IT Support for Professional ServicesIT support for firms where the people and their laptops are the business.
A professional services firm sells expertise, and the expertise lives in people, their laptops and the client files they work on. We run the IT for consultancies, agencies and advisory firms: Microsoft 365 or Google Workspace set up as the office, client data kept where it should be, and the answers to your clients' security questionnaires ready before they ask.
Who this is for
Consultancies, creative and marketing agencies, design studios, architects, engineering and property consultants, financial advisers and other service-based firms. Small and medium-sized businesses with staff in the office, at home, on client sites and travelling, tools such as HubSpot, Xero and Harvest alongside Microsoft 365 or Google Workspace, and nobody whose job is IT. Law firms and accountancy practices have their own pages.
Microsoft 365 and Teams are the office
For most professional firms the office is now a Teams workspace, a SharePoint site and a laptop. That works well when it is set up deliberately and badly when it grew one shared folder at a time. We configure Microsoft 365 as the place the firm works: Teams and SharePoint structured by client and project, email protected against impersonation, and Teams Phone if the firm wants a number that follows its people.
Staff work from home, client sites, trains and hotels, so the controls go with the device rather than the building. Every firm laptop is enrolled in Intune, encrypted and wipeable. Conditional Access means a stolen password on its own does not open a mailbox, and sign-ins from unexpected places are blocked or challenged. A laptop left in a taxi becomes a remote wipe rather than a conversation with the client and the ICO.
Client data, NDAs and security questionnaires
Clients hand over confidential material under NDA and increasingly ask how it will be protected before they do. Larger clients send security questionnaires with their contracts, and many ask for Cyber Essentials, which central government contracts handling personal information also require. The questions repeat: multi-factor authentication, patching, device encryption, backup, access control and who can see client data.
We answer those questions by running the controls, then keep the evidence: MFA enforcement, device compliance, patch status and backup restore tests. Client folders in SharePoint are set up so access follows the project team, external sharing is limited to named guests with links that expire, and sensitivity labels mark confidential material so it is harder to send to the wrong place. Cyber Essentials certification is a fixed project, and BSS holds it ourselves.
Source: Cyber Essentials (NCSC)
Personal phones, freelancers and contractors
Most firms let staff read email on their own phones, and many work with freelancers who never get a firm laptop. Neither needs full device management. Intune app protection puts a boundary around Outlook, Teams and OneDrive on a personal phone: firm data cannot be copied into personal apps, and it can be removed without touching the owner's photos. Freelancers and client contacts join as guests with access to the projects they work on, and lose it when the work ends.
Source: Bring your own device (NCSC)
Invoices, business apps and Copilot
Invoice fraud hits professional firms from both directions. Criminals who get into a mailbox send your clients invoices with new bank details, or send you fake changes from a supplier. Multi-factor authentication, impersonation protection, alerts on mailbox forwarding rules and a call-back rule for bank detail changes stop most of it.
The rest of the business runs in tools such as HubSpot, Xero, Harvest and project or PSA systems. We connect them to Microsoft 365 sign-in where they support it, make sure MFA is on where they do not, and include them in the leaver checklist so access ends with employment. Before Microsoft 365 Copilot is switched on, we check who can see what in SharePoint and Teams, because Copilot will surface anything a user already has access to, including the client folder that was shared with everyone three years ago.
Source: Small organisations guide (NCSC)
On Google Workspace?
Plenty of agencies and consultancies run on Google Workspace, and we support it as fully as Microsoft 365; nobody has to move. The controls clients ask about have direct equivalents: 2-Step Verification enforced for every account, with security keys or passkeys for admins, least-privilege admin roles, Gmail's phishing and malware protection with SPF, DKIM and DMARC, and alerts on suspicious sign-ins and mailbox forwarding. Client work sits in shared drives per client or project, with external sharing limited to named people, and third-party app access restricted so staff cannot hand a client folder to an unvetted add-on.
Phones and laptops are managed with Google endpoint management, so firm data can be removed from a personal phone or a lost laptop, and Windows laptops can be managed and protected properly either way. Gmail, Drive, Calendar and Contacts can be backed up outside Google and kept for seven years in the UK. Cyber Essentials works the same on either platform, and we keep the same evidence for your clients' questionnaires.
What is included
Helpdesk and monitoring
Unlimited support answered by an engineer, Monday to Thursday 08:45 to 17:00 and Friday 08:45 to 16:00, wherever your staff are working. Every device monitored and patched 24/7 by our RMM tooling, with alerts raised to the helpdesk.
Microsoft 365 or Google Workspace set up properly
Multi-factor authentication for everyone and email tuned against impersonation and invoice fraud: on Microsoft 365, Business Premium with Conditional Access, Defender for Office 365 and Teams and SharePoint structured around clients and projects; on Google Workspace, 2-Step Verification, Gmail protection settings and shared drives per client.
