Question 1

New hire has an account but cannot reach Outlook or Teams

Accepted Answer

1. Go to admin.microsoft.com > Users > Active users > select the employee > Licenses tab.
2. Tick the right plan (Business Basic for web-only, Standard for desktop apps, Premium if you want Intune and Defender) and save.
3. Wait 5 to 15 minutes; the Exchange mailbox is created only then, and Teams access only becomes visible after.
4. Have the employee sign out and back in on all devices so the license cache refreshes.
5. Check admin center > Billing > Licenses to confirm available count; pricing rarely stays current, so verify that separately.

When to bring us in: 
If you are unsure whether Basic, Standard, or Premium fits the role: ask for advice. The wrong plan costs you twelve months or an expensive switch.

Question 2

Employee left, but their email must be retained

Accepted Answer

1. Before doing anything: place the mailbox on Litigation Hold or Retention via the Compliance portal. Content is then retained regardless of license state.
2. Convert the mailbox to shared: admin > User > Mail > Convert to shared mailbox. Under 50 GB you no longer need a license.
3. Only then remove the license via the Licenses tab; in this order you lose nothing.
4. Give colleagues who need access Full Access or Send As rights on the shared mailbox.
5. Log which mailboxes are shared and why; within a year nobody remembers.

When to bring us in: 
Under statutory retention duties (financial, medical, legal) a shared mailbox is not always enough. Ask for advice on a formal archive solution.

Question 3

We pay for licenses nobody uses

Accepted Answer

1. Open admin > Reports > Usage > Activity reports; per user you see how many days they recently signed in to Outlook, Teams, OneDrive.
2. Make two lists: users with zero activity in 60 days, and users who only use Outlook (and never touch Premium features).
3. List 1: email or conversation, often from leavers never decommissioned; pull their license.
4. List 2 may go to a cheaper plan; verify they do not need archive or Defender before downgrading.
5. Document what you did and when; in six months nobody remembers.

When to bring us in: 
Downgrading Premium to Standard drops some security features. Ask for advice if you are not sure what sits underneath.

Question 4

Which M365 Business plan fits us now: Basic, Standard, or Premium?

Accepted Answer

1. Basic: web-only Office, Exchange, Teams, OneDrive 1 TB. Fits people who never open Word or Excel locally.
2. Standard: same plus desktop Office. The 'standard office' plan for most SMBs.
3. Premium: same plus Intune (device management), Defender (anti-phishing, anti-malware), Entra ID P1. Fits after one incident or once you face compliance requirements.
4. Upgrade per user directly from the admin center; downgrade also, but features drop immediately.
5. Do not rely on exact pricing in old quotes; pricing rarely stays current. Check live via your billing tab.

When to bring us in: 
The Premium-or-not call is an architect's question, not a button question. Ask for advice for a one-hour conversation about what your risk profile justifies.

Question 5

We are buying a new SaaS: what should I watch for on sign-up?

Accepted Answer

1. Create the master account with a role-based mailbox (admin@company.com), not a personal one; otherwise access is lost when that person leaves.
2. Turn on MFA on the admin account immediately, before continuing setup.
3. Check which region the data sits in (EU vs US) and adjust before importing content; later switches are often impossible.
4. Where possible, enable SSO via Microsoft 365 or Google Workspace; saves a lot of offboarding work later.
5. Add the vendor to your SaaS register (a spreadsheet is fine) with billing frequency, contract end date, and the owner.

When to bring us in: 
For SaaS that will hold sensitive data (customers, salary, health): ask for advice on the DPA and sub-processor list before signing.

Question 6

Vendor asks 'log in via Microsoft or Google?': which do I pick?

Accepted Answer

1. Pick the IdP that holds your primary account. Work mail at @company.com on M365? Then sign in via Microsoft, else you end up in a weird hybrid state.
2. Have both? Pick the one most colleagues actively use; SSO works better the more people follow the same flow.
3. Document per SaaS which SSO source it uses; at IdP migration you will need this list.
4. If the vendor offers 'sign in with email' alongside Microsoft/Google: always pick the SSO variant, passwords get lost.
5. Test the logout flow once; some SaaS only logs out locally and keeps the SSO session open.

When to bring us in: 
If you choose Google now but consider moving to Microsoft (or vice versa): ask for advice, as migrating SSO sources can get expensive.

Question 7

Vendor mentions 'SCIM provisioning': what is it and do I want it?

