policy that saves a very bad morning.

The 3-2-1 Backup Rule — and Why OneDrive Alone Isn't a Backup

"Everything's in the cloud, so we're covered." It's the most common sentence I hear in first meetings — and the most dangerous one.

GILAD NURIEL · GILADIT KNOWLEDGE BASE

Sync is not backup

OneDrive, Google Drive and Dropbox are synchronization services. Their job is to make sure every copy of your files looks the same everywhere. That's exactly the problem: if a file is deleted, corrupted, or encrypted by ransomware on one computer, that change syncs faithfully to the cloud and to every other computer. The sync service did its job perfectly — and your file is gone everywhere at once.

Recycle bins and version history help, but they have time limits, they can be emptied, and in a real incident they're often not enough. A backup is something different: a separate, independent copy that nothing in your daily environment can touch.

The rule that's survived every technology shift

The rule is older than the cloud, and it translates beautifully to it:

• Copy 1 — the live data your team works on (your Microsoft 365 or file server).
• Copy 2 — an automatic backup to a different system, e.g. a dedicated cloud backup service that snapshots your Microsoft 365 mail and files every night.
• Copy 3 — a copy that is offline or isolated (an encrypted drive rotated out of the office, or immutable cloud storage that even an administrator can't delete for 30 days).

The question that matters more than the backup

Not "do we back up?" but "have we ever restored?" A backup that has never been test-restored is a hope, not a plan. A proper setup includes a scheduled restore drill — pick a random file from three weeks ago and bring it back. If that takes more than a few minutes or fails, you want to find out on a calm Tuesday, not during an incident.

Ransomware, Explained: How It Gets In and How Small Businesses Survive It

Ransomware is not a virus that "happens" to you like weather. It's a burglary with predictable steps — which means each step is a place you can stop it.

GILAD NURIEL · GILADIT KNOWLEDGE BASE

What it is, in one paragraph

Ransomware is software that encrypts your files — turns every document, spreadsheet and database into unreadable noise — and offers to sell you the key. Modern gangs add a second threat: before encrypting, they quietly copy your data out, and threaten to publish it. Small businesses are not too small to be targets; they're targeted because they tend to be less protected.

The anatomy of an attack

1. The way in. Usually a phishing email that captures someone's password, or a forgotten remote-access door left open to the internet. Rarely anything sophisticated.
2. The quiet phase. Days or weeks of looking around: what's valuable, where are the backups, who has admin rights. This is the phase where good monitoring catches them.
3. The strike. Often at night or on a holiday weekend. Backups are deleted first if they're reachable, then everything is encrypted at once.
4. The note. A ransom demand, typically with a countdown timer designed to cause panic decisions.

The four preparations that decide the outcome

• MFA everywhere — closes the stolen-password door, which is the most common entrance.
• An isolated backup — a copy the attacker can't reach even with admin rights (see the 3-2-1 article). This is what turns "pay or die" into "wipe and restore".
• Patched, minimal exposure — no remote desktop open to the whole internet, updates applied on schedule.
• A one-page plan — who unplugs what, who gets called, in what order. Written before, not during.

If it happens anyway

Disconnect affected machines from the network (unplug, don't shut down — the machine's memory can help investigators). Call your IT professional and, if you have one, your cyber insurer. Don't negotiate alone, and don't rush to pay: with good backups, most businesses restore without paying anything.

Office Wi-Fi That Never Drops: How a Proper Network Is Designed

If your video calls freeze near the kitchen and the printer disappears every Tuesday, your network wasn't designed — it accumulated.

GILAD NURIEL · GILADIT KNOWLEDGE BASE

Why the provider's router isn't enough

The box your internet provider installed is built to do one thing: deliver internet to a family apartment. An office asks much more of it: dozens of devices, video meetings, a printer everyone needs, guests who shouldn't see your files, and walls made of concrete. When that box is also your only Wi-Fi antenna, sitting in a cabinet at one end of the office, physics does the rest.

What a designed network looks like

• Coverage is planned, not hoped for. Access points (Wi-Fi antennas) are placed based on the floor plan and the walls — usually on the ceiling, usually more than one. The goal is that no desk is far from a strong signal.
• Wired where it matters. Anything that doesn't move — desktops, printers, TVs in meeting rooms — goes on a cable. Every device you take off the air makes the Wi-Fi better for the laptops and phones that actually need it.
• Separate networks for separate trust. Staff, guests, and gadgets (cameras, smart TVs) each get their own network. A visitor's laptop should get internet — not a view of your accounting share.
• One system, not a patchwork. Access points from one family, centrally managed, so your device hands off smoothly as you walk — instead of clinging to the far antenna while a closer one sits idle.

