CRM and business systems · Microsoft 365

Secure Microsoft 365 workplace, ready for Copilot

A Microsoft 365 tenant for councils and small organisations that is safe before AI arrives: Entra ID with Conditional Access, Intune-managed devices, Purview labels and DLP, oversharing cleaned up, and a backup copy outside the tenant.

A reference architecture from EITSAA, not a named client system. Service limits, prices and product features change, so confirm current details before you commit to a design.

  • ACSC Essential Eight
  • SA ISMF information classification and access control expectations
  • Australian Privacy Principles
  • State Records Act 1997 (SA) recordkeeping

Architecture

Architecture diagram. Tinted boundaries show regions, accounts, networks and trust zones. Numbered arrows match the flow below.
Secure Microsoft 365 workplace, ready for Copilot architectureStaff to Entra ID: sign in. Entra ID to Conditional Access: evaluate. Intune to Conditional Access: compliant?. Conditional Access to Exchange Online and Teams: token. Conditional Access to SharePoint and OneDrive: token. Microsoft 365 Copilot to SharePoint and OneDrive: permission-trimmed. Microsoft Purview to SharePoint and OneDrive: labels, DLP. Defender for Office 365 to Exchange Online and Teams: filter. SharePoint and OneDrive to Microsoft 365 backup: backup. Guests to Conditional Access: guest policyStaff and devicesIdentity and devicetrustMicrosoft 365 tenant ·Australian datacentresBackup (separateprovider)StaffLaptop, phone, browserGuestsSponsored, expiringEntra IDSSO, MFA, passkeysConditional AccessDevice, risk, locationIntuneCompliance, app protectionExchange Online andTeamsMail, chat, meetingsSharePoint andOneDriveSites, files, sharingMicrosoft 365 CopilotWithin each user's accessMicrosoft PurviewLabels, DLP, retentionDefender for Office365Phishing, attachments, linksMicrosoft 365 backupImmutable, own credentials1sign in2evaluate2compliant?3token3token4permission-trimmed5labels, DLP6filter7backupguest policyPlatform servicesUnified auditlogDefender alertsand incidentsMicrosoft SecureScorePurviewretention
  • People and clients
  • Security and identity
  • SaaS and business systems
  • AI and ML
  • Monitoring, audit and analytics
  • Request or data flow
  • Asynchronous or optional
  • Boundary: region, account, network or trust zone

Request and data flow

  1. Staff sign in once to Microsoft Entra ID with MFA, moving to phishing-resistant passkeys or security keys for admins first and then everyone.

  2. Conditional Access evaluates every sign-in: user, sign-in risk, location and whether Intune reports the device as compliant (encrypted, patched, screen lock on). Unmanaged phones get app protection policies instead of full enrolment.

  3. Only then does the user receive a token for Exchange Online, Teams, SharePoint and OneDrive. Legacy authentication is blocked outright.

  4. Copilot retrieves only content the signed-in user can already open, so the permission model is the AI control. Oversharing is fixed before licences are assigned, not after.

  5. Purview sensitivity labels classify and, for the most sensitive tier, encrypt content. DLP stops sensitive information leaving by email, sharing links or Copilot responses where the policy covers them.

  6. Defender for Office 365 filters phishing, detonates attachments and rewrites links before they reach a mailbox or a Teams chat.

  7. A separate backup service with its own credentials keeps immutable copies of mail, OneDrive, SharePoint and Teams, so a compromised global admin cannot delete the last good copy.

Components and why they were chosen

ComponentWhat it doesWhy this choice
Microsoft Entra IDIdentity, SSO, MFA and groups for staff and guests.Already part of every Microsoft 365 tenant. P1 features unlock Conditional Access.
Conditional AccessPolicy engine for every sign-in.Turns MFA from a checkbox into risk- and device-aware access.
Microsoft IntuneDevice compliance, configuration, patching and app protection.Device health becomes a sign-in condition, which supports several Essential Eight strategies.
SharePoint, OneDrive and TeamsWhere most organisational knowledge lives.Site ownership, sharing settings and membership decide what Copilot can surface.
SharePoint Advanced Management or equivalent reportsFind sites shared with everyone, unowned sites and heavy link sharing.Oversharing is invisible until you report on it.
Microsoft PurviewSensitivity labels, DLP, retention and audit.One classification scheme across mail, files, chat and AI interactions.
Defender for Office 365 and Defender for BusinessEmail, collaboration and endpoint protection.Most compromises still start with a phishing message.
Third-party Microsoft 365 backupIndependent, immutable restore points.Retention policies are not backups, and the tenant is a single administrative blast radius.

Design decisions and trade-offs

Copilot rollout order

Fix permissions and label sensitive sites first, then pilot with a small cross-section of staff.

Why. Copilot makes existing access easy to use, including access nobody intended.

Trade-off. Licences sit unused for weeks while governance work is done.

Oversharing stopgap

Restrict discovery of known-sensitive sites while the clean-up runs.

Why. Removes the worst exposure immediately without breaking collaboration everywhere.

Trade-off. Restricted content is also harder for legitimate users to find through search and Copilot.

Label taxonomy

Four labels at most, aligned to the classification scheme the organisation already uses.

Why. Staff apply labels they understand. Ten labels means everything is labelled General.

Trade-off. Coarse labels need DLP rules to catch specific data such as tax file numbers.

Device approach

Full enrolment for organisation-owned devices, app protection for personal phones.

Why. Strong control where the organisation owns the device, privacy for staff where it does not.