Accepted Answer

1. Without SCIM: each new hire means manually creating an account in every SaaS; each leaver means undoing it everywhere.
2. With SCIM: you manage users in M365 or Okta, the SaaS follows automatically: on, off, and group assignment.
3. Not every SaaS offers SCIM; often only on pricier tiers. Check 'SCIM' or 'auto-provisioning' on their pricing page before signing.
4. Setup at Microsoft happens via Entra ID > Enterprise applications > [SaaS] > Provisioning, using a token from the vendor.
5. Test with one user first; SCIM misconfigurations can wipe all accounts if set wrong.

When to bring us in: 
SCIM implementation and attribute mapping is technical and painful when it breaks. Ask for advice before turning this on tenant-wide.

Question 8

Who do I make admin in the vendor portal?

Accepted Answer

1. Create at least two admins: a role account (admin@company.com) and one personal admin (the actual operator).
2. The role account is your fallback when a person leaves; make sure the mailbox exists and is monitored.
3. Enable MFA on both admins, not only the active one.
4. Record per vendor who the admins are in your SaaS register. Run this list at every offboarding.
5. For financial admins (billing access) the role can differ from technical admin; many vendors split it.

When to bring us in: 
If a single person is admin on a critical SaaS and may leave: ask for advice quickly; access recovery via vendor support can take weeks.

Question 9

How do I enforce MFA for all users of a SaaS?

Accepted Answer

1. Check the vendor's admin settings for a 'Require MFA for all users' toggle. If it exists, use it.
2. No tenant-wide toggle? Then check per user whether MFA is on; click through and keep a list.
3. Under SSO via M365: M365's MFA covers the sign-in. But the vendor cannot 'see' it unless they accept an MFA claim.
4. For admins specifically: make MFA required even if regular users get a grace period.
5. Record this per SaaS in your register; auditors increasingly ask.

When to bring us in: 
If the SaaS does not offer MFA on the tier you have: ask for advice on whether an upgrade is justified, or whether the SaaS no longer fits.

Question 10

Employee left: which SaaS do I have to close down?

Accepted Answer

1. Open your SaaS register (none? start one now). Walk each vendor and block or delete the user.
2. Note: SaaS the leaver only used via SSO seem 'closed instantly' but often keep sessions live for 24 hours.
3. For SaaS where the leaver was admin: hand admin off first, then delete.
4. Export any user-owned data (Trello boards they created, OneDrive folders) before deletion.
5. Document what you did and when. Audits ask exactly for this.

When to bring us in: 
Unsure which SaaS exist? Ask for advice on a shadow-IT discovery; you often find twice as much as expected.

Question 11

On cancellation: leave data or have it deleted?

Accepted Answer

1. Ask the vendor formally for their post-cancellation retention policy. Default is often '30 to 90 days, then irreversibly deleted'.
2. Want it gone for good? Request a 'data deletion confirmation' in writing; that is your GDPR evidence.
3. Want to keep data accessible? Some vendors offer a 'read-only archive plan' at a lower rate.
4. Document the choice and date. A customer or auditor question will need this.
5. On the end date: sign in once to check that the account is truly closed and data is gone or kept as agreed.

When to bring us in: 
Customer personal data in a SaaS you are canceling? Ask for advice; the GDPR data-processing agreement sometimes overrules vendor policy.

Question 12

A SaaS auto-renewed silently for a year: is that allowed?

Accepted Answer

1. Pull up the last invoice or welcome email; contract duration and notice period (usually 30, 60, or 90 days) are listed.
2. Count back from the annual renewal date. Past the notice window, renewal is valid in most jurisdictions, including NL.
3. Try anyway: ask the vendor for a goodwill exit, particularly if you got no advance warning email. Decent support sometimes accommodates.
4. Going forward: set a calendar reminder for each SaaS (renewal date minus 90 days) so you decide in time.
5. At next renewal negotiate a shorter term or an exit clause, especially on multi-year contracts.

When to bring us in: 
Large amounts or a SaaS you truly want gone: ask for advice; a well-argued cancellation letter sometimes works after the fact.

Question 13

Is a Microsoft 365 Copilot license worth it?

Accepted Answer

1. Think who handles the most writing and repetitive work; finance, HR, and marketing are usually the first to benefit.
2. Start with a few pilot licenses (3-5) for a month; gather concrete examples of what they did with it.
3. Ask pilots after a month: 'what would you genuinely miss if it were taken away?' Not 'did you like it?'.
4. Scale to the whole org only if the pilot shows clear productivity gains across most roles.
5. Pricing rarely stays current; ask your reseller or admin center for live rates.

