Microsoft 365 Business

Intended for small and medium-sized businesses with up to 300 users, the Microsoft 365 Business subscription includes Windows 10 Pro, Office 365 Pro Plus, and most (but not all) of the features included in Enterprise Mobility + Security E3. The intention behind the product is to create a comprehensive package for organizations that do not maintain a full-time IT staff, which is the case with many small businesses. The process of deploying Microsoft 365 workstations is largely automated, and the package includes the Microsoft 365 Admin Center, which provides a unified interface for the setup and management of identities and devices.

Microsoft 365 Business includes Windows Autopilot, which streamlines the process of deploying new Windows workstations or upgrading existing ones. For computers that already have Windows 7, Windows 8, or Windows 8.1 installed, Microsoft 365 provides an upgrade to Windows 10 Pro. In addition to Autopilot, Microsoft 365 includes device management settings in Azure Active Directory that can automatically apply policies to newly deployed workstations, including those for functions like the following:

• Activation of the Microsoft 365 subscription

• Windows 10 and Office 365 updates

• Automated installation of Office 365 applications on Windows 10

• Control of the device’s screen when the system is idle

• Access control to Microsoft Store apps

• Access control to Cortana

• Access control to Windows tips and advertisements from Microsoft

Another priority of Microsoft 365 is to provide security in areas where small businesses often fall short, as shown in Figure 4-1. The suite of security functions and services included in the product provides protection for all the primary areas of a business network: identities, with multifactor authentication; devices, with management capabilities for on-premises and mobile devices; applications, with usage restrictions; email, with threat detection and data loss prevention; and documents, with classification, encryption, and access control.

Microsoft 365 Business allows up to 300 user subscriptions in one tenancy, but this does not mean than an organization’s network is limited to 300 users. It is not required that every user on the network have a Microsoft 365 Business license, although only the license-holders can utilize the cloud services included with the product. It is also possible to combine license types in a single tenancy. This means that if an organization running Microsoft 365 Business expands to the point at which there are more than 300 users, it is possible to add more users with Microsoft 365 Enterprise licenses without having to upgrade the original 300 Business users.

Microsoft 365 Enterprise

For organizations with more than 300 users, there are two subscription options, called Microsoft 365 Enterprise E3 and Microsoft 365 Enterprise E5. Both include Windows 10 Enterprise and Office 365 Pro Plus, as well as Enterprise Mobility + Security, and both support an unlimited number of users. The feature lists for the E3 and E5 subscriptions are largely identical, with Microsoft 365 Enterprise E5 including all the features of E3 plus more advanced security, threat protection, and analytics tools.

Several of the elements included in Microsoft 365 are also available as individual subscriptions and are available in two plans—referred to as Plan 1 (P1) and Plan 2 (P2)—and include the following:

• Azure Active Directory Premium

• Office 365 Advanced Threat Protection

• Azure Information Protection

In each case, Plan 2 includes all the features of Plan 1, plus some additional capabilities. Microsoft 365 Enterprise E5 includes Plan 2 for all three features, while Plan 1 is included in one or more of the other subscriptions, as shown later in Table 4-1.

For organizations subscribing to Microsoft 365 Enterprise E3, it is also possible to add certain advanced E5 features in two additional subscription packages, as follows:

• Identity & Threat Protection Includes Azure Advanced Threat Protection (ATP), Windows Defender Advanced Threat Protection, and Office 365 Advanced Threat Protection, as well as Microsoft Cloud App Security and Azure Active Directory Premium P2

• Information Protection & Compliance Includes Office 365 Advanced Compliance and Azure Information Protection P2

Microsoft 365 F1

Microsoft envisions the Microsoft 365 product as a crucial step in an organization’s transition from traditional on-premises computing to cloud-based services. For that transition to be complete, they consider it essential for workers at all levels of the business to participate. Microsoft 365 F1 is intended for first-line workers—that is, the segment of an organization’s work force that provides that provides the first point of contact between the organization and the outside world. This refers specifically to workers in the field, in call centers, on shop floors, and in customer service roles.