The upgrade project, simply

A typical office network refresh: a short survey walk with a signal meter, a plan on the floor blueprint, one day of cabling and mounting, and an evening of migration so nobody's workday is interrupted. Old network keeps running until the new one is verified.

VPN vs. Zero Trust: Remote Access, Explained Simply

Your team works from home, the café, or a client's office. There are two philosophies for letting them reach company systems safely — and they think about trust in opposite ways.

GILAD NURIEL · GILADIT KNOWLEDGE BASE

The VPN: a tunnel to the office

A VPN (virtual private network) builds an encrypted tunnel from the employee's laptop into the office network. Once connected, the laptop behaves as if it were plugged in at a desk — it can see the file server, the printer, everything.

That's the strength and the weakness in one sentence. The tunnel is secure, but it's all-or-nothing: whoever gets through the front door is inside. If an attacker steals a VPN password (or the laptop itself), they inherit that same full access. The castle has strong walls and a very trusting interior.

Zero Trust: never assume, always check

Zero Trust flips the logic: being "inside" earns you nothing. Every request — every login to email, every file opened — is checked on its own: who is asking, from which device, is that device healthy and updated, is the request normal for this person? Access is granted per application, not to the whole network.

What this means for a small business

Here's the good news: if your business runs on Microsoft 365 or Google Workspace, you're already halfway to Zero Trust without knowing it. Email, files and Teams are reached directly over the internet, guarded by identity checks — no tunnel needed. What remains is to do it properly:

• MFA on all accounts — the foundation everything else rests on.
• Device rules — company data only opens on devices that are encrypted, locked and updated.
• Per-app access — the bookkeeper reaches the accounting system; they don't get the keys to everything.
• A small VPN where truly needed — some legacy systems still want one; it can serve just that system instead of the whole network.

Why Your Cloud Bill Keeps Growing — and How to Tame It

Nobody in your business ever decided to spend this much on software and cloud. It happened the way cupboards fill up: one small, reasonable purchase at a time.

GILAD NURIEL · GILADIT KNOWLEDGE BASE

Where the money leaks

• Ghost licenses. Employees who left months ago, still paying seats in Microsoft 365, Zoom, the design tool, the CRM. Offboarding rarely includes a subscription sweep.
• Everyone on the top tier. Plans are bought once, for the most demanding user, and applied to all. Most staff use a fraction of what their license includes.
• Duplicate tools. Three note apps, two storage services, and both Zoom and Teams — each adopted by a different team for the same job.
• Forgotten infrastructure. A test server someone spun up in Azure or AWS for a project that ended in 2023, faithfully billing every hour since.
• Sneaky renewals. Annual subscriptions that auto-renew at a higher "standard" price after the first-year discount quietly expires.

The audit, step by step

1. Collect the truth. Pull twelve months of statements from the credit card and every admin console. The card statement always contains subscriptions the admin consoles don't know about.
2. Map licenses to humans. Compare every paid seat against the actual current team. This step alone usually pays for the whole exercise.
3. Right-size the plans. Match license tiers to real usage — most vendors show last-login and feature-usage data if you look.
4. Pick one tool per job. Consolidating duplicates isn't just cheaper; it also means less training and fewer places for data to scatter.
5. Set a renewal calendar. Every contract gets a reminder 30 days before renewal — which is when you have negotiating leverage, not after.

The First Day and the Last Day: Why Onboarding and Offboarding Are Security Issues

A new hire waiting three days for a working email is an embarrassment. A former employee whose accounts still work three months later is a threat. Both have the same cure.

GILAD NURIEL · GILADIT KNOWLEDGE BASE

The chaotic version (sound familiar?)

Someone new starts Sunday. On Sunday morning, the manager remembers. IT (or "the person who knows computers") improvises: an account here, a borrowed laptop there, permissions copied from "whoever does a similar job" — which quietly grants the new bookkeeper access to five years of management folders. Months later someone leaves, and their departure is an email that never reaches anyone responsible for accounts. Their mailbox, their VPN, their file access — all still alive.

