Managed Microsoft 365 for Northern Virginia Businesses
The security controls you already pay for, actually turned on, plus clean onboarding, offboarding and licensing.
Your Microsoft 365 tenant should protect every sign-in, mailbox and file without your staff having to think about it.
Most small business tenants already include those controls in their licensing and have never had them configured, usually because a reseller or a busy employee set the tenant up years ago and nobody has reviewed it since. DistrictConnects sets up, secures and manages Microsoft 365 for offices across Northern Virginia, and the same team handles your migrations, Intune device management and email security.
- 100+DMV businesses supported
- 300User limit on Microsoft 365 Business plans, per Microsoft
- 99%+Of password spray attacks use legacy sign-in, per Microsoft
What goes wrong in a tenant nobody manages
Most tenants we review were set up once, during a move or by a reseller, and then left alone. The gaps are rarely obvious until an account is taken over or an insurer asks for proof.
- MFA with holes. MFA is on for most people but not for shared mailboxes, service accounts or the owner who asked to be excluded, and those are the accounts attackers try first.
- Legacy sign-in still open. Older protocols cannot do MFA. Microsoft reports that more than 99 percent of password spray attacks use them (Microsoft Learn).
- Former staff still active. Accounts and licenses stay on after people leave, and their phones keep syncing company mail.
- Too many Global Administrators. Everyone who once needed to reset a password became a full admin, and none of those accounts are separate from daily email.
- Laptops and phones nobody can see. Company data sits on devices that IT cannot encrypt, patch or wipe.
- Insurance answers that are not true. Cyber insurance applications ask about MFA, Conditional Access and device management. Ticking yes for controls that were never configured can put a claim at risk.
You may already own the fix. Microsoft 365 Business Premium includes Defender for Business and Defender for Office 365 Plan 1, plus Entra ID P1 and full Intune.
One team for the whole Microsoft 365 stack
Identity, devices, email and data protection depend on each other, so we run them together instead of as separate projects.
- Devices. Intune and Defender encrypt, patch and wipe every laptop and phone, and cut off any device Defender marks as compromised.
- Moves and clean-ups. Microsoft 365 migration covers GoDaddy defederation, Google Workspace and on-premises Exchange moves without losing mail.
- Email. Email security tunes phishing and impersonation protection and puts SPF, DKIM and DMARC on your domain.
- Recovery. Backup and disaster recovery keeps a separate copy of your mail, files and Teams that ransomware cannot reach.
What is included
Identity and sign-in security
Microsoft Entra ID configured properly: MFA on every account including shared mailboxes, Conditional Access by user, device and location, legacy authentication blocked, passwordless options with Windows Hello or the Authenticator app, and alerts on risky sign-ins.
Admin accounts locked down
Separate admin accounts used only for admin work, protected by MFA, with no more than a few Global Administrators. Two emergency break-glass accounts are kept so a policy mistake can never lock you out of your own tenant.
Onboarding and offboarding
Users built from groups by role and location, so licenses, mailboxes, Teams and SharePoint access apply automatically on day one. When someone leaves, we disable the account, revoke sessions, transfer OneDrive and mailbox data and document it for your records.
Email protection
Anti-phishing, Safe Links and Safe Attachments tuned for your business, impersonation protection for owners and finance staff, and SPF, DKIM and DMARC on your domain. Details on our email security page.
Teams, SharePoint and OneDrive structure
Teams and channels with clear owners, SharePoint libraries with permissions set by group, OneDrive sync standards and external sharing rules for clients and vendors, so files stop living in personal folders and email attachments.
Device management
Company laptops and phones enrolled in Microsoft Intune with encryption, patching and remote wipe, new PCs set up through Windows Autopilot, and personal phones protected at the app level. See our Intune and Defender page.
Microsoft 365 backup
Microsoft keeps your service running, but its retention is not a backup you control. We back up Exchange, OneDrive, SharePoint and Teams separately, with retention of 7 years or more where your industry requires it.
License review and reporting
The right plan for each person, licenses removed from former staff, and a regular review of sign-in logs, alerts and Secure Score. Clients on managed plans get quarterly business reviews with a vCIO who plans the next steps with you.