The Microsoft 365 F1 subscription provides a streamlined version of the same basic functionality as the other Microsoft 365 subscriptions, including similar productivity, collaboration, and security tools but at a lower price and with limitations that are suitable to first-line workers’ typical needs. The components in the Microsoft 365 F1 subscription are as follows:

• Windows 10 Enterprise

• Office 365 F1 (formally Office 365 Enterprise K1)

• Enterprise Mobility + Security

The primary difference in the F1 subscription, compared to the Enterprise and Business subscriptions, is that users receive access to the Office 365 productivity applications in their web and mobile versions only; the installable applications are not included. The product includes access to the Office 365 cloud-based services, including Exchange Online, SharePoint Online, OneDrive, Microsoft Teams, Microsoft Intune, Stream, Yammer, Sway, and Planner but with limitations that suit the tasks they typically perform and the devices that these workers employ, including the following:

• Exchange Online mailboxes are limited to 2 GB.

• SharePoint Online access is included, without personal sites, site mailboxes, or the ability to create forms.

• OneDrive is limited to 2 GB of cloud storage, without desktop synchronization.

• Microsoft Teams is limited to one-to-one calls only; users can join but not create meetings.

• Stream is limited to consumption only; users cannot create or upload video streams.

• Flow is limited to consumption only, with a limit of 750 flow runs per user per month.

Microsoft 365 F1 also includes many of the same threat protection and device management services as the Microsoft 365 Business and Enterprise E3 subscriptions. The end result is a package that enables first-line workers to fully participate in the culture and community of the organization, with access to the same productivity, collaboration, and security tools as users with Microsoft 365 Enterprise or Business subscriptions. At the same time, first-line workers can gain skills and experience with tools that can enable them to grow and develop within the work force.

Microsoft 365 Business and Enterprise feature comparison

The components and features included in the main Microsoft 365 subscriptions are shown in Table 4-1.

Microsoft 365 Government

In addition to the core Microsoft 365 subscriptions mentioned earlier, Microsoft has also created specialized packages for governmental and educational organizations that are designed to suit their specific needs. The Microsoft 365 Government G3 and G5 subscriptions contain the same tools and services found in their Enterprise E3 and E5 equivalents, but the packages are designed to adhere to the additional compliance regulations and requirements to which United States government entities are often subject.

For all the Microsoft 365 Government products, data is stored under special conditions, including the following:

• All Microsoft 365 Government user content, including Exchange Online mailboxes, SharePoint Online site content, Skype for Business conversations, and Microsoft Teams chat transcripts, is stored in data centers located within the United States.

• The user content generated by Microsoft 365 Government subscribers is logically segregated from commercial Microsoft 365 user content within the Microsoft data centers.

• Access to Microsoft 365 Government user content within the Microsoft data centers is restricted to employees who have undergone additional security screening.

Access to the Microsoft 365 Government products is restricted to United States federal, state, local, tribal, or territorial government entities, as well as to other entities that are required to handle government data in compliance with the same regulations and requirements as a government entity. Eligibility to purchase these products is subject to verification by Microsoft using various government resources, including those of law enforcement agencies and the Department of State, as well as government standards, such as the International Traffic in Arms Regulations (ITAR) and the FBI’s Criminal Justice Information Services (CJIS) Policy.

In addition to the Microsoft 365 Government G3 and G5 subscriptions, which define the products’ feature sets, there are versions of Microsoft 365 Government that define various levels of security and compliance, including the following:

• Microsoft 365 U.S. Government Community (GCC) Intended for Federal Risk and Authorization Management Program (FedRAMP) moderate risk impact situations; also complies with the Internal Revenue Service Publication 1075 standard, the U.S. Criminal Justice Information Services (CJIS) Security Policy, and the U.S. Department of Defense (DoD) Defense Information Systems Agency (DISA) Level 2 requirement for noncontrolled unclassified information.

• Microsoft 365 U.S. Government Community (GCC) High Intended for FedRAMP high-impact situations; complies with the International Traffic in Arms Regulations (ITAR) and the Defense Federal Acquisition Regulation Supplement (DFARS).

