Over about six weeks I sat down with three businesses that had the same setup underneath. A small services business with four staff, where each person paid for their own personal Microsoft 365 plan. A solo financial planner keeping business files on his family plan. And a sole trader with all his work in a personal OneDrive.
None of them had done anything silly. Personal Microsoft 365 is what you buy when you start out on your own, and it works fine right up until there's a second person, someone leaves, or a compliance question comes up.
Who owns the account
On a personal plan, the account belongs to the person who signed up. So do the files in it.
In the four-person office, that meant each staff member's email, OneDrive and documents sat in an account the business had no say over. If one of them left, their files would walk out the door with them. Nobody could reset a password, switch on two-factor for everyone, or set up a new starter. Each person was their own IT department.
A business plan flips that around. All the accounts sit in one tenant, which is just Microsoft's word for your business's own space, with one admin panel and one monthly bill. When someone leaves, you block their sign-in and their mailbox and files stay with the business. Adding a new starter takes a few minutes from the same panel.
The financial planner
His setup had a few more layers. Business files lived on the personal family plan. He shared them with an overseas paraplanner by emailing links, and those links had no access controls, so anyone holding the link could open the file.
His email was hosted somewhere else again. When we went through it, we couldn't confirm two-factor was on, and the password reset went to a personal Gmail address. That Gmail account was effectively the key to his business email.
His compliance manager had already raised the Essential Eight, the Australian Cyber Security Centre's baseline for protecting against common attacks. Several of those controls, like multi-factor authentication and restricting admin access, are hard to show when your business data is spread across a family plan, an outside email host and a personal Gmail. Moving onto a business tenant gives you one place to set them and one place to show they're set.
The sole trader
This one was easy. We added his business account to OneDrive on his laptop through the cloud icon in the system tray (Settings, then Account, then Add an account). That gave him two OneDrive folders side by side, personal and business. Then he dragged his business files across.
His personal files stayed where they were. His business files now sit in an account that belongs to the business. Job done.
What to check in your own business
Open Outlook or OneDrive and look at the account name. If it's a Hotmail, Outlook.com or Gmail address, or the plan says Personal or Family, the business doesn't own that data. That's a two-minute check, and I'd do it today.
Our guide to picking a Microsoft 365 plan for a small business covers which business plan suits which setup. If you'd rather someone moved it across for you, that's part of our Microsoft 365 setup work.