Device management, including personal phones
Firm laptops enrolled in Intune or Google endpoint management, encrypted, compliant and wipeable; personal phones covered by app protection so firm data stays in firm apps.
Client folders and sharing
SharePoint access that follows the project team, external sharing limited to named guests with expiring links, and sensitivity labels for confidential client material.
Business apps and leavers
Tools such as HubSpot, Xero and Harvest connected to Microsoft 365 or Google sign-in where supported, and closed off on a leaver's last day along with everything else, with a record of it.
Backup, tested
Microsoft 365 or Google Workspace, and any remaining file server, backed up outside Microsoft or Google, kept in the UK, restores tested every quarter with the result shown to you. Microsoft 365 and Google Workspace backup is a separate service, priced per user per month on top of support.
Evidence for clients
Cyber Essentials certification, and the documentation to answer a client's security questionnaire or due diligence request without a scramble.
What is not included, and why
- The business app licences themselves. You buy HubSpot, Xero, Harvest and the rest from the vendor; we make sure the accounts behind them are protected.
- Advice on your contracts and NDAs. We put the technical controls in place and describe them accurately; what you agree to with a client is for you and your advisers.
- Teams Phone and connectivity are separate services, covered on the Teams Phone and broadband pages.
What it costs
Managed IT support for professional services firms is priced per user per month, with security monitoring and device management included, so it moves with your headcount. Microsoft 365 or Google Workspace backup is a separate service, also priced per user per month. Microsoft 365 or Google Workspace licences are extra, at Microsoft's or Google's price; Microsoft 365 Business Premium is £16.90 per user per month at Microsoft's UK price. Onboarding, SharePoint restructuring, Copilot readiness and Cyber Essentials certification are quoted as fixed projects. We quote after a short discovery call, once we know your setup.
How it starts
- 1Free IT Health CheckA short online check that benchmarks your security and business risk and tells you where you stand.
- 2Discovery callAn engineer, not a salesperson. What you have, what is broken, what it would cost to fix, in writing.
- 3OnboardingEverything moves across on a plan, with no gap in cover and nothing lost.
Questions people ask before signing
A client has sent us a long security questionnaire. Can you help?
Yes. Most questionnaires ask the same things in different words: MFA, patching, encryption, backup, access control, incident response and Cyber Essentials. We put those controls in place as standard, draft the technical answers with you and keep the evidence, so the next one takes an afternoon.
Do we need Cyber Essentials?
If your clients ask for it, or you bid for central government work that handles personal information, yes. Even if nobody has asked yet, it is a sensible baseline and a short answer to a lot of questionnaire questions. We hold it ourselves and run certification for clients as a fixed project.
Our staff use their own phones for email. Is that a problem?
Not if the apps are managed. Intune app protection keeps firm data inside Outlook, Teams and OneDrive on a personal phone, stops it being copied elsewhere, and lets us remove it without touching anything personal. Phones that do not meet the rules simply cannot open firm data.
How should we share files with clients?
From a SharePoint or Teams area set up for that client, shared with named people rather than anyone with the link, with links that expire. It keeps one copy of the truth, shows who has access, and is easy to close when the engagement ends. We set the defaults so staff do not have to remember.
We run on Google Workspace. Can you still support us?
Yes. We support Google Workspace and Microsoft 365, on the same per user pricing, with licences at Google's price. We enforce 2-Step Verification, set up shared drives and sharing controls per client, restrict third-party app access, manage devices and keep the evidence for client questionnaires and Cyber Essentials. You do not have to move to Microsoft.
Should we switch on Copilot?
Possibly, but tidy permissions first. Copilot can only see what each user can already see, which is exactly the problem if old client folders are open to the whole firm. We review sharing and access, fix what needs fixing and then help you pilot it with a few people.
Our people travel and work late. When can they get help?
The helpdesk is open Monday to Thursday 08:45 to 17:00 and Friday 08:45 to 16:00, and remote support works the same wherever the person is. Our RMM tooling monitors and patches devices 24/7 and raises anything it finds to the helpdesk. On-call engineering outside office hours is an optional extra, not part of the standard price, so speak to the team if you need it. Out-of-hours security monitoring is available through the optional 24/7 SOC powered by Barracuda XDR, and the Barracuda SOC can contact you about high-criticality incidents if you choose.
How much does IT support cost for a professional services firm?
Managed support is priced per user per month with security included, so it moves with your headcount. What changes the figure is the number of users and devices, any servers, the security options you choose and any specialist software. Backup is a separate per user service, Microsoft 365 or Google Workspace licences are at Microsoft's or Google's price, and projects such as onboarding are quoted as fixed pieces of work. We quote after a short discovery call, once we know your setup.