• Microsoft 365 DoD Restricted to the exclusive use by U.S. Department of Defense agencies; complies with the U.S. DoD Defense Information Systems Agency (DISA) Level 5 requirement for controlled unclassified information and unclassified national security systems.

In addition to the Microsoft 365 Government subscriptions, Microsoft also maintains an alternative means of accessing Office 365 cloud services, called Azure Government ExpressRoute, which is a private, dedicated network connection to the Microsoft cloud services for eligible subscribers that have regulatory requirements that prevent them from using the public Internet.

Microsoft 365 Education

Microsoft 365 Education is another specialized version of Microsoft 365 that includes additional tools and services that are specifically targeted at teachers and students. There are two subscription levels, called Microsoft 365 Education A3 and Microsoft Education A5, which correspond to the Enterprise E3 and E5 subscriptions in most of their features and services. The subscriptions include specialized versions of the three major components, as follows:

• Windows 10 Education

• Office 365 Education

• Management & Security

Some of the tools included in the Education subscriptions are specially modified for classroom use, and there are additional educational tools included as well.

The education-specific modifications in the Microsoft 365 Education A3 and A5 subscriptions include the following:

• OneNote Class Notebook A shared OneNote implementation that includes a collaboration space for class work, a content library for handout documents, and a personal notebook space for each student.

• Yammer Academic An implementation of the Yammer private social networking service that includes school branding capability, administration capabilities that provide content management and access control.

• Minecraft Education Edition with Code Builder An educational adaptation of the Minecraft game that enables students to learn how to code software by dragging and dropping visual code blocks.

• Take a Test app An application that enables teachers to deploy high-stakes or low-stakes tests to students in a distraction-free environment, as shown in Figure 4-2. Once students have begun taking a test, they are not able to browse the web, print or share the screen, open other applications, use the Windows clipboard, or change system settings.

• Set Up School PCs app An application that enables administrators or teachers to easily set up computers running Windows 10 by joining them to an Azure Active Directory tenant, installing approved applications (as shown in Figure 4-3), removing unapproved applications, configuring Windows Update to install updates outside of class time, and locking down the system to prevent its use for anything other than educational purposes.

• School Data Sync (SDS) A service that uses data synchronized from a school’s Student Information System (SIS) to create Office 365 groups for Exchange Online and SharePoint Online, Microsoft Intune groups, class teams for Microsoft Teams, and class notebooks for OneNote, as shown in Figure 4-4. Also, SDS can populate many other third-party applications with student information.

• Office Lens A tool that uses the camera of a smartphone or tablet to take pictures of printed pages or whiteboards. This tool crops, straightens, and sharpens them, and it converts them to PDF, Word, or PowerPoint files and then saves them to a OneNote notebook, a OneDrive folder, or a local drive.

• Intune for Education A streamlined version of Microsoft Intune that provides device management and application-deployment services for teacher and student devices through a web-based portal, as shown in Figure 4-5.

Productivity

Few IT professionals must be sold on the Microsoft Office productivity applications, such as Word, Excel, and PowerPoint; they are industry standards that are virtually without competition. However, there are those who do need to be sold on a cloud-based, subscription-based implementation such as Office 365 ProPlus, as opposed to on-premises versions like Office Professional Plus 2019. The selling points that make an effective case for Office 365 include the following:

• Applications Some people might think that with Office 365, the productivity applications are accessible only from the cloud and that an Internet connection is required to run them. While the productivity applications are indeed accessible from the cloud with an Office 365 ProPlus subscription, such as that included in Microsoft 365, the product also includes fully installable versions of the productivity applications, just like those in Office 2019.

• Devices An Office 2019 Professional Plus license enables a user to install the productivity applications on a single computer; however, with an Office 365 ProPlus subscription, a user can install the applications on up to five PC, Mac, or mobile devices and sign in to any or all them at the same time. This means that users can run the Office 365 applications on an office computer, a home computer, and a smartphone, plus two other devices, with a single license, while an Office 2019 user would need a separate license for each device.

• Installation An Office 365 ProPlus license includes access to a cloud-based portal, with which users can install the productivity applications themselves on any computer. Office 2019 and other on-premises versions include no self-service portal access and require administrators to install the applications on each device.