How the work runs
Free tenant review
We look at your admin roles, MFA coverage, Conditional Access, legacy sign-in, licenses, inactive accounts, sharing settings and DNS, then walk you through what we found in plain English. You get a written list of gaps and an itemized quote.
Plan the policies
We agree who needs which plan, how groups map to your departments and locations, which devices and countries are allowed to sign in, and how shared mailboxes, service accounts and older printers or scanners will be handled.
Run in report-only mode
Conditional Access policies start in report-only mode, so we can see exactly who and what they would block before anything is enforced. Break-glass accounts are created first.
Enforce group by group
Policies switch on one group at a time, starting with a pilot. Staff get a short guide for MFA registration and we are on hand, remotely or on-site, for the first sign-ins.
Document and hand over
You receive the policy list, admin accounts, group structure, license map and the onboarding and offboarding checklist, so nothing about your tenant depends on one person's memory.
Manage and review
We handle user changes, alerts, license changes and Microsoft updates month to month, and meet with you quarterly to review security, costs and what is coming next.
Platforms we work with
- Microsoft 365
- Microsoft Intune
- Microsoft Defender
- Dell
- Lenovo
Industries we do this for
Related guides
Service area
On-site across Northern Virginia and DC.
Prince William
- Manassas
- Haymarket
Arlington and Alexandria
- Arlington
- Alexandria
DC and Maryland
Common questions
What is Microsoft Entra ID?
Entra ID, formerly Azure Active Directory, is Microsoft's cloud identity service. It decides who can sign in to your business systems, from which devices and locations, and to which apps. It runs single sign-on, multi-factor authentication and Conditional Access for Outlook, Teams, SharePoint and OneDrive, and for many third-party apps such as QuickBooks Online, Salesforce, Zoom and DocuSign. Every Microsoft 365 tenant has it. Most have never had it properly configured.
Do we need Business Premium, or is Business Standard enough?
Business Standard gives your team email, Teams, Office apps and file storage. Business Premium adds the security: Entra ID P1 for Conditional Access, Intune for device management, Defender for Business on laptops and Defender for Office 365 Plan 1 for email. You can mix plans in one tenant. Many offices put Premium on owners, finance, HR, admins and remote staff first. We size this per person during the free tenant review.
Is Microsoft 365 secure out of the box?
Only partly. Every tenant gets basic spam and malware filtering, and Microsoft's security defaults turn on MFA prompts and block legacy sign-in. Conditional Access, device compliance, impersonation protection and alerting all need setting up, and several need Business Premium or an add-on. Tenants created years ago through a reseller often have none of it switched on, even when the licenses are already paid for.
Will our staff get locked out when you turn on MFA and Conditional Access?
No. We create two emergency break-glass accounts first, then run every Conditional Access policy in report-only mode to see who and what it would block. Older devices such as copiers that send email with a password are moved to a supported method before enforcement. Policies then switch on one group at a time, with staff guided through MFA registration remotely or on-site.
Does Microsoft back up our email and files?
Microsoft keeps the service available and protects against its own hardware failures, but it is not a backup you control. Deleted items, retention policies and recycle bins have time limits, and ransomware or a disgruntled user can delete or encrypt data that then syncs everywhere. We back up Exchange, OneDrive, SharePoint and Teams to separate storage, with retention of 7 years or more when your industry requires it.
How much does managed Microsoft 365 cost?
It depends on the number of users, which plans they need, how much of the tenant needs fixing first, and whether you also want device management, backup and email security managed for you. We do not publish prices. You get a free tenant review, then an itemized quote that separates Microsoft licensing from our work. Plans are month to month, with no long-term contract.
Is our business too small for this?
No. Any office with about 5 or more users gains from central sign-in, MFA and a proper offboarding process, and medical, dental, legal and accounting offices have compliance reasons to do it earlier. Microsoft 365 Business plans are built for up to 300 users, so a small office gets the same identity controls as a large company, configured for how a small team actually works.
Should we use Microsoft 365 or Google Workspace?
Both work well. Microsoft 365 fits offices that rely on Windows PCs, the Office desktop apps and tight control over devices and sign-in through Entra ID and Intune. Google Workspace suits browser-first teams. We manage both, and when a move makes sense we migrate mail, files, calendars and accounts with a planned cutover. See our Microsoft 365 migration page for how that works.