IT Services · Microsoft 365
Choosing a licence tier, moving mail without losing anything, configuring the security settings that are off by default, and knowing where your data is stored.
Microsoft 365 in Dubai is usually bought through whoever sold the company its first laptops, configured in an afternoon, and never looked at again. It works, in the sense that email arrives. What is normally missing is the licensing review nobody did, the security settings that are off by default, and any record of where the data actually sits.
This page covers the four things that matter when you deploy or inherit a Microsoft 365 tenant in the UAE: picking the right licence, migrating mail without losing it, configuring the security baseline, and establishing data residency before it becomes difficult to change.
It is a managed service page rather than a development one. If you need something built on top of the platform, that is Microsoft 365 development and a different conversation.
Licensing
The most common finding on an inherited tenant is money being spent on capability nobody uses.
Licensing is where most Microsoft 365 money in Dubai leaks. Microsoft publishes its current plan comparison and the detail moves, so the useful thing is not a plan recommendation that dates but the questions that decide it.
Do staff need desktop applications? Some plans include installable Office apps and some give web and mobile only. For a team working mainly in a browser, the lower tier is genuinely sufficient and the difference per seat per year is real money at twenty people.
Do you need device management and advanced security? The higher business tier adds device management and threat protection. If staff access company mail on personal phones, which in this market is close to universal, that capability is worth understanding rather than dismissing.
Are you above the Business plan seat limit? Business plans cap at a stated number of seats. Past that you are into Enterprise plans, which also give more administrative control. Growing companies hit this without noticing.
Does everyone need the same licence? Rarely. A frontline worker who needs email and nothing else does not need the same seat as someone living in Excel. Mixed licensing is supported and is where most savings sit.
The audit we run compares licences assigned against licences actually used, and on most inherited tenants a meaningful share are assigned to people who left, duplicated, or far above what the role requires.
Web and mobile only is enough for a lot of roles. Paying for desktop apps across a whole company because two people need them is the commonest overspend.
Different roles, different seats. Supported by Microsoft, rarely done, and usually where the savings are on a Dubai tenant of any size.
Licences for departed staff, duplicates, and seats far above the role. Visible in the admin centre and almost never reviewed.
Some protections sit in higher tiers. Decide knowingly rather than discovering a gap after an incident, and price the tier against the risk.
Migration
Most Microsoft 365 work in Dubai starts with a migration, usually from a hosting provider’s mail, an old on premises server, or Google Workspace. The order of operations is what determines whether it goes smoothly.
Copy before you switch to Microsoft 365. Mail is migrated into the new tenant while the old system is still receiving. Both hold the data during the transition. The failure mode is changing DNS first, which routes new mail to an empty tenant while the history sits somewhere else.
Inventory what exists. Not just mailboxes. Shared mailboxes, distribution lists, aliases, calendars, contacts, rules and anything forwarding to an external address. The forwarding rules are the ones that surprise people, and some of them should not exist.
Lower the DNS time to live beforehand. A day ahead, so the cutover propagates quickly rather than leaving mail split between two systems for hours.
Plan the authentication records. SPF, DKIM and DMARC need to be correct for the new tenant or your mail starts landing in junk folders. Microsoft documents the required records, and this is the single most common post migration complaint.
Keep the old system available. For a week or two after cutover, not switched off the same day. Something always surfaces.
Security
A tenant set up quickly is a tenant with gaps, and the gaps are consistent.
Microsoft 365 security in Dubai turns on a handful of settings. Microsoft has improved its defaults over time and security defaults now cover a baseline for new tenants. Older tenants, and tenants where someone turned defaults off to stop a complaint about sign in prompts, are where we find problems.
Multifactor authentication on every account. Especially administrators. An administrator account without it is the single largest risk on most tenants, and compromised credentials in this region are typically used for invoice fraud rather than anything exotic.
Legacy authentication blocked. Older protocols bypass multifactor entirely. If anything still depends on them, that dependency needs finding and replacing rather than leaving the door open.
Audit logging on. Without it, you cannot reconstruct what happened after an incident. It needs to be enabled before you need it, which is the whole point.
External forwarding controlled. A common attack sets a rule quietly forwarding mail to an outside address. Blocking automatic external forwarding, or alerting on it, closes that.
Administrator accounts reviewed. How many global administrators exist, and whether any belong to a former IT supplier. Most tenants have more than they need and at least one that should have been removed.
Where the tenant holds personal data about customers or staff, this stops being purely an IT question. The UAE’s personal data protection framework places obligations around securing personal data, so an unmaintained tenant is a compliance consideration as well as a technical one.