When to bring us in: 
Doubts on Copilot data privacy in your tenant (where do prompts go?): ask for advice, particularly in sensitive industries.

Question 14

Mailbox running out: do I need an Archive license?

Accepted Answer

1. Check current size: outlook.office.com > Settings > General > Storage.
2. Under the cap: cleanup often helps more than license expansion. Delete 'Sent items' older than two years as a test.
3. Near the cap: an Exchange Online Archiving license adds a second 100 GB mailbox accessible from Outlook.
4. Configure a retention policy so old mail moves to the archive mailbox automatically, without user effort.
5. Pricing rarely stays current; check via admin > Billing.

When to bring us in: 
Under statutory retention (financial, legal) an archive license alone is not always enough. Ask for advice on a formal archive solution.

Question 15

Power Automate flow stops: 'quota exceeded'

Accepted Answer

1. Open make.powerautomate.com > My flows and look at run history. Find the flow that runs most.
2. Check which connectors it uses; SharePoint and Outlook are 'standard'; Salesforce, SQL, HTTP are 'premium'.
3. Standard connectors over quota: spread the flow across more triggers, or use batch actions so each run does more work.
4. Premium-connector error: a Power Automate Premium license is needed per user or per flow.
5. Document what the flow does and yields; that justifies whether a license is worthwhile.

When to bring us in: 
Power Automate architecture (per-user vs per-flow vs Process licenses) is a licensing puzzle. Ask for advice before buying a Premium license.

Question 16

Colleagues cannot open my Power BI report

Accepted Answer

1. Power BI Free: you can build but not share via a workspace. Not usable for 'viewers'.
2. Power BI Pro: required for both publisher and viewer, unless the workspace runs on Premium capacity.
3. Power BI Premium per User: same as Pro plus larger model limits, paginated reports, deployment pipelines and Copilot features.
4. Microsoft Fabric / Power BI Premium per Capacity: capacity per org, viewers then only need Free; scales beyond 50 viewers. Microsoft has folded Premium-per-capacity into Fabric SKUs (F-SKUs); the legacy "P-SKU" is closed to new customers.
5. Count viewers vs builders first; that determines whether Premium capacity is cheaper than Pro per person.

When to bring us in: 
Power BI license architecture is its own specialty. Ask for advice past around 50 viewers; it can save thousands per year.

Question 17

One colleague needs Project or Visio: can I buy it standalone?

Accepted Answer

1. Project: three plan options (Plan 1, Plan 3, Plan 5) ranging from planning-only to portfolio management.
2. Visio: two options (Plan 1 web-only, Plan 2 with desktop and datasource connectors).
3. Buy via admin > Billing > Purchase services and assign on the user's Licenses tab.
4. Both work alongside your existing M365 license; additive, not replacing.
5. Pricing rarely stays current; verify via admin center, especially with multiple users.

When to bring us in: 
With 5+ Project or Visio users: ask for advice; an Enterprise plan or separate deal may beat standalone licenses.

Question 18

Which Defender license do we need?

Accepted Answer

1. Defender for Office 365: anti-phishing, anti-malware in email. Built into Business Premium and E5; add-on for Standard or E3.
2. Defender for Endpoint: device detection and response. Plan 1 is in Business Premium; Plan 2 needs E5 or a separate add-on.
3. Defender for Identity: detects suspicious behavior in Active Directory. Add-on or via E5 / EMS E5.
4. First decide what you want to protect: mail only, also devices, or identity too.
5. On Business Premium you already have a chunk; upgrade only if you genuinely miss features.

When to bring us in: 
Defender licensing touches your security posture directly. Ask for advice; the wrong plan wastes money and leaves gaps.

Question 19

We want fixed-line calling via Teams

Accepted Answer

1. Calling Plan (Microsoft as provider): numbers from Microsoft, simplest setup, limited to certain countries.
2. Direct Routing (your provider): keep current numbers and provider, technically more complex.
3. Operator Connect: a middle ground where a Microsoft partner supplies numbers and manages the plumbing.
4. Pilot with two users before moving everyone; some use cases (call center, alarms) do not fit.
5. Pricing and country availability rarely stay current; ask for live rates and watch number-porting lead times.