• Activation When users install the Office 365 productivity applications from the self-service portal, they are automatically activated. They remain activated as long as the computers connect to the Office Licensing Service in the cloud at least once every 30 days. If a device exceeds the 30-day requirement, Office 365 goes into reduced functionality mode, which limits the user to viewing and printing existing documents. Office 2019 and other on-premises versions in an enterprise environment require administrators to keep track of the product key for each individual license or utilize a network-based activation method, such as Key Management Service (KMS) or Multiple Activation Key (MAK). Once activated, Office 2019 installations do not require periodic reactivation.

• Updates Office 365 installations are automatically updated either monthly or semi-annually with the latest security, quality, and feature updates. Office 2019 and other on-premises versions receive security updates but no feature updates. There is also no upgrade path to the next major on-premises version of Office. For example, Office 2016 users must pay full price for a new license to install Office 2019.

• Support Office 2019 and other on-premises versions include free technical support for the installation process only. Office 365 subscriptions include free technical support for the life of the subscription.

• Storage An Office 365 ProPlus subscription includes 1 TB of OneDrive cloud storage. Office 2019 and other on-premises versions do not include cloud storage.

• Mobile apps Access to the Office mobile apps on devices with screens smaller than 10.1 inches with core editing functionality is free to everyone. Office 365 subscribers receive extra features on all the mobile apps. Users of Office 2019 or other on-premises versions do not receive the extra features.

Collaboration

The nature of collaboration in the workplace has changed, so the tools that facilitate collaboration must change with it. One of the primary advantages of cloud-based computing is that it provides users with the ability to access enterprise resources from any location. Microsoft 365 takes advantage of that benefit by making it possible to access the cloud using nearly any device with an Internet connection. Azure Active Directory and Microsoft Intune are services, based in the cloud, which provide identity and device management functions that these user connections to the cloud secure. These components, along with the increased capabilities and emphasis on smartphones and other mobile devices in the business world, have made Microsoft 365 an unprecedented platform for collaboration.

With an infrastructure in place that can provide users with all but universal access to enterprise resources, the next step toward a collaboration platform is the applications and services that enable users to communicate and share data. Microsoft 365 includes four primary collaboration services—shown in Figure 4-6—that provide different types of communication for different situations. There are also additional services that provide more specific functions for the other services.

The services that contribute to the collaboration capabilities in Microsoft 365 are as follows:

• SharePoint Online Provides content storage and publishing services for group and personal intranet websites and for all the other Microsoft 365 collaboration tools. A SharePoint site can be a collaboration platform of its own, or its elements can be embedded in other service publications.

• Exchange Online/Outlook Provides standard email communication, as well as calendar and scheduling functions. Email is asynchronous communication that can be one-to-one, or with the aid of distribution lists, one-to-many. Scheduling functions can be embedded in other services.

• Microsoft Teams Provides synchronous chat- and call-based communication among team members that must communicate quickly and frequently. By incorporating elements from other services, such as Exchange Online scheduling, SharePoint Online content, and Stream video, Teams can function as a comprehensive collaboration platform.

• Yammer Provides a group-based or company-wide private social media service that is designed to accommodate larger groups than Teams or to foster a sense of community within the enterprise. Yammer also provides a platform for the functions provided by other services, such as content from SharePoint Online sites or scheduling with Exchange Online.

• Stream Provides video storage and distribution services, both directly to users in web browsers or embedded in other Microsoft 365 collaboration services, including Exchange Online, SharePoint Online, Teams, and Yammer.

• Planner Provides project management services that enable users to create schedules containing tasks, files, events, and other content from Microsoft 365 services.

• OneDrive for Business Provides file storage for individual users that is private unless the user explicitly shares specific documents.

Azure Active Directory and Office 365 Groups provide the identity-management infrastructure for all the Microsoft 365 collaborative services. This enables users and administrators to set up and use these services any way they want. However, the content from the various services is combined, there is only one set of user accounts and group memberships that applies to all of them. This turns the collection of Microsoft 365 collaboration services into a flexible and interoperable toolkit.

