A new tax practice, set up cloud-only from its first weeks

Managed IT
Microsoft 365
Security

A new tax practice came to us three weeks after it was incorporated. Four people, no office IT and nothing to migrate, but client tax records arriving from the first engagement. That made it the chance to set everything up properly from the start, rather than fix it later.

It’s the setup we now recommend to any new or growing practice: everything in Microsoft 365, nothing on premises, and every device owned and managed by the business.

The challenge

A new practice holds the same sensitive data as an established one: tax records, bank details and identity documents for every client. It needs the same protection, without an IT team, an office server or the budget for either.

The partners wanted to take on clients straight away, work from wherever they were, and not have to think about IT while they did.

What we set up

Microsoft 365 as the whole platform. Email, files, meetings and calls in one place, with no servers to buy, patch or keep in a cupboard.
A Cloud PC for everyone. Each person works on a Windows 365 Cloud PC: a full Windows desktop that runs in Microsoft’s data centres and is reached from a company laptop. Client files are reached only from the Cloud PC or a managed company phone, not from the laptop itself.
Company-owned devices only. Laptops and phones are bought by the practice, enrolled in Intune and kept up to date automatically. No personal device touches client data.
Sign-in that’s hard to abuse. MFA on every account, older sign-in methods that get round MFA blocked, and sign-ins that look risky challenged or stopped automatically. Reaching client data needs a managed device as well as the right password and second factor.
Threat protection on every device and account.
Email that’s hard to fake. SPF, DKIM and DMARC set up when the domain went live, so it’s much harder for anyone to send email pretending to be the practice.
Phones in Teams. The practice’s numbers ring in Teams, so calls reach people wherever they’re working.

How we did it

We started from our standard setup, the same sign-in rules and device settings we use for every client, and fitted it to a practice of four. Because there was nothing to move across, the work was all configuration: the Microsoft 365 tenant and its security policies first, then email and the domain’s records in October 2024, then the devices.

We’ve run it day to day since: new starters, devices, updates, and the questions a growing practice brings.

Why it matters

Starting cloud-only costs far less than getting there later. Most practices we meet arrive with a server in a cupboard, client files on personal laptops and a tangle of logins to unpick. A new practice can skip all of that.

If you’re starting or growing a practice, this is the moment to get the foundations right, before they’re hard to change. Our managed IT page sets out what’s included, item by item.