When to bring us in: 
A PBX replacement is a project, not a license choice. Ask for advice before porting numbers; reverting takes months.

Question 20

Which Google Workspace plan fits us?

Accepted Answer

1. Business Starter: 30 GB per user, meetings up to 100 without recording. Fits small teams with few files.
2. Business Standard: 2 TB per user, meetings up to 150 with recording, shared drives. The 'standard office' plan.
3. Business Plus: 5 TB per user, Vault, advanced endpoint management. Fits once you face compliance requirements.
4. On strong file growth: upgrade from Starter to Standard early; downgrade after exceeding storage is not possible without data loss.
5. Pricing rarely stays current; check live via admin.google.com > Billing.

When to bring us in: 
The Plus-or-not call, especially with Vault, is a compliance question. Ask for advice; the wrong choice means data-export pain later.

Question 21

Sharing files via personal Drive fails frequently

Accepted Answer

1. Create a Shared Drive via drive.google.com > Shared drives > New.
2. Give it a clear name (project, department, client); clutter is prevented by discipline up front.
3. Set roles: Manager adds/removes, Content manager manages files, Contributor adds, Viewer reads.
4. Move relevant files from personal Drives to the Shared Drive; ownership transfers do not affect Shared Drive content.
5. Build an onboarding checklist: new hires get membership of the right Shared Drives day one, nothing in My Drive.

When to bring us in: 
Moving from My Drive to Shared Drives at scale: ask for advice; plain moves break links in docs and mails.

Question 22

Request from lawyer or accountant: 'can you preserve this data?'

Accepted Answer

1. Open vault.google.com (only visible with a Vault license).
2. Create a 'matter' for the specific case and place a 'hold' with the relevant users and date range.
3. A hold blocks deletion of mail and Drive files for the hold's duration, regardless of user action.
4. To search old data without setting a hold: use Vault 'search'; retention policy determines what is still findable.
5. Document holds outside Vault too (an internal log); legal matters span years.

When to bring us in: 
Vault architecture and retention timing affects your legal position. Ask for advice with your lawyer; this is not an IT-only choice.

Question 23

Apps Script crashes: 'service invoked too many times'

Accepted Answer

1. Check Apps Script quotas in Google's docs; they differ across consumer Gmail, Workspace Starter, Standard, and Plus.
2. Cut API calls with batch ops: use getValues() on a whole range instead of per cell.
3. Split heavy scripts into pieces under the per-script execution limit (6 minutes on a personal Gmail account, 30 minutes on Workspace).
4. Cache results with CacheService for data that does not change often.
5. For real workloads: consider moving the work outside Apps Script, to Cloud Functions or a server script.

When to bring us in: 
Apps Script architecture (triggers, batches, queues) is a real rabbit hole. Ask for advice before investing much in optimization; sometimes another tool fits better.

Question 24

Adobe license sharing between colleagues no longer works

Accepted Answer

1. Go to adminconsole.adobe.com > Products and check who currently has a license assigned.
2. If one person has a license but multiple need it: add the extra users and assign them licenses too.
3. On a swap: detach the license from the old user first, then assign to the new one. This order avoids overlap errors.
4. For occasional users: consider single-app licenses (Photoshop only, Acrobat only); cheaper than All Apps.
5. Pricing rarely stays current; check via admin console or your Adobe reseller.

When to bring us in: 
On Adobe license architecture for a team: ask for advice. The wrong plan can double cost without anyone noticing.

Question 25

Which e-sign tool: Acrobat Sign or DocuSign?

Accepted Answer

1. Already on Acrobat Pro or Adobe CC for teams? Sign is bundled in some plans; verify that first.
2. Mostly Microsoft 365 or Salesforce as backbone? DocuSign tends to integrate slightly deeper there.
3. Low volume (a handful of contracts per month); both work without much template setup.
4. High volume or complex flows (internal approvals, multiple signers in order): pilot both for a week.
5. Pricing rarely stays current; ask for live rates, especially on volume tiers.

When to bring us in: 
On legal-validity questions specific to your industry (notarial, medical): ask for advice, not every signature type covers every transaction.

Question 26

Adobe app suddenly demands sign-in or says 'no license'

Accepted Answer

1. Close all Adobe apps and Creative Cloud entirely.
2. Sign out at account.adobe.com (all sessions) and sign back in with your work account.
3. Reopen the Creative Cloud app; it should re-fetch the license. Wait a few minutes for first sync.
4. Still no luck? Run the Adobe Creative Cloud Cleaner Tool; it clears the license cache without uninstalling the apps.
5. On a new PC: sign in to Creative Cloud first, before opening any individual Adobe app.