The checklist version

Onboarding, triggered the day the contract is signed — not the day the person arrives:

• Account created from a role template — the permissions this role needs, nothing more.
• Laptop prepared in advance: encrypted, updated, signed in once for testing.
• MFA registered during the first hour, with a two-minute explanation of why.
• A named buddy for "where is everything" questions, so IT isn't the tour guide.

Offboarding, triggered by HR the moment a departure is known:

• On the last day: password reset, sessions revoked, MFA devices removed — within the hour, not the week.
• Mailbox converted to a shared archive; a delegate answers ongoing threads. Nothing is deleted in panic.
• Equipment returned against the inventory list (this is where an up-to-date asset list earns its keep).
• A subscription sweep: every SaaS tool checked for the departing name.

Why this is a "project" and not a memo

The checklist only works if it runs the same way every time — which means it's written down, owned by someone, and ideally semi-automated (account creation from templates, a trigger from HR, an automatic task list). Setting that up once is a small project; it then runs for years.

Moving Your Phones to the Cloud: A VoIP Migration, Step by Step

Somewhere in your office there may still be a dusty box on the wall that all the phones connect to. Retiring it is one of the most satisfying small projects in IT — when it's sequenced right.

GILAD NURIEL · GILADIT KNOWLEDGE BASE

The vocabulary, quickly

VoIP means your calls travel over the internet instead of dedicated phone lines. A cloud PBX is the "switchboard" — the thing that routes calls, plays the menu, manages queues — running as an online service instead of a box in your closet. And Microsoft Teams Phone is one popular flavor of this: a real business phone number that rings inside the Teams app your staff may already use, on their computer and mobile alike.

Why businesses switch

• Work from anywhere. The office number answers at home, at a client's site, abroad — no forwarding tricks.
• Real features, small price. Menus ("press 1 for..."), queues, hours-based routing, voicemail-to-email — features that used to require enterprise hardware.
• One less box to die. The old PBX is often the last unmaintained server in the building, and parts for it stopped being made years ago.
• Costs drop — typically meaningfully, especially if international calls are part of your day.

The migration itself

1. Map the current setup. Every number, extension, menu, and "when nobody answers, it rings in the kitchen" rule. The old system's quirks are the real spec.
2. Check the network first. Calls are unforgiving of a weak network. A quick assessment (and sometimes a small router setting called QoS, which gives voice traffic right of way) prevents the "it crackles" phase entirely.
3. Build the new system in parallel. The cloud PBX is configured and tested with temporary numbers while the old phones keep working. Menus and queues are rehearsed here.
4. Port the numbers. Your existing numbers are formally transferred to the new provider. This is a regulated, scheduled process — planned for a quiet day, with the old system as fallback until it completes.
5. Land the change with people. Ten minutes of training per team: how to transfer a call, how to set yourself away. Skipping this is why some migrations feel like failures despite working perfectly.

Copilot and AI in a Small Business: What's Useful, What's Hype, What's Risky

Every vendor now sells "AI inside". Here's an honest map for a small business: where AI already earns its keep, where it doesn't yet, and the two rules that keep it from becoming your next data leak.

GILAD NURIEL · GILADIT KNOWLEDGE BASE

What's genuinely useful today

• Meeting summaries. Tools like Copilot in Teams turn an hour-long meeting into minutes with action items. For teams that live in meetings, this alone can justify the license.
• First drafts. Proposals, replies to routine emails, job descriptions, translations. AI writes the draft; a human makes it true and makes it yours.
• Finding things. Asking "what did we agree with the supplier about delivery times?" and getting an answer drawn from your own mail and documents — this is where Copilot inside Microsoft 365 shines, because it already sits next to your data.
• Repetitive glue-work. Paired with automation tools (Power Automate, Zapier), AI can sort incoming requests, extract details from invoices, and route things to the right person.

What's still mostly hype

Fully autonomous "AI employees", AI that runs your finances, anything promising to replace judgment rather than typing. Today's AI is a brilliant, tireless, occasionally wrong junior assistant. It's confident when it's right and it's confident when it's wrong — the same tone in both cases. Plan for review, not blind trust.

The two rules that prevent the horror stories

1. Decide where company data may go. Free consumer chatbots may use what your team pastes into them for training. The fix isn't banning AI — that just drives it underground. It's providing an approved tool (business versions with proper data commitments) and a one-page policy: what's fine, what never leaves the company.
2. Fix permissions before switching Copilot on. AI that searches "everything you have access to" will faithfully surface the salary spreadsheet that's been over-shared since 2021. A quick permissions review before rollout turns this from a lurking embarrassment into a non-event.