Charities often end up paying commercial rates for software simply because nobody told them a nonprofit version existed. In many cases, we find organisations running on a mix of personal Gmail accounts and retail Office 2019 licences, which creates a fragmented, insecure environment that makes UK GDPR compliance almost impossible. Microsoft 365 for charities is not a stripped-back version of the software; it is the full enterprise suite provided at a significantly lower price point, or in some cases, via a grant that covers the first few users entirely.
Moving to a formal Microsoft 365 tenant (the technical term for your private instance of the cloud service) allows a charity to centralise its data, secure its communications, and manage its devices from a single dashboard. For a sector that relies heavily on trust and reputation, the ability to prove that donor data is handled securely is a commercial necessity, not just an administrative one.
The reality of Microsoft nonprofit eligibility
Microsoft does not give these discounts to everyone who asks. To qualify, your organisation must hold recognised charitable status in the UK. This usually means being registered with the Charity Commission for England and Wales, the Office of the Scottish Charity Regulator (OSCR), or the Charity Commission for Northern Ireland. Some other organisations, such as public libraries or certain community interest companies (CICs), may also qualify, but the criteria are specific.
Registration is handled through the Microsoft Nonprofit Portal. You will need to provide your charity registration number and, occasionally, governing documents. Microsoft uses a third-party validator, usually TechSoup (operating as Charity Digital in the UK), to verify your status. This process can take anywhere from a few days to a couple of weeks. Once approved, you gain access to a dedicated pricing list where the savings are substantial. For example, Microsoft 365 Business Premium is often available as a grant for the first ten users, with a heavily discounted per-user fee thereafter. This is the specific licence we recommend because it includes the security tools needed to defend against modern phishing attacks.
Managing the volunteer security gap
A pattern we see on most tenants we take on is that charities often have zombie accounts for volunteers who left years ago but still have access to the file server. In a standard business, staff turnover is usually tracked by HR and IT. In a charity, volunteers come and go with less formality, which leads to a sprawling list of active accounts that nobody is monitoring.
Each of these accounts is a doorway into your data. If a volunteer uses a weak password on their personal laptop to access your SharePoint files, and that laptop is compromised, your entire donor database could be at risk. We solve this by implementing strict offboarding processes and using conditional access policies. This means we can set rules that say: "You can only access charity data if you have Multi-Factor Authentication (MFA) turned on and you are using a device that meets our security standards."
If you have a high volume of casual volunteers, you do not necessarily need to give them all a full Business Premium licence. You can use cheaper F-series (Frontline) licences or even guest accounts in Microsoft Teams for those who only need to join meetings or read specific documents. The goal is to ensure that no one is using a personal @gmail.com or @outlook.com address to conduct charity business.
Securing donor data under UK GDPR
The Information Commissioner’s Office (ICO) does not give charities a pass on data protection because they are doing good work. If you hold names, addresses, and bank details of donors, you are a high-value target for attackers. Phishing is the primary threat here. An attacker impersonating a trustee or a senior manager can easily trick a staff member into changing bank details for a regular supplier or a grant recipient.
To protect against this, we configure the three pillars of email authentication: SPF, DKIM, and DMARC. These records live in your DNS (Domain Name System) and tell other mail servers that your emails are genuine. Without them, it is trivial for a criminal to send an email that looks exactly like it came from your @charity.org.uk address. We have a detailed guide on SPF, DKIM and DMARC that explains how these work in plain English.
Beyond email, you should use the encryption features built into Microsoft 365. If a staff member accidentally emails a spreadsheet of donor data to the wrong person, Office 365 Message Encryption can allow you to revoke access to that email even after it has been sent. This is the difference between a minor awkwardness and a reportable data breach.
A worked cost scenario for a UK charity
Take a hypothetical UK charity with 15 staff members and 10 regular volunteers. If they bought retail licences, they might be paying £10-£12 per user per month for basic features, totalling around £250-£300 monthly, often without the advanced security features of Business Premium.
By accessing nonprofit grants, the scenario changes:
- Staff (15 users): The first 10 users are covered by the Microsoft 365 Business Premium grant (£0). The remaining 5 users pay the discounted nonprofit rate (roughly £4-£5 per user). Monthly cost: £25.