When to bring us in: 
Multiple colleagues hitting a license error simultaneously: ask for advice, it may be a tenant issue only Adobe support can fix.

Question 27

Which project tool fits us: Asana, Linear, or Trello?

Accepted Answer

1. Trello: kanban boards, very simple, fits teams that want visual work without much structure.
2. Asana: lists, boards, timelines, dependencies. Fits teams with multiple project types side by side.
3. Linear: opinionated for software teams; cycles, issues, automation. Poor fit for non-engineering work.
4. First decide who will actually use it (only PMs or the whole org) and how complex the flows are.
5. Run a two-week pilot of one tool at a time; comparing three at once never works.

When to bring us in: 
Choice affects a whole department or organization: ask for advice, the wrong tool means years of migration pain.

Question 28

We want chat alongside Teams: Slack or Mattermost?

Accepted Answer

1. Slack Free: message history limited to a recent period, few integrations. Not suitable for long-term business use.
2. Slack Pro or Business+: paid per user per month, full history and full features.
3. Mattermost Cloud: similar to Slack but hostable in EU; slightly less mature integrations.
4. Mattermost self-hosted: free, but you run the infra (server, backups, updates). Fits orgs that want data fully in-house.
5. First check whether you actually need a second chat tool besides Teams; often it is a symptom of poorly configured Teams.

When to bring us in: 
Choice affecting all communication: ask for advice; switching pain on an entrenched chat tool is underestimated.

Question 29

Zoom or Webex meetings alongside Teams: does it make sense?

Accepted Answer

1. First check who really needs it: usually just sales or customer-success going to external meetings.
2. Zoom Pro or Webex Standard: paid per user, fits a meeting 'host'.
3. For 'join only' no license is needed; participants attend free.
4. For Zoom Phone or Webex Calling: that is a telephony add-on; only do that if you truly want to move telephony to that tool.
5. Pricing rarely stays current; check via vendor portal before bulk buying.

When to bring us in: 
On a telephony platform choice (Teams Calling, Zoom Phone, Webex Calling): ask for advice, this touches number porting and locks in years.

Question 30

Error 'you've reached your license limit'

Accepted Answer

1. Check in the vendor's admin portal: assigned vs purchased licenses.
2. Does 'purchased' look right? Or are you paying for less than you actually want to assign?
3. Walk the assigned list and detach inactive users: leavers, long-no-login, test accounts.
4. Scale up to more licenses only if you really have more active users; vendors deliberately set threshold emails.
5. Going forward: schedule quarterly reviews and assign that task to someone explicitly, else it creeps back.

When to bring us in: 
On big growth jumps or a vendor pushing a higher tier: ask for advice, sometimes another license model is cheaper.

Question 31

We have no idea which SaaS we are all using

Accepted Answer

1. Pull credit card and bank statements for the last year; search for 'subscription', 'monthly', 'invoice'.
2. Open admin.microsoft.com > Identity > Enterprise apps; every SSO login is logged; you see vendors colleagues sign into via Microsoft.
3. Same for Google Workspace: admin.google.com > Apps > Web and mobile apps.
4. Ask each department briefly: 'what tools do you pay for personally or via the department?' People tell if you do not come across accusingly.
5. Compile everything in a register; expect twice what you thought.

When to bring us in: 
When the register exceeds 30 vendors: ask for advice; you likely have overlap, unused, and risky tools at once; cleanup pays back.

Question 32

Invoice is in dollars when I expected euros

Accepted Answer

1. Check the invoice for the listed currency; some vendors offer EUR billing only on larger accounts.
2. Ask the vendor if EUR billing is possible; on annual contracts it sometimes is.
3. If not: pay with a credit card that has no FX margin (business cards like Wise, Revolut Business).
4. Accounting-wise: record in EUR at invoice-date FX, not pay-date, otherwise your accountant breaks out in hives.
5. Expect 5-10% annual fluctuation if you stay in USD; budget for it.

When to bring us in: 
At annual totals above 5,000 EUR in USD: ask for advice; a conversation with the vendor about EUR billing or annual settlement can save structurally.

Question 33

SaaS invoice from US says 'VAT 0%': is that right?