Every account, administrators first. The largest single risk on most Dubai tenants, and the fix is configuration rather than spend.
Older authentication bypasses multifactor completely. Find what depends on it and replace that rather than leaving the bypass available.
Audit logging enabled before an incident, and automatic external forwarding blocked or alerted on. Both are quiet until they matter.
Data location
Data residency for Microsoft 365 in Dubai is decided at setup. Microsoft operates data centres in the UAE, and it publishes where customer data is stored per service and per tenant. The practical point is about timing rather than geography.
The storage location for a tenant is determined largely when the tenant is created, based on the country specified at sign up. Moving an existing tenant’s data to a different region afterwards is not a setting you toggle. If residency matters to your business, it has to be established before the tenant exists.
This catches UAE companies in a specific way. A tenant created hastily with the wrong country, or created by an overseas parent company, may store data somewhere the local business did not intend. Finding out later, when a client or a regulator asks, is an awkward position with no quick fix.
Residency requirements vary by sector. Some regulated activities in the UAE have expectations about where data is held, and your obligations depend on what you do rather than on a general rule. That is a question for your compliance adviser, and the answer should precede the technical work.
It is also worth distinguishing residency from access. Where data is stored and who can access it are different questions, and the second is answered by your own configuration rather than by Microsoft’s geography.
Day to day
The work that keeps a tenant healthy, and the part nobody owns in most companies.
A Microsoft 365 tenant in Dubai is not a thing you finish. Staff join and leave, licences drift, Microsoft changes defaults, and new capability appears that you are paying for and not using.
Joiners and leavers. The Microsoft 365 process in Dubai that matters most and is handled worst. When someone leaves, their account needs disabling immediately rather than at month end, their mailbox converting to shared if colleagues need the history, and their licence releasing. Most tenants we audit carry active accounts for people who left months ago.
Licence review. Quarterly is enough. Assigned against used, and whether the tier still matches the role. Companies grow into higher tiers and rarely review downwards when a role changes.
Security posture. Microsoft provides a score and recommendations in the admin centre. It is not a target to maximise, because some recommendations are not appropriate for every business, but it is a useful prompt to review deliberately.
Backup, which is a genuine gap. Microsoft replicates your data for availability; that is not the same as a backup you can restore from after someone deletes a year of files or ransomware encrypts a share. Retention policies help within limits. Whether you need separate backup is a decision to make consciously rather than assume.
Someone owning it. An hour a month, with a named person. The reason tenants decay is not cost, it is that after the project ends the responsibility belongs to nobody.
Accounts disabled the day someone leaves, mailboxes converted, licences released. The most common gap and the one with real exposure attached.
Assigned against used, tier against role. Companies drift upwards and almost never review back down when a role changes.
Replication is not backup. Whether you need separate protection is a decision to take deliberately, not an assumption to discover during an incident.
An hour a month. Tenants decay because after the project nobody owns them, not because maintenance is expensive.
Working with us
For an existing Microsoft 365 tenant in Dubai we start with an audit: licensing against actual use, accounts and administrators, security configuration, data location, and anything retaining or forwarding data it should not. You get a written document and a prioritised list, and that is useful whether or not anything follows.
For a new deployment we settle the questions that are difficult to change later before creating anything. Country and residency, licence mix, domain and authentication records, and who holds administrative control. Then the build, then migration if there is mail to move.
Migration follows the order on this page: inventory, copy, verify, then switch, with the old system kept available afterwards. We test sending and receiving from outside the company before calling it done, because that is what actually proves it.
Ownership stays with you throughout. The tenant is yours, the global administrator account is yours, and we work as an additional administrator that you can remove. We will not take ownership of a tenant and we would advise against any supplier who wants to.
Microsoft 365 in Dubai works as a defined project, or with ongoing support alongside our IT support. You get a fixed written quote within 45 minutes during business hours.
The apps
Most companies pay for a suite and use a third of it, usually without knowing what the rest does.
Microsoft 365 in Dubai is bought for email and then quietly includes a dozen other things. Some are genuinely useful, some duplicate tools you already pay for separately, and a few cause problems if nobody configures them.
Teams. Chat, calls and meetings, and in most companies the thing that actually replaces something else. Worth noting it creates a SharePoint site behind every team, which is how file sprawl starts if nobody owns the structure.
SharePoint and OneDrive. The file layer. OneDrive is personal storage, SharePoint is shared. The common failure is everyone saving company files to their own OneDrive, which means the files leave when they do. Deciding this at the start saves a painful migration later.
