The short answer

Choose the right plan for each person, add and verify your own domain, add the DNS records Microsoft gives you, create one account per person, switch on multi-factor sign-in, turn on DKIM, set up shared mailboxes and shared files, and keep at least two admin accounts. Then move any old email across.

1. Choose plans per person

Licences are per user, and you can mix plans in one account. Someone who only needs email may not need the desktop Office apps; someone who builds complex spreadsheets does. Check Microsoft’s UK website for current plans before you buy.

2. Add and verify your domain

In the Microsoft 365 admin centre, add your domain (for example yourcompany.co.uk). Microsoft asks you to add a TXT record at your DNS provider to prove you own it. Use your own domain from the start: addresses ending in onmicrosoft.com are for setup only.

3. Add the DNS records

Microsoft lists the records it needs: an MX record so email is delivered to Microsoft 365, an autodiscover record so Outlook sets itself up, and an SPF record. If your domain already has an SPF record, for example for a website form or newsletter tool, combine them into one. A domain must have only one SPF record.

4. Create one account per person

Give every person their own account rather than sharing a login. It keeps a record of who did what and lets you remove someone cleanly when they leave. For addresses like info@ or accounts@, use a shared mailbox, which several people can use and which does not need its own licence.

5. Switch on multi-factor sign-in

Multi-factor sign-in stops most attacks that rely on a stolen password. For a small business, Microsoft’s “security defaults” switch it on for everyone in one step. Ask each person to set up the Microsoft Authenticator app on their phone.

6. Turn on DKIM

DKIM for your own domain is not always switched on automatically. In the Microsoft Defender portal, add the two DKIM records it shows you to your DNS, then enable DKIM for the domain. Then add a DMARC record; our guide on what DMARC is and how to set it up explains how.

7. Set up shared files

Keep company files in SharePoint or a Teams team rather than in one person’s OneDrive, so they stay with the business when people leave. Use OneDrive for each person’s own working files.

8. Keep two admins and plan for backups

Have at least two people who can get into the admin settings, so you are never locked out. Microsoft keeps deleted items for a limited time, but that is not the same as a backup. Decide whether you need a separate backup of email and files.

Check your work

Run our free email check on your domain to confirm MX, SPF, DKIM and DMARC are in place. If you would rather have it done for you, see Microsoft 365 setup for UK small businesses. Still deciding between platforms? Read Microsoft 365 or Google Workspace.