The IT department a growing construction firm runs on Microsoft 365 instead of hiring

The IT problems a growing builder runs into

A construction firm is good at building. Running IT is a different trade, and it is the one that quietly breaks as the firm grows. At 10 staff the owner’s laptop and a shared email account hold it together. At 40 staff, spread across head office, three active sites and a yard, the same arrangement starts to cost real money and real risk.

The pattern is familiar. Project drawings and variations live in people’s inboxes and on USB sticks, so two crews work from different versions of the same plan and the rework lands on the budget. Nobody is quite sure who can still log in, because the apprentice who left in March used a shared password that never changed. A site manager loses a laptop in a ute, and it holds client contracts with no way to wipe it. The estimator’s files exist in one place, on one machine, with no backup anyone has tested.

None of this is exotic. It is the ordinary state of a firm that grew faster than its systems. The trouble is that the stakes rise as the firm wins bigger work. Head contractors and government clients now ask subcontractors about their security before they award a job, often pointing at the Australian Cyber Security Centre’s Essential Eight. Staff and subcontractor records carry obligations under the Privacy Act 1988. The builder is not trying to become a technology company. It just needs the IT to work, stay secure and not depend on whoever happens to be handy with a computer.

Why Microsoft 365 as the foundation, run by a partner

The aim is a working IT foundation a builder can rely on without hiring an IT department. We build that on Microsoft 365, because most construction firms already pay for it and barely use a tenth of it. The licence already includes the identity, email, file storage and collaboration a growing firm needs. The gap is not the tools. It is that nobody has set them up properly or looks after them.

Microsoft 365 headlines the build for three practical reasons. Its identity layer, Microsoft Entra ID, gives every staff member one secure login across email, files and apps, which is the anchor everything else hangs off. SharePoint and Teams turn into a single, structured home for project documents, reachable from any site on a phone or tablet. And the security controls needed to satisfy a head contractor are already in the box, waiting to be switched on and configured, rather than bought separately.

The supporting pieces sit around that core. Microsoft Azure provides the back-end services for identity, backup and any line-of-business system that needs a home. The Microsoft Power Platform handles light automation later, once the foundation is solid, so a site form or a document approval can be routed without manual chasing. We deliberately keep automation as a second step. Bolting clever workflows onto disordered files and shared passwords just automates the mess. The partner model matters as much as the platform. This is an ongoing, documented relationship, not a one-off setup. Someone runs it, patches it, and answers the phone when a device dies on a Friday afternoon.

Building it, and where it got hard

The technology was rarely the hard part. The friction lived in how the firm actually worked, and one problem stood in for the rest.

Identity was the knot to untangle first. The firm had no single sign-on. Staff used a tangle of personal Gmail accounts, a shared office login and passwords written on a whiteboard, and a fair number worked off their own phones and laptops. When we audited who could reach what, we found two former employees still had working access to project files, one of them months after leaving. That is the exact gap that turns into a data breach or a disgruntled-leaver problem.

The fix was identity first, in order. We gave every staff member a single Entra ID login, turned on multi-factor authentication so a stolen password alone is not enough, and brought devices under management so a lost laptop can be wiped remotely. We then made SharePoint and Teams the single home for project documents, with a structured space per project, version history on drawings, and access granted by role rather than by sharing a file around. The piece that mattered most was the dullest. We wrote a documented onboarding and offboarding process, so that when a site manager starts they get exactly the access they need, and when they leave it is actually removed the same day. A checklist sounds unglamorous next to the technology. It is the difference between a control that exists on paper and one that works.

Two constraints shaped the rest. Site connectivity is patchy, so we set documents to sync and work offline, then reconcile when a device finds signal, rather than assuming a clean connection on every job. And because subcontractors come and go constantly, we kept their access time-bound and separate from staff, so a finished trade does not keep a standing login into the firm’s files.

What changed

In a representative engagement the firm moved its project documents off email and USB sticks into SharePoint and Teams, so a site crew and head office opened the same current drawing instead of arguing about which version was latest. Multi-factor authentication and managed devices moved the firm most of the way to the Essential Eight maturity its larger clients had begun to ask about, which turned a security questionnaire from a scramble into a form it could actually answer. The documented offboarding meant the next departing staff member lost access the same day, closing the gap that had let an earlier leaver keep a working login for months.

These figures are illustrative. They describe the pattern we see rather than a published result for a named builder. The shape is the point. The firm stopped losing time to version confusion and lost logins, the owner stopped being the accidental IT department, and the business could answer a client’s security question without flinching, all without carrying an IT salary it did not yet need.

Where this fits

A managed Microsoft 365 foundation is one application of our Technology Partner service, built for a construction and property development firm that has outgrown its informal setup but is not ready for in-house IT. It is the sensible first step, because it secures the basics and puts the documents in order before anything more ambitious. Once the foundation holds, light automation on the Power Platform is the natural next move. If your project files are scattered and you are not sure who can still log in, the place to start is a short review of how your firm runs its IT today.