Right-sizing means building what the next stage of growth needs, without buying for 500 people when you have 30. Each stage below builds on the one before, so the groundwork done at 15 staff is still doing its job at 90.
| Stage | What usually strains | What to put in place |
|---|---|---|
| About 5 to 20 | Shared logins, personal devices, no MFA | One identity per person, MFA, managed and encrypted laptops, a register started |
| About 20 to 50 | Onboarding, access by request, first security questionnaires | Autopilot, role-based groups, the full security baseline, a 24/7 SOC |
| About 50 to 100+ | Budgeting, renewals, evidence for clients and insurers | A quarterly roadmap, lifecycle planning, licence reviews, records to answer from |
Stage 1
About 5 to 20 staff: lay the foundations
- Identity
- Give every person their own account in Entra ID, retire shared logins and enforce MFA. Block legacy authentication with Conditional Access so nothing can sign in around it.
- Devices
- Buy laptops for the business and enrol them in Intune from the start: encrypted, patched and able to be wiped if lost.
- Licensing
- Standardise on one licence set. Our clients use Microsoft 365 Business Premium, which brings the Microsoft 365 apps and Intune together, with Defender for Endpoint P2.
- Security baseline
- Defender for Endpoint P2 on each device and an independent backup of Microsoft 365 held outside the tenant.
- Documentation
- Start the register now, while it is short: admin accounts, licences, devices and supplier details.
- Is a provider worth it yet?
- Under about five staff, break-fix help usually costs less, and we will say so. We mostly work with organisations from about 10 staff upward.
Stage 2
About 20 to 50 staff: make it repeatable
- Onboarding
- Use Windows Autopilot so a laptop ships to the new starter and configures itself at first sign-in. Create accounts, licences and group memberships from a standard list for each role, and close leavers off on their last day.
- Access
- Grant access to SharePoint sites and Teams through groups by team or role, so a new hire inherits the right access and a mover doesn't keep the old one.
- Security expectations
- This is usually when the first client questionnaire or insurer form arrives. Apply the full baseline, attack surface reduction rules included, map it to the ACSC Essential Eight, and put a 24/7 cybersecurity remediation SOC on the alerts.
- Sites and suppliers
- A second office brings another internet service, network and possibly phone system. Keep the account details in one place, with one party who makes the calls.
- Documentation
- Record every change as it is made. At this size, nobody can hold the whole environment in their head.
Stage 3
About 50 to 100+ staff: plan ahead
- Roadmap
- Each quarter, summarise the previous period's projects, gather feedback and line up the next quarter's projects around what the business has planned: hiring rounds, new sites, large clients.
- Lifecycle and budget
- Forecast device replacements and licence renewals from the register, so hardware spend is a budget line set in advance.
- Licence reviews
- Match licences to roles and remove seats nobody uses. Bought at cost, every seat removed is a straight saving.
- Evidence
- Keep restore-test results, the Essential Eight mapping and the register current, so questionnaires are answered from records. Defender for Endpoint P2 also supports App Control for Business, which we audit for and work towards over time rather than switching on at once.
- Visibility
- A 24/7 client portal and a quarterly review give leadership a view of IT without a meeting every week.
Skipped a stage?
Most fast-growing organisations arrive at 50 or 80 staff with stage 1 half done. That is normal, and we often fix it in weeks. The work is the same, done in a compressed order: identity and MFA first, then devices and backup, then documentation and the roadmap.
“We've seen a five-person business, with one person called in for break-fix, grow into an 80-seat company that suddenly needed its IT structured and brought up to standard quickly.”
The first 30 days page shows how that compressed order runs in practice.