Plain-English buying guides for Auckland businesses

Guide 1

How to choose an IT support provider in Auckland

By Gavin

Most businesses only start looking for IT support once something's already broken. That's the worst time to be choosing — you're rushed, you take the first callback, and you end up locked into whoever answered the phone fastest rather than whoever's actually right for you. Sort this out before you're desperate and you'll get better pricing, a better fit, and someone who already knows your setup the day something does go wrong.

What actually matters

Business size fit. A provider whose average client has 200 staff isn't going to prioritise your 8-person office when things get busy. Just ask them outright what their typical client looks like.

Real response time commitments. "We'll get back to you soon" is not a service level — it's a sentence designed to sound like one. Get SLA response times in writing. Around 15–30 minutes for anything critical, 4 hours for the rest, is standard in Auckland.

Onsite vs remote, honestly. If you've got physical hardware, a server room, or staff who aren't comfortable troubleshooting over the phone, you need someone who'll actually show up. Double-check they're genuinely based here, not "servicing Auckland" from an office in Wellington or Hamilton.

Documentation. A decent provider documents your environment as they go — passwords stored properly, a network map, licences tracked somewhere sane. Ask to see an anonymised example. If you get a blank look, that tells you something.

Microsoft 365, properly. Nearly every small business runs on M365 now. There's a big gap between a provider who actively manages your tenant (Intune, Conditional Access, Secure Score) and one who just resets passwords when asked. Ask which one they are.

Backup and disaster recovery. Do they manage your backups, actually test restores, and have a real plan for if ransomware hits? This one isn't optional, whatever else you compromise on.

Red flags

• No written service agreement or SLA
• Can't tell you plainly what you get each month for a flat fee
• Wants a long contract signed before you've worked together at all
• Won't put you in touch with an existing client

Guide 2

Microsoft 365 security checklist for small businesses

By Gavin

Microsoft 365 is secure by default, in theory. In practice, plenty of the tenants I've come across through this directory are wide open, because "secure by default" only holds if someone's actually gone in and configured it. Here's what should be switched on, and the questions worth asking your provider if you're not sure it is.

Non-negotiable

• MFA on every account. This one thing blocks over 99% of account compromise attempts. If it's not switched on for everyone, that's tonight's problem, not next quarter's.
• No shared admin logins. Anyone with admin access needs their own dedicated admin account, kept separate from their everyday inbox.
• Conditional Access policies. Block sign-ins from countries you don't operate in, require compliant devices, enforce MFA on mobile too — not just desktop.
• Secure Score above 50%. Check yours at security.microsoft.com. Under 40% is a real problem, not a rounding error. Ask what the plan is to lift it.

Worth having

• Microsoft Defender for Business — comes with M365 Business Premium, and it's genuinely decent endpoint protection
• Intune device management — enforces encryption, lock screens, remote wipe on staff devices
• SPF, DKIM, DMARC on your email domain — stops someone spoofing "you" in a phishing email
• A real backup outside Microsoft — OneDrive/SharePoint retention is not the same thing as a backup, whatever anyone tells you

Ask your provider

• "Can you show me our current Secure Score and what you're doing about it?"
• "Are admin accounts genuinely separate from everyday email?"
• "Do we have backup outside Microsoft's native retention?"

Guide 3

Managed IT vs break-fix: which is right for your Auckland business?

By Gavin

There are two genuinely different ways to buy IT support, and most people don't realise they're choosing between them until they're already committed to one.

Break-fix

You pay when something breaks, nothing before, nothing after. It suits very small teams (1–3 people), simple setups, or an owner who's happy to handle most day-to-day stuff themselves and just needs backup for the hard cases.

• Upside: no fixed cost — you only pay when you actually need someone
• Downside: zero proactive monitoring, so you find out about a problem once it's already cost you something
• Downside: hourly rates run $120–$200/hr in Auckland, more again for urgent callouts
• Downside: the provider doesn't know your environment going in, so diagnosis takes longer every single time

Managed IT

A flat monthly fee covers monitoring, maintenance, helpdesk access, usually M365 management too. The incentive flips in your favour here — the provider eats the cost of things going wrong, not you, so they're motivated to stop problems before they start.

• Upside: predictable cost, proactive monitoring, faster fixes because they already know your setup
• Upside: often bundles patching, backup monitoring and security updates in
• Downside: you're paying every month, quiet or not
• Downside: quality swings wildly between providers — get exactly what's included in writing before you sign

Rule of thumb

Once you're past 5 staff relying on IT to actually do their jobs, managed IT almost always works out cheaper and lower-risk than break-fix. The maths tips quickly once you factor in what downtime actually costs you.

Guide 4

Questions to ask before moving to Teams Phone or VoIP

By Gavin

Moving your phone system to VoIP or Microsoft Teams Phone is one of the more impactful IT changes a small business can make — and also one of the easier ones to get wrong if you skip the boring questions upfront.