Exchange. Mail, calendars and shared mailboxes. The shared mailbox is underused in this market: it gives a team a common address like sales or accounts without paying for a licensed user, and it keeps history when individuals change.
Power Automate and Power Apps. Included at some tiers and almost never touched. Simple automations, an approval flow or a form feeding a list, are within reach of a capable non developer and remove real administrative work.
Intune. Device management at higher tiers. If staff read company mail on personal phones, which here they do, the ability to remove company data from a lost device without wiping someone’s personal phone is worth understanding.
The practical exercise is to list what you pay for monthly in other tools and check what overlaps. Companies frequently run a separate chat tool, a separate file sharing service and a separate form tool alongside a Microsoft 365 subscription that covers all three.
Chat, calls, meetings. Creates a SharePoint site per team, so decide the structure before twenty of them exist without a naming convention.
Shared versus personal storage. Company files in personal OneDrive leave with the person. Settle this on day one.
A team address with no licence cost and history that survives staff changes. Underused across Dubai businesses of every size.
Remove company data from a lost personal phone without wiping it. Relevant here because almost everyone reads work mail on their own device.
Email deliverability
This is the most common complaint in the weeks after a Microsoft 365 migration in Dubai, and it is nearly always authentication records rather than anything about the tenant.
SPF states which servers may send mail for your domain. After a migration it has to list Microsoft, and critically it has to still list anything else that legitimately sends as you: your website’s contact form, a CRM, an invoicing system, a marketing platform. Replacing the record with only Microsoft breaks those silently.
DKIM signs your mail so a receiving server can verify it was not altered. It is not enabled by default for custom domains and has to be switched on and published in DNS.
DMARC tells receiving servers what to do when SPF or DKIM fail, and asks for reports. Start at the monitoring setting, read the reports for a few weeks to find legitimate senders you forgot, then tighten. Going straight to the strictest setting is how companies stop their own invoices being delivered.
Microsoft documents all three in its email authentication guidance, and the sequence matters more than the settings. Monitor, discover, then enforce.
The other factor is reputation. A brand new tenant sending a large volume immediately looks like exactly what spam looks like. Normal business mail is fine; a bulk campaign on day one from a fresh tenant is not, and bulk sending belongs on a dedicated platform rather than through your mail tenant anyway.
Inheriting a tenant
A specific situation, common here, and it has an order that matters.
A fair number of businesses reach us because whoever set up their Microsoft 365 in Dubai has stopped responding, raised prices, or simply disappeared. What you can do depends on who holds what.
Check who owns the subscription. There is a difference between a tenant you own with a supplier as administrator, and a tenant where licences are resold to you through that supplier’s agreement. In the second case the supplier controls the billing relationship, and moving means transferring the subscription rather than changing a password.
Establish global administrator access. If you hold a global administrator account, you can remove anyone else and you are in control. If you do not, recovery goes through Microsoft with proof that you own the domain, which is slower but it works, and owning the domain is the thing that makes it possible.
Check the domain itself. As with any supplier handover, confirm the domain registration is in your company name. A supplier holding your domain has far more hold over you than one holding a tenant.
Audit before changing anything. Which accounts exist, which have administrator rights, what is forwarding, what the licence position is, and whether any data retention or legal hold is configured. Make the record first; change afterwards.
Then remove what should not be there. Former supplier administrator accounts, partner relationships you did not agree to, and accounts for people who left. In that order, once you are certain your own access is secure.
The preventative version costs nothing: own the tenant, own the domain, hold a global administrator account yourself, and give suppliers access rather than ownership. We set every engagement up that way.
A tenant you own differs from licences resold through a supplier’s agreement. The second needs a subscription transfer, not a password change.
A global administrator account in your control, and the domain registered to your company. Those two together mean nothing can be held hostage.
Accounts, admins, forwarding, licences, retention. Document the inherited state first, because afterwards you cannot tell what was theirs and what was yours.
Cost
Microsoft 365 pricing in Dubai starts with the published licence and that is not the whole cost, which is where budgets go wrong.
Licences are per user per month, usually lower on an annual commitment, and the tier choice is the main variable. Microsoft lists current pricing and it changes, so the figure to work with is today’s published one rather than a number in a proposal written last year.
Setup is a one off and depends mostly on whether mail is being migrated and from what. Moving ten mailboxes from a hosting provider is a different exercise from moving eighty from an on premises server with years of archives.
Ongoing administration is the line most often left out. Somebody has to handle joiners and leavers, respond when a password breaks, and review licensing. Whether that is internal time or a support arrangement, it is a real cost and pretending it is zero is how tenants end up unmanaged.