Accepted Answer

1. The invoice carries no VAT; that is correct if you supplied a valid VAT number to the vendor.
2. In your books: post VAT as if you had charged yourself (payable) and simultaneously deductible; net zero, but visible on your VAT return.
3. For SaaS from other EU countries: same mechanism, but called 'intra-community service'.
4. If the vendor lacks your VAT number, they bill with VAT; request a correction and supply the right number going forward.
5. Accounting software: set up a separate VAT code for 'reverse charge' so the return computes automatically.

When to bring us in: 
Doubts on VAT treatment specific to your case: ask your accountant for advice; redoing this with the tax authorities is heavy admin.

Question 34

Vendor asks 'EU or US data center': what do I pick?

Accepted Answer

1. First check what data goes in: customer personal data, salaries, health: EU residency essentially required.
2. No personal data (technical logs only)? US works without major GDPR friction.
3. Ask in the vendor admin whether the choice is changeable later; with some vendors it is locked after setup.
4. Record the choice in your SaaS register next to the DPA; audits look exactly here.
5. If the vendor only offers US and you have EU data: is there a Standard Contractual Clauses (SCC) addendum? Request it.

When to bring us in: 
In sensitive industries (healthcare, finance, legal): ask for advice. The wrong residency choice can lead to GDPR fines.

Question 35

Vendor offers an annual deal with a discount vs monthly

Accepted Answer

1. First decide how confident you are this tool stays in 12 months; on doubt, go monthly.
2. On annual or multi-year: ask explicitly for the discount (not every vendor offers it unprompted) and put the percentage in writing.
3. Multi-year (2-3 years) sometimes adds discount but tightens lock-in; only do this when the tool is genuinely embedded.
4. Negotiate the notice period: standard 30-90 days before renewal; shorter is better.
5. Pricing rarely stays current; today's discount is not next year's guarantee.

When to bring us in: 
On multi-year contracts above 10,000 EUR: ask for advice, the clauses bite later if you want out.

Question 36

Vendor sends a 'true-up' invoice after year-end

Accepted Answer

1. Read your contract's 'true-up' or 'overage' clause; it specifies how extra use is billed.
2. Track active user counts monthly yourself; year-end then never surprises you.
3. On strong growth: consider negotiating a new baseline with the vendor before year-end rather than after.
4. Accounting: reserve monthly for estimated true-up so the settlement is not a cash-flow event.
5. For next renewal: negotiate a higher baseline or different structure if true-ups consistently exceed expectations.

When to bring us in: 
When true-ups exceed 20% of the base contract: ask for advice, you likely overpay for the structure you picked.

Question 37

How do I judge whether a vendor is safe enough?

Accepted Answer

1. Ask if they have SOC 2 or ISO 27001; for sensitive data that is a minimum.
2. Request the DPA (data processing agreement) and read for sensitive clauses on sub-processors and data transfer.
3. Check haveibeenpwned.com to see if the vendor appears in a known breach; recent breaches are a red flag.
4. Think what you lose if this vendor goes offline tomorrow; how critical is it to daily operations?
5. Record the outcome in your SaaS register; audits ask exactly this.

When to bring us in: 
For the most critical vendors or sensitive industries (healthcare, finance): ask for advice, a proper assessment by a specialist is justified.

Question 38

What is in a DPA, and do I need one?

Accepted Answer

1. Request the DPA via vendor admin or support; many large vendors (Microsoft, Google, AWS) provide it as a download.
2. Read the definition of 'personal data', the retention period, and the breach handling; these are the key sections.
3. Request the sub-processor list; that lists all third parties potentially touching your data (CDN, helpdesk, analytics).
4. Sign the DPA and store it in your SaaS register; an audit asks whether you have one per vendor handling personal data.
5. On sub-processor changes the vendor should notify you; check that the notice clause is in the DPA.

When to bring us in: 
For DPAs that deviate from standard EU clauses or vendors refusing to sign one: ask for advice, that is not an IT call but a legal one.

Question 39

CSP mentions NCE switch and impact is unclear

Accepted Answer

1. Ask CSP for current licenses on NCE terms
2. Choose deliberately: monthly (pricier, flex) or annual (discount, fixed)
3. Note 7-day cancel window per new order
4. Plan seat reduction just before renewal, not after

When to bring us in: 
Forward CSP quote if terms are unclear.

Question 40

Switch CSP partner without downtime or double billing

Accepted Answer

1. Ask current CSP for exact NCE term end
2. Have new CSP prepare transfer request
3. Confirm in admin portal as tenant owner
4. Check first invoice for overlap

When to bring us in: 
On double billing: dispute via both partners.

