Microsoft 365 for South African SMEs — Complete 2026 Guide

Which Microsoft 365 plan is right for us?

Microsoft's plan matrix looks intimidating, but for South African SMEs the decision usually comes down to four options:

• Business Basic — cloud email, Teams, OneDrive, web-only Office. Suits businesses whose staff live in a browser.
• Business Standard — everything in Basic plus installed Word, Excel, Outlook, PowerPoint. The default for most SA SMEs.
• Business Premium — Standard plus Intune (device management), Defender for Business (endpoint protection), Autopilot (zero-touch laptop deployment) and Azure AD Premium P1 (conditional access). The right baseline for anyone taking security seriously.
• Enterprise (E3 / E5) — required once you exceed 300 users, and worth considering earlier if you need advanced compliance, eDiscovery or Defender for Identity.

Frontline plans (F1/F3) exist for shift workers, retail floor staff and warehouse teams who share devices — worth exploring if you have deskless workers.

Rand pricing signals (2026)

Microsoft prices M365 in rand via Cloud Solution Providers (CSPs) on an annual commit. Approximate street pricing at time of writing:

• Business Basic — R120 per user per month
• Business Standard — R250 per user per month
• Business Premium — R430 per user per month
• Enterprise E3 — R680 per user per month
• Enterprise E5 — R1,150 per user per month
• Frontline F3 — R150 per user per month

Two things change the total: your CSP's margin (usually 5–15%) and whether you're on monthly or annual commit. Monthly commit costs about 20% more but lets you flex licence counts every month — useful for seasonal teams.

The security baseline every SA SME should hit

These are the eight settings 1ICT applies on every new managed tenant. If your current provider hasn't done them, that's a conversation:

1. MFA enforced for every user, no exceptions — via Conditional Access, not per-user MFA.
2. Legacy authentication protocols (POP, IMAP, SMTP basic auth) blocked.
3. Global Admins limited to two named accounts, both cloud-only, both MFA-hardware-key protected.
4. Defender for Office 365 Safe Links and Safe Attachments turned on.
5. Anti-phishing policy with impersonation protection for the CEO, CFO and finance team.
6. Intune enrolment required for every device that touches company data.
7. Third-party M365 backup running with restore tested quarterly.
8. Audit log retention set to the maximum available on your licence.

Migration approach that doesn't break the business

Whether you're coming from Google Workspace, on-prem Exchange, cPanel mail, or a fragmented mix — the shape of a safe migration is the same:

1. Discovery (week 1): mailbox count, sizes, distribution lists, shared mailboxes, mobile devices, integrations.
2. Tenant staging (week 2): tenant provisioned in South Africa North, domain verified, licences assigned, security baseline applied before any user is created.
3. Coexistence + pilot (week 2–3): IT and one pilot department cut over, mail flow tested both directions.
4. Cut-over (a Friday evening): DNS switches, remaining mailboxes finalise, staff pick up on Monday with a working laptop and a one-page cheat sheet.
5. Hyper-care (week 4): daily stand-up, walk-in support, close every ticket, hand over to steady-state managed IT.

Five gotchas that cost SA businesses real money

• Buying Basic then bolting on security. Business Premium costs less than Basic + Defender + Intune + AAD P1 bought separately.
• Assuming Microsoft backs up your data. They don't. Retention is not backup.
• Letting an ex-employee's mailbox stay licenced for months because nobody owns offboarding. Convert to a shared mailbox (free) or archive properly.
• Signing an annual commit for headcount you don't have yet. Match commits to actual staff; use monthly commit for the buffer.
• Ignoring Microsoft's Secure Score. It's a free scorecard that tells you exactly where you're weak. Target 70%+ within 90 days.

Frequently asked questions