- Volunteers (10 users): These can often be covered by Microsoft 365 Business Basic nonprofit grants or heavily discounted F3 licences. Total monthly cost: £0 to £10.
- Total Software Spend: Approximately £35 per month.
This leaves more budget for IT support for charities to ensure the system is actually configured correctly. The saving on licensing alone often pays for the professional management required to keep the organisation secure.
Five configuration mistakes we see in charity tenants
- Leaving MFA as optional. Many charities worry that volunteers will find MFA too difficult. In reality, a breach is far more difficult to manage. We turn on MFA for every account, no exceptions.
- Using a single 'Admin' account. We often find multiple people sharing one global admin password. This makes it impossible to know who made a change and creates a single point of failure.
- Defaulting to 'Anyone' sharing links. SharePoint and OneDrive can be set to allow files to be shared with anyone who has the link. We disable this by default to prevent sensitive data from being indexed by search engines or forwarded indefinitely.
- Neglecting the 'Secure Score'. Microsoft provides a dashboard that scores your security posture. Many charities sit at 20-30% because they haven't turned on basic features like mailbox auditing or blocked legacy authentication protocols.
- Ignoring backups. Microsoft protects the infrastructure, but they do not protect you from accidental or malicious deletion. If a disgruntled volunteer wipes your fundraising folder, Microsoft's 'recycle bin' only keeps it for a limited time. A dedicated Microsoft 365 backup is essential.
The checklist for a new charity setup
- Verify Nonprofit Status: Register with the Microsoft Nonprofit Portal and await validation.
- Claim the Business Premium Grant: Assign these to your core staff first to get the best security features for free.
- Enforce MFA: Use the Microsoft Authenticator app as the primary method; avoid SMS where possible.
- Configure SPF, DKIM, and DMARC: Protect your domain from being spoofed by fraudsters.
- Set up Intune for Device Management: If staff use personal laptops (BYOD), use Intune to ensure charity data stays within managed apps and can be wiped if the device is lost.
- Establish a Joiners and Leavers Process: Ensure accounts are disabled the moment a volunteer or staff member moves on.
- Audit Permissions: Check who has access to sensitive folders like 'Finance' or 'HR' and remove anyone who doesn't strictly need it.
How Black Sheep Support helps
We specialise in helping UK charities move away from messy, insecure IT setups and into a managed, compliant Microsoft 365 environment. We handle the nonprofit registration, the data migration, and the ongoing security monitoring so your team can focus on your mission rather than password resets.
Our helpdesk is available during office hours (Monday to Thursday 08:45 to 17:00 and Friday 08:45 to 16:00) to support your staff. We also provide 24/7 monitoring through our RMM tools, which alert us to issues that we pick up the moment the desk opens. For charities needing higher levels of protection, we offer an optional 24/7 SOC powered by Barracuda XDR to catch threats overnight.
If you want to stop overpaying for licences and start securing your donor data
and we will help you map out a migration plan that fits your budget.
Not ready to talk yet? Run our free IT Health Check to assess your charity's current risk and security posture in minutes, without any commitment. We also handle hardware, broadband, mobile and networking, providing a complete IT solution for the third sector.
FAQ: Microsoft 365 for Charities
Can we use the nonprofit grant if we are a CIC? Some Community Interest Companies qualify, but it depends on your specific articles of association and how you serve the community. Microsoft and their validation partner, Charity Digital, make the final call based on their current global eligibility guidelines. It is always worth applying to see if you meet the criteria.
What happens to our data if we lose our charity status? If your organisation is removed from the charity register, you will likely lose access to nonprofit pricing at your next renewal. Your data remains yours, but Microsoft will require you to transition to standard commercial pricing to keep the service active. We can help manage that transition to ensure no data is lost.
Is the free nonprofit version less secure than the paid one? No. The software is identical. In fact, by using the Business Premium grant, charities often have better security features than small businesses paying for the 'Standard' retail version. The only risk is if the tenant is not configured correctly, which is why professional setup is vital.
Do we need to buy a licence for every volunteer? Not necessarily. For volunteers who only need to read documents or attend meetings, you can often use guest access or the free 'Business Basic' nonprofit grants. We can help you audit your user list to find the most cost-effective mix of licences for your specific needs.
Want this handled for you? See Microsoft 365 support.
Based in Brighton or Hove? We are too: see IT support in Brighton.