Question 41

Annual discount sounds nice, but what if the team shrinks?

Accepted Answer

1. Count core team that stays, put those on annual
2. Put flex roles, freelancers, seasonal on monthly
3. Mix deliberately: anchor seats plus buffer
4. Document per license which term applies

When to bring us in: 
At 20+ seats: ask CSP for mixed-billing proposal.

Question 42

Warehouse or production only needs Teams and email

Accepted Answer

1. List roles that only use mobile or shared device
2. Check if a shared mailbox via F1 suffices (F1 has no Exchange mailbox itself), or whether F3 with its 2GB mailbox is needed
3. Test workflow on an F license before rollout
4. Calculate savings per FTE per year

When to bring us in: 
If torn between kiosk vs F: compare feature matrix with CSP.

Question 43

One PC must run offline or cannot be cloud-bound

Accepted Answer

1. Determine if PC truly cannot use cloud (lab, machine, isolated)
2. If yes: buy LTSC volume license via reseller
3. If no: M365 is cheaper over 3 years
4. Document which PC runs which model

When to bring us in: 
Unsure: request LTSC quote and calculate break-even.

Question 44

Old Open Value or Open License expires, what now?

Accepted Answer

1. Gather all existing activation keys
2. Ask CSP for migration path for your SKUs
3. Plan dual-run period between old and new
4. Activate new keys before old expire

When to bring us in: 
Unknown SKU? Forward license overview.

Question 45

Teams calling works internally but not to outside lines

Accepted Answer

1. Check if Phone System already in M365 E5
2. Otherwise: buy Phone System per user who actually calls
3. Choose Calling Plan (Microsoft) or Direct Routing (own SIP)
4. Assign numbers in Teams Admin Center

When to bring us in: 
For hybrid setup: request SIP trunk quote from telecom partner.

Question 46

One Power Apps form, not everyone needs per-user plan

Accepted Answer

1. Count apps each user opens on average
2. At 1-2: per-app plan
3. At 3+: compare per-user plan
4. Calculate annual price for 12 months, not monthly

When to bring us in: 
If using Dataverse: request separate quote, counts differently.

Question 47

Too many Pro seats, or external readers also need reports

Accepted Answer

1. Count active readers per month
2. Under 100 readers: Pro per user cheaper
3. At 250+ or paginated reports: consider Premium Capacity
4. Test dataset size against Pro limit (1GB)

When to bring us in: 
Unsure on capacity sizing: ask Microsoft Solution Assessment.

Question 48

Business Plus or jump straight to Enterprise Standard?

Accepted Answer

1. Check current and expected seats over 12 months
2. Determine if DLP or S/MIME is truly needed
3. Ask Google partner for Enterprise quote (no public list price)
4. Test feature set in trial tenant

When to bring us in: 
Approaching 300: switch now, before renewal rush.

Question 49

External or contractor needs one Google app, no mailbox

Accepted Answer

1. Create Cloud Identity Free account in admin
2. Assign only specific Workspace app
3. No mailbox, so no mail routing needed
4. Remove at end of engagement

When to bring us in: 
Limit (50 free) reached? Upgrade to Cloud Identity Premium. Verify the current cap (often 50, sometimes higher per region or account) with Google before relying on it.

Question 50

Want to enforce 2-step verification, not just offer it

Accepted Answer

1. Set 2SV to 'Allow' first, communicate to team
2. Switch to 'Enforce' with grace period (1-2 weeks)
3. Send reminder plus authenticator app guide
4. Check new login attempts in audit log

When to bring us in: 
Lock-out? Reset from admin via 'backup verification'.

Question 51

Vendor asks SAML or OIDC, unsure which to pick

Accepted Answer

1. Check which option identity provider supports well
2. SAML: exchange metadata XML
3. OIDC: exchange client ID and secret
4. Test login as test user before rollout

When to bring us in: 
Vendor only does SAML but IdP only OIDC: ask about bridge.

Question 52

Offboarded employee remained in SaaS X for 6 weeks

Accepted Answer

1. List critical SaaS where SCIM is supported
2. Configure SCIM bridge in IdP per SaaS
3. Test with dummy account: create, modify, deactivate
4. Document non-SCIM SaaS in manual offboarding checklist

When to bring us in: 
SCIM error in audit log? Forward log excerpt.