Before you commit

• Is your internet actually good enough? VoIP doesn't need much bandwidth, but it hates latency. If your broadband's flaky, call quality will be too — get a proper network readiness check done first, not a guess.
• What happens when the internet drops? Do calls fail over to mobile automatically, or do your phones just go silent? Get a straight answer, not a reassurance.
• Can you keep your numbers? Usually yes, but porting takes 2–6 weeks and needs planning — it's not an overnight switch, whatever the sales deck implies.

On price

• Per user or per line? Per user is more predictable if your headcount's growing.
• Are local and mobile calls included, or metered on top?
• What's the contract length and what does getting out look like?
• Handsets and headsets — included, rented, or bought separately?

If you're looking at Teams Phone specifically

It's a solid option if you're already on M365 Business Premium, since it keeps everything in one ecosystem instead of bolting on another vendor. It does need a Calling Plan or Direct Routing set up properly, which means finding an IT provider or telco who's actually done this before — ask to see a reference deployment, not just a slide about it.

Guide 5

Cybersecurity for Auckland SMEs: what you actually need (vs what's being sold to you)

By Gavin

Cybersecurity is a fear-driven market, and it shows. Plenty of vendors will happily sell a 10-person business enterprise-grade tooling nobody's ever going to configure properly. Here's a more grounded view of what an Auckland small business actually needs, and roughly where your budget should go first.

What's actually hitting NZ small businesses

• Business email compromise. Someone impersonates you or a supplier to redirect a payment. By far the most common and costly attack on NZ SMEs, and the fix is mostly email authentication (SPF/DKIM/DMARC) plus staff awareness — not expensive software.
• Ransomware. Files encrypted, payment demanded. Prevention is good backups (tested, offsite), patched software, MFA. Detection is endpoint protection.
• Credential theft. Phishing that steals your M365 or email password. MFA, a password manager, and phishing-resistant sign-in are the real prevention here.
• Supply chain compromise. A vendor or supplier you trust gets breached and it flows through to you. Harder to prevent outright, but limiting what third-party apps can touch in your M365 tenant helps.

Spend your budget here first

1. MFA, everywhere — email, banking, accounting. Not optional.
2. Backups you've actually tested — 3-2-1 is the standard: three copies, two media types, one offsite. Test a restore every quarter, not just when you need it.
3. Email authentication — SPF, DKIM, DMARC. Often free, stops spoofed "you" emails.
4. Endpoint protection — Microsoft Defender for Business is included in M365 Business Premium and is genuinely good. You likely don't need to bolt on more.
5. Actual staff awareness training — one phishing simulation a quarter beats most expensive security tooling. Decent free and low-cost options exist.

Probably not yet

• A 24/7 SOC — this is a 50+ staff conversation
• Penetration testing — worth doing eventually, but only after the basics above are locked in
• A standalone SIEM — M365 Business Premium already covers most of what small businesses need here

Ask a cybersecurity provider

• "Do you work to a recognised framework — NIST CSF, Essential 8, SMB1001?" (No answer, be wary.)
• "What does an engagement for a business our size actually look like, and what do we walk away with?"
• "Do you help implement the findings, or just hand over a report and leave?"

Guide 6

How to evaluate AI automation providers for your Auckland small business

By Gavin

AI automation is having a proper gold rush moment right now. Every web agency and IT shop on this directory seems to offer "AI solutions" of one kind or another. Some of it's genuinely useful. A good chunk of it is overpriced and oversold. Here's how I'd sort one from the other.

What it actually means, stripped of the buzzwords

For a small business, useful AI automation usually comes down to one of these:

• Workflow automation. Your tools talking to each other automatically — a new enquiry becomes a CRM lead, which triggers a follow-up email. Tools like Make, Zapier or Power Automate do most of the heavy lifting. Not always technically "AI", but genuinely useful either way.
• AI chatbots or voice agents. Something that handles customer enquiries on your site or phone line, answers FAQs, books appointments, triages leads around the clock. Works well when your enquiries are repetitive and predictable — less well when they're not.
• Document processing. Pulling data automatically out of invoices, forms or emails into your systems. High payoff if you're currently drowning in manual data entry.
• AI copilots. Tools like Microsoft Copilot helping staff draft, summarise and analyse faster. Often the fastest, lowest-risk win of the lot.

Red flags in an AI sales pitch

• No working example for a business your size and type, just a generic demo
• Heavy on buzzwords like "agentic AI" and "LLM orchestration", light on what actually happens
• They own the automation and you can't touch or edit it — you're locked in indefinitely
• No clear answer for what happens when it breaks or the AI gets something wrong
• Pricing stays a total mystery until you've signed an NDA

Worth asking before you sign anything

• "Can I see a live demo of something similar you've built for another client?"
• "Who owns this once it's built — can our team edit it without coming back to you every time?"
• "What's the ongoing cost actually look like — retainer, usage-based, one-off?"
• "What's the process when the AI gets it wrong or the workflow breaks?"
• "What's the smallest version of this we could start with to prove it's worth it?"

Where I'd start

Pick one high-volume, repetitive task — appointment booking, lead follow-up, invoice processing — and prove the ROI there before going any further. A good provider will suggest exactly this themselves, rather than pitching a full overhaul from day one.