Backup, if you decide you need it, is a separate subscription. Worth deciding deliberately as described above rather than discovering the gap during an incident.
The saving that offsets some of this is the tools you stop paying for. A company running a separate chat tool, file sharing service, video conferencing subscription and form builder alongside Microsoft 365 is paying twice for several things, and listing those is usually the first thing an audit produces.
Bilingual and regional
Details that matter here and rarely appear in a generic deployment guide.
A Microsoft 365 tenant in Dubai frequently serves a team working across two languages, and a few settings are worth getting right at setup rather than fielding complaints about afterwards.
Interface language per user. Each account can run the interface in Arabic or English independently of the tenant default. Staff can set this themselves, and telling them so during rollout prevents a week of support tickets from people who assumed it was fixed.
Right to left in documents and mail. Composing in Arabic needs the editing language enabled, which is a per user setting rather than something the tenant decides. Without it people end up fighting the text direction in every document.
Time zone and calendar. Set the tenant to Gulf Standard Time at creation. The recurring annoyance on tenants set up by an overseas supplier is meetings landing at the wrong hour because the default was left elsewhere.
The working week. Calendars default to a Monday to Friday week with a Saturday and Sunday weekend. The UAE working week does not match that for every organisation, and the setting is adjustable per user. Leaving it wrong makes scheduling assistants suggest the wrong days.
Holiday calendars. UAE public holidays can be added, and because several move with the Hijri calendar and are confirmed close to the date, this is a manual upkeep item rather than something that maintains itself.
None of these are difficult. They are the difference between a rollout people accept and one they complain about, and they cost nothing if handled during setup.
Interface and editing language set per account, not per tenant. Tell staff during rollout and the support tickets never arrive.
Set at tenant creation. Tenants provisioned by an overseas supplier commonly default elsewhere and every meeting lands wrong.
Adjustable per user. Leave it on a Western default and scheduling assistants keep proposing days your team does not work.
Several UAE holidays follow the Hijri calendar and are confirmed near the date, so this is upkeep rather than a one time setting.
Rolling it out
The technical deployment is the easy half. Adoption is where projects quietly fail.
A Microsoft 365 rollout in Dubai can be technically flawless and still leave a company working the way it did before, with files on desktops and decisions in WhatsApp. The difference is almost never training volume.
Move one thing at a time when adopting Microsoft 365 in Dubai. Mail first, because it has to move anyway and everyone notices it. Files next, once people trust the system. Chat and meetings last. Changing everything in one week produces resistance and makes it impossible to tell which change caused which complaint.
Decide where files live, then enforce it. The single decision that determines whether the file layer works. Company files in SharePoint, personal working files in OneDrive, and a folder structure agreed before anyone starts uploading. Retrofitting structure onto thousands of scattered files is painful work nobody budgets for.
Name one person internally. Not an IT expert, just someone who uses it confidently and will answer a colleague’s question. Most adoption questions are small, and people ask the person next to them rather than raising a ticket.
Train on the actual workflow. Generic training on what Teams can do achieves little. Walking a specific department through how they will now do the thing they do every day achieves a great deal, and it takes less time.
Switch off the old thing. On an agreed date, after a warning. If the previous system stays available indefinitely, a proportion of staff will keep using it, and you will run two systems permanently while paying for both.
Where there is genuine resistance, it is usually a signal rather than an obstacle. Someone whose job depends on a spreadsheet they built is not being difficult; they have a requirement nobody asked about. That is worth hearing before overruling.
Mail, then files, then chat and meetings. Everything at once produces resistance and makes complaints impossible to attribute.
Not an expert. Someone colleagues will ask. Most adoption questions are small and never reach a ticket queue anyway.
On an agreed date with warning. Leave it running indefinitely and you will pay for two systems while half the company uses each.
Common faults
The same list, on most tenants, regardless of company size.
An audit of Microsoft 365 in Dubai produces a predictable set of findings. Listing them is useful because several take minutes to correct and carry real exposure until they are.
Active accounts for people who left. Found on the large majority of tenants we examine. Each is a licence being paid for and a credential that still works, sometimes years after the person departed.
Global administrator accounts nobody can account for. Former suppliers, a consultant from a one off project, or a generic admin account with a shared password. The last is worse than it sounds because nothing in the audit log distinguishes who used it.
No multifactor on administrators. Frequently because it was switched off after someone complained about the prompts. This is the highest risk item on the list and the easiest to fix.
