Here's how Microsoft 365 usually arrives in a business. Someone buys the licences. Everyone gets email in Outlook. Teams goes in during a busy month and people start chatting and sharing files there. And then… that's it. The sign-in page is Microsoft's default. The top bar is Microsoft blue. SharePoint, the part that's meant to hold your company's documents, is either empty or a tangle of sites nobody planned.
None of that is unusual, and none of it means you chose the wrong product. It means Microsoft 365 was switched on but never set up. Those are different things, and the gap between them is where files get lost, the wrong people see the wrong documents, and new starters spend their first week asking where everything lives.
This guide is for two groups of people:
- —You're about to start with Microsoft 365 (or just have) and want to set it up right the first time, rather than fixing it in three years.
- —You've used it for a while, but it still looks and works the way it did on day one, and you suspect you're paying for a lot you're not using.
Below is the checklist I work through when I set up Microsoft 365 for a company. You don't need to do it all at once, but every business benefits from each step.
1. Plan your site structure before you create anything
SharePoint is made of sites, and every Microsoft Team quietly creates one. Without a plan, you end up with dozens of sites named after projects, people and one-off meetings, and nobody knows which one is “the real one”.
Instead, sketch it on paper first. A structure that works for most small and mid-sized businesses:
- —One home site for the whole company: policies, forms, announcements and a “start here” guide.
- —One site per function that works with its own documents: for example Administration, Finance or Purchasing, Sales, and Projects. Organise by what the work is, not by who's doing it today.
- —Join them to a hub, so every site shares one menu and one look. People can move between departments without hunting for links.
You're done when: anyone in the company can answer “where would I save this?” without asking.
2. Give sensitive documents their own locked-down space
Contracts, insurance, HR files, board papers: these shouldn't live in a folder inside the general company site with “special permissions” on it. Folder-level permissions are easy to break and hard to check.
Put them in a separate restricted site instead. Keep it out of the hub menu so it isn't advertised to everyone. Limit it to the people who need it, and stop members from sharing files onward. Then test it: sign in with an account that shouldn't have access and confirm it really can't get in. Most businesses skip this test, and it's the only way to know the lock works.
3. Set permissions by group, not by person
Giving access to individuals one at a time feels quick, but within a year nobody can say who can see what. Use permission groups instead, with names that explain themselves (for example “Projects – Members” or “Finance – Owners”). When someone joins or leaves, you change one group membership, not twenty folders.
- —Avoid the built-in “Everyone” and “Everyone except external users” groups for anything that isn't truly company-wide. They're the most common cause of documents being visible to people who shouldn't see them.
- —Give every site at least two owners, so access requests don't stall when one person is on leave.
- —Write the groups down. A simple table of site, group and who's in it is enough.
4. Use a few columns instead of endless folders
Folders force every document into one place. But a supplier invoice belongs to a vendor, a month and a project. Columns (SharePoint calls this metadata) let you tag a file with all three, then sort, filter and group however you need.
You don't need many. Start with three to five that match how people actually look for things: document type, client or vendor, status and year cover most businesses. Then create saved views that answer everyday questions with one click: “open quotes”, “active projects”, “invoices by vendor”.
If you've already got years of folders, you don't have to throw them away. I wrote about fixing that in Your SharePoint is 5 years old and nobody can find anything.
5. Give repeat work a standard workspace
If your business runs the same kind of job again and again (a client, a project, a tender, a new hire), every one of them should get the same folder layout. Same subfolders, same names, same place. Give each one a reference number, and link related work together (a won quote linked to the project it became, for example).
It sounds small. In practice it's the difference between “check Sarah's folder, she might have saved it under the client's old name” and knowing exactly where the signed contract is for any job, past or present.
6. Make the home page useful on day one
Your home site should answer the questions people ask most. Think about what staff ask HR, admin or their manager every week, and put the answer one click away:
- —Current company policies and forms, in one place, latest version only.
- —Quick actions for common requests, such as submitting an expense or requesting a purchase order.
- —A “start here” page for new joiners: where things live, who to ask, which tools to use for what.
7. Put your brand on it
Branding isn't vanity. When the sign-in page, the top bar and the intranet all carry your company's look, staff trust it, use it, and are more likely to notice when a fake sign-in page doesn't look right. There are three places to brand:
- —The sign-in page: your background, logo and a short message, set in the Microsoft Entra admin centre under company branding (what's available depends on your licences).
- —The Microsoft 365 top bar: your colours and logo across Outlook, Teams, SharePoint and the other apps, set in the Microsoft 365 admin centre under Settings → Org settings → Organization profile → Custom themes.
- —SharePoint: a theme built from your logo colours, plus site logos and header images, so every site feels like part of one company.
8. Cover the security basics
A well-organised tenant still needs the doors locked. These are the essentials every business should have in place, however small:
- —Multi-factor authentication (MFA) for everyone, including the boss and the admin accounts. If you have nothing else, Microsoft's “security defaults” switch this on for the whole organisation.
- —Sensible sharing settings. In the SharePoint admin centre, make the default sharing link “specific people” rather than “anyone with the link”, and decide deliberately whether guests can be invited.
- —Separate admin accounts, or at least as few global admins as you can manage with, and never fewer than two.
9. Write down what you built
The most overlooked step. Six months after setup, someone will ask why a site exists, who owns it, or how a permission was meant to work, and the person who set it up may have moved on. Keep a simple record: the sites, their owners, the permission groups, the columns and the settings you changed.
For larger setups I go a step further and script the whole build (with PnP PowerShell), so the setup can be checked, repeated or rebuilt exactly. You don't have to go that far, but you do need something written down.
Already using Microsoft 365? Start here
If your tenant has been running for a while, don't try to do all nine steps at once, and don't start by deleting things. A safer order:
- —Lock the doors first: MFA and sharing settings (step 8). They're quick and protect everything else.
- —Find out what you have: list your sites and who owns them, and see where sensitive files actually live today.
- —Move the sensitive files into a restricted space (step 2).
- —Build the home site and the hub (steps 1 and 6), so people have one front door even before everything behind it is tidy.
- —Then restructure one department at a time, adding columns and standard workspaces as you go, so nobody's work stops.
Common mistakes to avoid
- —Letting every Team become its own filing system with no plan for where company-wide documents live.
- —Copying the old shared drive across as-is. You keep every old problem, now in the cloud. (More on that in 5 signs your business has outgrown shared drives.)
- —Keeping shared work in personal OneDrive. When that person leaves, the files go with their account.
- —Buying more software before using what you already pay for. Depending on your plan, Microsoft 365 already includes tools like SharePoint lists, Forms, Planner and Power Automate, which cover a lot of what businesses buy separately.
What this looks like in a real company
I recently did exactly this for a technology services company in Houston. They had Microsoft 365 but nothing set up: the default blue bar, the standard sign-in page and an empty SharePoint. They now have seven sites on one hub, a locked-down records site tested with a no-access account, a numbered workspace for every sales pursuit and project, 36 metadata columns, 21 permission groups, and their branding from the sign-in page to every site. The whole build is scripted, so their IT lead can maintain it or rebuild it.
You can see the full before-and-after, with screenshots, in the case study.
Microsoft 365 is one of the best-value tools a business can own, but only once it's set up to match how your business works. Whether you're starting from scratch or living with years of “we'll sort it later”, the steps above are the foundation. Get them right, and everything you add later, from automated approvals to Copilot, works better on top of them.