Trade-off. Two policy sets to maintain and explain.

Backup

A separate provider with independent credentials.

Why. Native retention and recycle bins do not protect against a malicious admin or a tenant-wide mistake.

Trade-off. An extra per-user subscription and a restore process to rehearse.

Well-architected pillars

Security

MFA everywhere, Conditional Access with device compliance, separate admin accounts with just-in-time elevation, legacy authentication blocked and oversharing removed.

Reliability

Microsoft runs the service. You own recoverability of your data: an independent backup and a tested restore of a mailbox, a site and a Team.

Performance

Copilot quality depends on content quality. Archive stale sites, remove duplicates and keep current documents where people expect them.

Cost optimisation

Per-user licences dominate. Match the plan to the role, remove licences from leavers on their last day, and pilot Copilot before buying it for everyone.

Operational excellence

Monthly reports on sharing, guest accounts, risky sign-ins and label use, with named site owners who review membership twice a year.

Sustainability

Archiving stale content and retiring unused sites reduces storage and makes search and AI results better.

Network, identity and data

Networking

There is no network perimeter to rely on. Access decisions sit in Conditional Access, with named locations used as a signal rather than a trust boundary. On-premises file shares being migrated are moved with permissions reviewed, not copied blindly.

Identity and least privilege

Separate cloud-only admin accounts, Privileged Identity Management or equivalent just-in-time elevation, two break-glass accounts excluded from Conditional Access and monitored, and guests with sponsors and expiry dates.

Data and encryption

Microsoft 365 offers Australian data location for core customer data, but confirm the current commitments for every feature you enable, including Copilot, web grounding and any agents or connectors. Classify before you migrate, and treat prompts and responses as records where they document decisions.

Security and compliance mapping

ControlHow this design addresses it
Multi-factor authenticationPhishing-resistant for admins and remote access, Conditional Access for everyone. Essential Eight multi-factor authentication.
Restrict administrative privilegesSeparate admin accounts, just-in-time elevation and alerts on new role assignments. Essential Eight.
Patch applications and operating systemsIntune update rings and compliance policies feed Conditional Access. Essential Eight.
Configure Microsoft Office macro settingsMacros blocked from the internet by Intune policy. Essential Eight.
Regular backupsIndependent, immutable Microsoft 365 backup with tested restores. Essential Eight.
Information classification and recordkeepingLabels map to the organisation's classification scheme, and retention follows the applicable disposal schedules.

Mappings show how the design supports each control. They are not certifications, and EITSAA does not claim IRAP assessment or compliance for any reference architecture.

Failure modes, targets and scaling

  • Target RTORestore a single mailbox, site or Team within hours. Bulk tenant recovery depends on backup throughput, so measure it
  • Target RPOBackup frequency, typically several times a day for mail and files
  • Scaling and limitsTens to thousands of users. The limits are governance effort and licence budget, not the platform
Failure modeMitigation
Copilot surfaces a sensitive document to the wrong personOversharing reports before rollout, restricted discovery for sensitive sites, and labels with encryption on the highest tier.
Phished account used to read mail and share filesPhishing-resistant MFA, risk-based Conditional Access and alerting on new inbox rules and mass downloads.
Global admin compromised and data deletedSeparate admin accounts, just-in-time elevation and a backup the tenant admin cannot delete.
Guest access never removedAccess reviews and guest expiry, with sponsors who confirm each renewal.
Labels exist but nobody uses themDefault labels on sensitive sites, auto-labelling for known data types and short training.

Observability and runbooks

  • Sign-in logs and risky sign-in reports reviewed weekly, with alerts for break-glass use.
  • Sharing and oversharing reports, guest counts and unowned sites trended monthly.
  • Copilot usage and label activity reports during the pilot, with a channel for staff to report unexpected results.
  • Backup job success and a recorded restore test each quarter.

Cost drivers and levers

Per-user Microsoft 365 plans, Copilot add-on licences, backup subscriptions and the internal time to own sites and labels.

  • Use Microsoft 365 Business Premium where the organisation fits its user limit, as it bundles many of these controls.
  • License Copilot for the roles a pilot shows benefit, not everyone.
  • Reclaim licences from leavers automatically.
  • Archive stale sites instead of paying to store and search them.

Implementation and fit

Phased approach

  1. Weeks 1 to 2: baseline. MFA for everyone, legacy authentication off, break-glass and separate admin accounts, backup switched on.
  2. Weeks 3 to 6: devices and sharing. Intune compliance in Conditional Access, oversharing and guest reports, site owners assigned, stale sites archived.
  3. Weeks 7 to 10: classification. A small label set, DLP for the sensitive data you hold and retention aligned to recordkeeping duties.
  4. Weeks 11 to 16: Copilot pilot with a cross-section of staff, an acceptable use policy, training and measured outcomes before wider licensing.

Anti-patterns to avoid

  • Buying Copilot for everyone before reviewing who can see what.
  • Sites shared with everyone in the organisation by default.
  • Global admins who also read email and browse the web.
  • Treating the recycle bin and retention policies as backup.

When to use it

  • Councils, not-for-profits and small businesses on Microsoft 365 that are considering Copilot.
  • Organisations bidding for government work that need Essential Eight evidence for their own environment.

When not to

  • Organisations on Google Workspace, where the same principles apply but the products differ.

More in crm and business systems

Related insights

Discuss this architecture

Tell us your systems, constraints and timeline. We reply within one business day, and the initial conversation is free.

Start a conversationCall 0402 401 584