Mail forwarding to external addresses. Sometimes legitimate and set up years ago, sometimes not. Every rule needs a name against it and a reason, and any rule nobody can explain gets removed.
Company files in personal OneDrive. Because nobody decided where files belong. The exposure is that the files leave with the person, and recovering them afterwards depends on retention settings most companies have never configured.
Licences far above the role. Whole companies on a premium tier because it was simplest at purchase. Reviewing this usually funds the audit several times over.
No record of anything. No documentation of what was configured, by whom, or why. This is the finding that makes every other finding take longer to resolve.
Disable departed accounts, release their licences, remove unexplained administrators, enable multifactor. An afternoon with immediate effect.
Audit logging on, external forwarding reviewed and controlled, legacy authentication blocked once you know what depends on it.
File structure decided and company data moved out of personal storage, licence tiers matched to roles, retention configured.
What is configured and why, where the administrator accounts are, who owns the domain. The absence of this is what makes everything else slow.
In short
Six things that are inexpensive to settle at the start and awkward to change later.
If you take nothing else from this page, these are the Microsoft 365 decisions in Dubai that have consequences beyond the week you make them.
The country at tenant creation, because it drives data residency and cannot simply be toggled afterwards. Who owns the tenant and the domain, because that determines whether you can ever leave a supplier easily. Where company files live, because retrofitting structure onto thousands of scattered documents is work nobody budgets for.
Multifactor from day one, because adding it later means asking the whole company to change something, which generates the resistance that got it switched off on the tenants we audit. The licence mix, because a uniform premium tier across everyone is the commonest overspend and reviewing it downwards later is a conversation nobody wants to have.
And who owns it afterwards, by name. Every finding on this page exists on some tenant because the project ended and the responsibility did not transfer to anyone.
None of these require a large budget. They require being asked before the tenant exists, which is the whole argument for treating a Microsoft 365 deployment in Dubai as a short piece of thinking rather than an afternoon of clicking.
If the tenant already exists and none of them were settled, that is the ordinary situation rather than a disaster. Most are still correctable: ownership can be established, files can be moved, licences can be rebalanced, multifactor can be rolled out with a plan rather than a surprise. The one that genuinely resists correction is the data location chosen at sign up, and even that matters only if your sector gives you a residency requirement. Finding out which of these apply to you is what the audit is for.
If your team lives in Google tools and nothing requires Microsoft file formats, moving to Microsoft 365 in Dubai is the wrong project. It creates disruption for a benefit nobody asked for. Google Workspace is a legitimate choice and the comparison is on that page.
If you already run Microsoft 365 and it works, an audit is worth having and a migration is not. Suppliers propose moves because a move is a project. Ask what specifically is wrong before agreeing to one.
If the actual problem is that nobody answers IT questions, the gap is support rather than platform. A different tenant administered by nobody behaves exactly like the current one.
And if you need something custom built on the platform, that is development rather than deployment, and the right page is Microsoft 365 development.
If you are unsure which applies, tell us what you run today and what is going wrong, and we will say plainly, including when the answer is that nothing needs changing. Our team works with businesses across Dubai and the wider UAE in Arabic and English, and a fixed written proposal follows within 45 minutes during business hours with no obligation.
From the blog
What a penetration test is, how it differs from a scan, what belongs in the scope, and why UAE law makes written authorisation essential.
Read the article
The Microsoft 365 settings a small UAE business should check first, based on Microsoft's own guidance, with what each one does.
Read the articleStraight answers
It depends on headcount, whether staff need desktop apps or only web and mobile, and how much security and device management you require. Business plans have a seat limit; Enterprise plans do not and add more administrative control. Microsoft publishes the current plan comparison and the detail changes, so check it before committing.
You should not. A properly run migration copies mail to the new tenant before any mail routing changes, so both systems hold the data during the switch. Loss happens when someone changes DNS first and migrates afterwards, which is the wrong order.
Microsoft operates data centres in the UAE and the storage location for a tenant depends on where it was provisioned and which services are involved. If data residency matters to you, establish it before the tenant is created, because moving an existing tenant's data location is not straightforward.
Partly. Several protections are available but not enabled by default on older tenants, and the defaults have changed over time. Multifactor authentication, conditional access and audit logging are the usual gaps we find on tenants that were set up quickly and never revisited.
Yes, and it starts with an audit rather than changes. We look at licensing against actual use, which accounts exist, what security is configured, and whether anything is retaining data it should not. That document is useful whether or not you continue with us.
Sources
Fixed price, in writing
Got it. Your quote is being written now.
In business hours you will have it within 45 minutes. Check your inbox for the confirmation.