Question 53

Invoice higher than expected, ex-employees still counted

Accepted Answer

1. Pull seat report from each SaaS portal
2. Compare with current HR list of active staff
3. Delete, not just suspend, old accounts
4. Schedule quarterly audit in calendar

When to bring us in: 
Need to retain data: ask if read-only role is free.

Question 54

Vendor announces true-up or license audit

Accepted Answer

1. Pull seat report for audit period
2. Count only active, billable roles
3. Document own count with date and source
4. Share your count only after their finding

When to bring us in: 
Big discrepancy? Ask for vendor count substantiation.

Question 55

Want to cancel, contract mentions notice period

Accepted Answer

1. Find notice clause (often 30, 60 or 90 days)
2. Count back from renewal date
3. Set calendar alert 14 days before deadline
4. Send cancellation in writing via agreed channel

When to bring us in: 
Vendor refuses cancellation? Cite specific clause with date.

Question 56

Cancelled the subscription, but the tool keeps living in our data

Accepted Answer

1. List all tools ever linked to the cancelled system. Search admin logs for "Connected apps" or "API keys" before you leave.
2. Revoke all API tokens and OAuth grants before the cancel date. Skip this and you get surprises after billing stops.
3. Service accounts or "integration users" with their own mailbox: identify them. Often named "automation@company.com" or "zapier-bot". Treat as normal offboarding.
4. Webhooks the other way: if the cancelled tool pushed to you, close the endpoint so you no longer receive historical data you should not retain.
5. Document in an offboarding checklist for the tool. Next cancellation it becomes a tickbox, not archeology.

When to bring us in: 
On older integrations, nobody remembers what runs where. We can run a short audit on your M365 and Google Workspace OAuth grants, plus your main integration platforms (Zapier, Make, n8n). Half a day.

Question 57

Want to leave vendor X but export is limited

Accepted Answer

1. Ask vendor for full export (not selective)
2. Test import in new tool with sample set
3. Keep export file at least 1 year after switch
4. Document which fields didn't transfer

When to bring us in: 
No export offered? Invoke contract data-portability clause.

Question 58

Slack Free shows only recent messages, older are hidden

Accepted Answer

1. Decide: are old messages truly needed?
2. If yes: upgrade to Pro or Business+
3. If unsure: export workspace data as JSON
4. Evaluate if Teams or alternative fits better

When to bring us in: 
Compliance retention requirement? Pro tier minimum needed.

Question 59

Notion workspace is messy, paying for inactive guests

Accepted Answer

1. Open Settings > Members, sort by last active
2. Downgrade inactive members to guest or remove
3. Archive unused teamspaces
4. Set seat cap as a limit via admin

When to bring us in: 
Migrate to new workspace if legacy is too chaotic.

Question 60

HubSpot Starter too tight, Professional feels overkill

Accepted Answer

1. List features team actually needs
2. Check if workarounds work on Starter
3. Test Professional in 14-day trial
4. Negotiate via reseller or partner channel

When to bring us in: 
Unsure: Starter plus separate automation tool may be cheaper.

Question 61

Jira or Confluence Standard, or jump to Premium?

Accepted Answer

1. Determine if audit log or sandbox is truly needed
2. Count users and projects
3. Ask Atlassian for monthly and annual quote
4. Plan upgrade at renewal, not mid-cycle

When to bring us in: 
Compliance requires audit log: Premium needed.

Question 62

GitHub Team already costs, Enterprise is double

Accepted Answer

1. Count active developers, not all accounts
2. Decide if SSO requirement is hard (compliance)
3. Calculate Team plus separate SAML bridge as alternative
4. Negotiate via Microsoft CSP if M365 sits there too

When to bring us in: 
Open source projects: ask if OSS discount exists.

Question 63

Figma Professional enough, or should it be Organization?

Accepted Answer

1. Count active editors (viewers often free)
2. Decide if design system management is needed
3. Test Org in trial
4. Negotiate annual contract for discount

When to bring us in: 
External agencies or clients: make guest seats, saves edit licenses.

Question 64

Password manager choice: 1Password or Bitwarden

Accepted Answer

1. Test both in trial with 2-3 colleagues
2. Check SSO tier: Bitwarden requires Enterprise for SSO
3. Decide on self-host preference (only Bitwarden)
4. Migrate passwords via export-import

When to bring us in: 
Migrating from LastPass: do per user, not bulk.

SaaS and licenses