Microsoft has illustrated one possible scenario, shown in Figure 4-7, illustrating how workers and teams can use the Microsoft 365 collaboration services to work together by creating a digital daily plan containing specific tasks and the circumstances in which they might be performed.

Security

For many IT professionals who are hesitant to move their operations to the cloud, security is the biggest issue that concerns them. The idea of storing sensitive company data on Internet servers, over which they have no direct control and of which they do not even know the exact location, can be frightening. However, Microsoft has invested an enormous amount of time, effort, and expense into securing its data centers, and Microsoft 365 includes an array of security tools that subscribers can utilize to provide defense in depth against outside intrusions.

Every security situation is a matter of judgment. Administrators must evaluate the organization’s data and decide how much security it requires. In cases of highly sensitive data, the prospect of storing it in the cloud should rightly be frightening. In such cases, it might be necessary for an organization to maintain local storage and split the enterprise functionality between cloud-based and on-premises systems.

As noted elsewhere in this book, Microsoft maintains dozens of data centers around the world. The very fact that Microsoft’s cloud services are storing data for thousands of organizations means that they have the incentive and the capital to build data centers with equipment and physical security that only the largest corporations could conceivably duplicate. For most prospective Microsoft 365 subscribers, the cloud will provide greater physical security, higher availability, and more fault tolerance than they could provide themselves.

Therefore, if the Microsoft data centers can be considered safe against physical theft and most natural disasters, the remaining security concerns are centered around the protection of identities, devices, and documents. These are concerns that are a threat to any enterprise network, whether on-premises or in the cloud. Unauthorized users can conceivably gain access to sensitive data wherever it is stored, and IT professionals might try to prevent that from happening.

Security is a continuously developing challenge, with threats growing as quickly as the means to protect against them. For administrators who want to use Microsoft products to keep up with the latest developing threats, there is no question that the latest and best security tools that Microsoft makes are to be found in cloud-based platforms, such as Microsoft 365. On-premises products, such as Exchange Server and Office 2019, are being left behind in their security capabilities in favor of Software as a Service (SaaS) products like Office 365, Exchange Online, and SharePoint Online, all of which are part of the Microsoft 365 product.

The Microsoft 365 security components include the following:

• Microsoft Intune Provides device and application management services that enable mobile devices to join the network if they comply with security policies that ensure they are appropriately equipped and configured

• Azure Information Protection Enables users and administrators to apply classification labels to documents and implement various types of protection based on the labels, such as access restrictions and data encryption

• Data Loss Prevention Enables the automated discovery of documents that contain common data patterns, such as those of credit cards and Social Security numbers, using preconfigured sensitive information types

• Cloud App Security Analyzes traffic logs and proxy scripts to identify the apps that users are accessing and enables administrators to analyze app security and sanction or unsanction individual apps

• Azure Active Directory Identity Protection Evaluates the sign-in activities of individual user accounts and assigns them risk levels that increment when multiple negative events occur

• Azure Advanced Threat Protection Uses machine intelligence to prevent, detect, and remediate security threats unique to the Azure environment by analyzing user behavior and comparing it to known attack patterns

• Microsoft Advanced Threat Analytics Captures network traffic and log information and analyzes it to identify suspicious behaviors related to known phases of typical attack processes

Another aspect of Microsoft 365 that might help to convince traditionalists that a cloud platform can be secure is its use of intelligent analysis to identify behavior indicative of an attack. Tools like Windows Defender Threat Protection gather information from Microsoft 365 devices, applications and services and use endpoint behavioral sensors, cloud security analytics, and threat intelligence to prevent, discover, investigate, and remediate potential and actual threats.

Compliance

As the proliferation and value of data increases over time, businesses, agencies, and individuals are becoming increasingly concerned with the privacy and protection of their data. To quantify the nature of this data protection, there are hundreds of regulatory bodies—both private and governmental—that publish standards for data storage and handling.

Some of the most common data privacy standards in use today are as follows:

• Federal Information Security Modernization Act (FISMA) Specifies how U.S. federal agencies must protect information

• Health Insurance Portability and Accountability Act (HIPAA) Regulates the privacy of personal health information

• Family Educational Rights and Privacy Act (FERPA) Regulates the disclosure of student education records

• Personal Information Protection and Electronic Documents Act (PIPEDA) Specifies how commercial business organizations can gather, retain, and share personal information

• Gramm{{#}}8211;Leach{{#}}8211;Bliley Act (GLBA) Specifies how financial institutions must protect and share the personal information of their customers

• General Data Protection Regulation (GDPR) Specifies data protection and privacy regulations for citizens of the European Union

These standards can define elements such as the following:

• The controls that organizations must exercise to protect the privacy of personal data

• The ways in which organizations can and cannot use personal data

• The rights of government and other official agencies to access personal data held by an organization

• The lengths of time an organization can and must retain individuals’ personal data

• The rights of individuals to access their personal data held by organizations and correct it

Whether their adoption of certain standards is mandatory or voluntary, many organizations are concerned with whether the tools and procedures they use for storing and handling data are compliant with these standards.

Every organization must be responsible for assessing its own data resources and determining what standards should apply to them. The nature of the business in which the organization is engaged can often dictate compliance with particular standards. For example, companies in the health care industry or those with government contracts might be required by law to store, handle, and protect their data in specific ways. Indeed, there are regulatory standards to which the Microsoft 365 products on their own cannot possibly comply, such as those which require data to be stored on devices and in locations wholly owned and controlled by the organization, which preclude the use of cloud storage entirely.

However, many of the hundreds of privacy standards in use do allow the possibility of compliance when data is stored in the cloud, and Microsoft is well aware of the importance of adherence to these standards for many organizations considering a migration to the cloud. For IT professionals who are hesitant to become Microsoft 365 adopters because they fear that changing the location and the conditions of their data storage will negatively affect their compliance with standards like these, Microsoft has had their products’ compliance with many different standards tested and has published documents certifying the results.

Microsoft divides the compliance effort into three phases, as shown in Figure 4-8. The phases are described as follows:

• Assess The organization gathers the information needed to assess their current compliance status and produce a plan to achieve or maintain compliance with specific standards. Microsoft’s Service Trust Portal website contains a vast library of documents specifying information about the testing processes and the third parties involved in compliance testing. In addition, the site provides access to Compliance Manager, a risk assessment tool that organizations can use to record the actions they take to achieve compliance with specific standards.

• Protect The organization implements a protection plan for their data, based on its sensitivity, using the tools provided in the Microsoft 365 services, including access control permissions, file encryption, Information Protection, and Data Loss Prevention.

• Respond The organization develops protocols for responding to regulatory requests using artificial intelligence tools such as Office 365 eDiscovery to perform complex searches of Exchange Online mailboxes, Office 365 Groups, SharePoint Online and OneDrive for Business sites, and Microsoft Teams conversations.

Software assurance

For Enterprise Agreement and, optionally, for Microsoft Products and Services Agreement customers, Software Assurance provides a variety of additional services, including the following, which can benefit Microsoft 365 licensees:

• Planning Services Provides a number of partner service days, based on the number of users/devices licensed, for the purpose of deploying Microsoft operating systems, applications, and services.

• Microsoft Desktop Optimization Pack (MDOP) Provides a suite of virtualization, management, and restoration utilities, including Microsoft Application Virtualization (App-V), Microsoft User Experience Virtualization (UE-V), Microsoft BitLocker Administration and Monitoring (MBAM), and Microsoft Diagnostics and Recovery Toolset (DaRT).

• Windows Virtual Desktop Access Rights (VDA) Provides users with the rights needed to access virtualized Windows instances.

• Windows to Go Use Rights Enables administrators to create and furnish users with USB storage devices containing bootable Windows images that include line-of-business applications and corporate data.

• Windows Thin PC Enables administrators to repurpose older computers as Windows Virtual Desktop Interface (VDI) terminals.

• Enterprise Source Licensing Program Provides organizations with at least 10,000 users or devices with access to the Windows source code for their own software development projects.

• Training Vouchers Provides a number of training days based on the number of users/devices licensed for the technical training of IT professionals and software developers.

• 24x7 Problem Resolution Support Provides 24x7 telephone support for business-critical issues and business hours or email support for noncritical issues. The number of incidents allowed is based on the type of volume licensing agreement and the products licensed.

• Step-up License Availability Provides licensees with the ability to migrate their licensed software products to a high-level edition.

• Spread Payments Enables organizations to pay for three-year license agreements in three equal, annual payments.

Cloud solution providers

The Cloud Solution Provider (CSP) program enables partners to establish ongoing relationships with end-user organizations of all sizes and provide them with sales and support for Windows 10 and all the Microsoft 365 Enterprise, Business, and Education products. Members of the Microsoft Partner Network can become CSPs and play a more prominent part of their customers cloud solutions.

Rather than simply reselling products, such as Windows 10 and Microsoft 365, a CSP can be a customer’s single contact for everything from providing solutions, to billing, to providing technical support. CSP partners can enhance their relationships with their customers by adding value to the Microsoft products, such as by bundling industry-specific software products with Microsoft 365 or by offering managed services, such as data migrations and internal help desk support. CSP partners can also offer Microsoft products that were previously unavailable to smaller companies. For example, at one time, Windows 10 Enterprise was available only to customers with a Microsoft Volume Licensing Agreement; CSP partners can now offer the Enterprise edition of the operating system to small- and medium-sized companies.

Depending on the capabilities of the Microsoft partner, the CSP program operates in two ways—direct (Tier 1) and indirect (Tier 2)—as shown in Figure 4-11.

The CSP direct model enables the partners to work directly with Microsoft and function as their customers’ sole point of contact. The CSP direct partner is the only conduit between Microsoft’s products and services and the customer. For a partner to participate in the CSP direct model, the partner’s company must have existing billing and technical support infrastructures. The customer’s entire relationship is with the partner; they have no direct contact with Microsoft at all. The CSP partner’s relationship with Microsoft and with their customers proceeds as follows:

1. The CSP partner cultivates customers, sells them on Microsoft 365 and/or other Microsoft cloud-based subscription products, and sets them a price based on both the cost of the subscriptions and the added value the CSP partner provides.

2. The CSP partner sets up the customer’s tenancy in Azure Active Directory and provides them with the necessary software, such as Windows 10 and any other products they might include in the customer’s negotiated package.

3. The customer uses the supplied Microsoft products and contacts the CSP partner for any support issues they might have.

4. Each month, Microsoft uses the Partner Center portal to bill the CSP partner for all the user subscriptions they have sold to their customers.

5. The CSP partner bills the customers at their negotiated rate for the Microsoft subscriptions, technical support, and other services.

The upside of this model is that the relationship with the customers is wholly in the hands of the CSP partners. They are responsible for building and maintaining relationships with their customers, and they can establish whatever prices they feel are appropriate for their services. However, this responsibility also means that a CSP partner must have a company infrastructure that can fulfill all the customers’ needs without any help from Microsoft.

For partners that do not have the infrastructure to handle all the billing and support issues that their customers might require, there is the CSP indirect model, which defines two levels of partners, as follows:

• Indirect provider Typically, this is a larger company engaged by indirect resellers to take on the responsibility for supplying products, customer service, billing, and technical support services to customers. Some indirect providers are also willing to provide indirect resellers with other types of assistance, such as technical training and marketing; some also provide financing and credit terms.

• Indirect reseller Typically, these are smaller companies or individuals who concentrate on locating, cultivating, and signing customers for Windows 10, Microsoft 365, and other cloud-based products and services. To become an indirect reseller, an individual or firm must do the following:

  • Join the Microsoft Partner Network (MPN) and obtain an ID

  • Enroll in the CSP program as an indirect reseller by supplying an MPN ID, business address, banking information, and a contact email address

  • Establish a relationship with an indirect provider, to obtain product, billing, and support services

The CSP indirect partner model enables individual consultants or small consulting companies to sign up as indirect resellers and concentrate on locating customers and developing relationships with them, rather than concentrating on back-end services, such as billing and support.