Plain-English buying guides for Auckland businesses

Guide 1

How to choose an IT support provider in Auckland

Most small businesses only think about IT support after something goes wrong. That's expensive timing. Choosing the right provider before you need them urgently means better pricing, a better fit, and someone who already knows your environment when things break.

What to actually look for

• Business size fit: A provider whose typical client is a 200-person company will deprioritise your 8-person office. Ask directly: what's their average client size?
• Response time commitments: "We'll get back to you soon" isn't a service level. Ask for SLA response times in writing — typically 15–30 minutes for critical issues, 4 hours for non-urgent.
• Onsite vs remote: If you have physical hardware, a server room, or staff who aren't tech-comfortable, you need someone willing to show up. Check they're genuinely Auckland-based, not just "servicing Auckland" from Wellington.
• Documentation: A good provider documents your environment — passwords stored securely, network maps, software licences tracked. Ask to see an example. If they look blank, walk away.
• Microsoft 365 competence: Almost every small business runs on M365 now. Ask if they manage tenants actively (Intune, Conditional Access, Secure Score) or just help with password resets.
• Backup and DR: Do they manage your backups, test restores regularly, and have a plan if ransomware hits? This is non-negotiable.

Red flags to watch for

• No written service agreement or SLA
• Can't explain what they'll actually do each month for a flat-fee contract
• Pushes you to sign a long contract before you've tested the relationship
• No customer references they're willing to share

Guide 2

Microsoft 365 security checklist for small businesses

Microsoft 365 is secure by default — but only if you've configured it. Out of the box, many tenants are wide open. Here's what your IT provider should have set up, and what to ask them about if you're not sure.

The essentials (non-negotiable)

• Multi-factor authentication (MFA) for every user: This alone blocks over 99% of account compromise attacks. If it's not on, stop reading and call someone today.
• No shared admin accounts: Every person who needs admin access should have a dedicated admin account, separate from their daily-use email.
• Conditional Access policies: Block sign-ins from unexpected countries, require compliant devices, and enforce MFA even on mobile apps.
• Microsoft Secure Score above 50%: Visit security.microsoft.com and check your Secure Score. Under 40% is a genuine risk. Ask your provider what their plan is to improve it.

Nice to have (but worth asking about)

• Microsoft Defender for Business (included in M365 Business Premium) — endpoint protection on every device
• Intune device management — enforces encryption, lock screens and remote wipe on staff devices
• Email authentication (SPF, DKIM, DMARC) — stops spoofed emails appearing to come from your domain
• Backup outside Microsoft — OneDrive/SharePoint retention is not the same as a real backup

What to ask your provider

• "Can you show me our current Secure Score and what you're doing to improve it?"
• "Are all admin accounts separate from regular email accounts?"
• "Do we have backup outside Microsoft's native retention?"

Guide 3

Managed IT vs break-fix: which is right for your Auckland business?

There are two fundamentally different ways to buy IT support. Understanding the difference saves you money and frustration.

Break-fix (ad hoc support)

You pay when something breaks. No ongoing relationship, no monthly fee. Suits very small teams (1–3 people), businesses with minimal IT complexity, or owners who are comfortable handling most issues themselves.

• Pro: No fixed cost, pay only when needed
• Con: No proactive monitoring — you find out about problems after they've already affected your business
• Con: Hourly rates are higher ($120–$200/hr is typical in Auckland), and urgent callouts cost more
• Con: Provider doesn't know your environment, so diagnosis takes longer

Managed IT (flat monthly fee)

A fixed monthly fee covers monitoring, proactive maintenance, helpdesk access, and often M365 management. The provider is incentivised to keep things running — fixing problems costs them time, not you.

• Pro: Predictable cost, proactive monitoring, faster resolution (they already know your setup)
• Pro: Often includes software patching, backup monitoring, and security updates
• Con: Monthly commitment, even in quiet months
• Con: Quality varies enormously — ask what's actually included in writing

The rule of thumb

If you have 5+ staff relying on IT to do their jobs, managed IT almost always works out cheaper and lower-risk than break-fix — the maths shifts quickly once downtime costs are factored in.

Guide 4

Questions to ask before moving to Teams Phone or VoIP

Moving your business phone system to VoIP (Voice over IP) or Microsoft Teams Phone is one of the most impactful IT changes a small business can make — and one of the easiest to get wrong. Here's what to nail down before you sign anything.

Before you start

• Is your internet connection good enough? VoIP is bandwidth-light but latency-sensitive. If your broadband drops or fluctuates, call quality suffers. Ask your provider to run a network readiness check first.
• What happens during an outage? If the internet goes down, do calls fail over to mobile? Does the provider have a plan, or will your phones just go dead?
• Can you keep your existing numbers? Number porting is usually possible but takes 2–6 weeks and needs to be planned carefully — don't assume it's instant.

Pricing questions

• Is pricing per user or per line? (Per user is more predictable for growing teams)
• Are local NZ calls and mobile calls included, or metered?
• What's the contract length, and what are the exit terms?
• Are handsets/headsets included, rented, or purchased separately?

Teams Phone specifically

Teams Phone (Microsoft's built-in calling) is a great option if you're already on M365 Business Premium — it keeps everything in one ecosystem. But it requires a Calling Plan or Direct Routing setup, which needs an IT provider or telco who knows what they're doing. Ask if they've done Teams Phone deployments before and can show you references.

Guide 5

Cybersecurity for Auckland SMEs: what you actually need (vs what's being sold to you)

Cybersecurity is a noisy, fear-driven market. Vendors will happily sell a 10-person business enterprise-grade software they'll never configure properly. Here's a realistic, grounded view of what an Auckland small business actually needs in 2025 — and how to spend your budget where it counts.

The real threats facing NZ small businesses

• Business email compromise (BEC): Attackers impersonate your email or a supplier's to redirect payments. This is by far the most common and costly attack on NZ SMEs. Prevention is mostly email authentication (SPF, DKIM, DMARC) and staff awareness — not expensive software.
• Ransomware: Encrypts your files and demands payment. Prevention: good backups (tested, offsite), patched software, MFA. Detection: endpoint protection.
• Credential theft: Phishing attacks that steal Microsoft 365 or email passwords. Prevention: MFA, password manager, phishing-resistant authentication.
• Supply chain attacks: Attackers compromise a software vendor or supplier you trust. Harder to prevent — but limiting what third-party apps have access to your M365 tenant helps.

What you actually need (in order of priority)

1. MFA on everything — email, banking, accounting software. Non-negotiable.
2. Tested backups — ideally 3-2-1: three copies, two different media types, one offsite. Test a restore quarterly.
3. Email authentication — SPF, DKIM and DMARC on your email domain. Stops spoofed emails appearing to come from you. Often free to set up.
4. Endpoint protection — Microsoft Defender for Business is included in M365 Business Premium and is genuinely good. You probably don't need additional AV.
5. Staff awareness training — one phishing simulation per quarter does more than most expensive security tools. There are good free and low-cost options.

What you probably don't need yet

• A 24/7 Security Operations Centre (SOC) — this is for 50+ staff organisations
• Penetration testing — valuable, but only after the basics above are solid
• Expensive standalone SIEM tools — M365 Business Premium already includes most of this

Questions to ask a cybersecurity provider

• "Do you work to a recognised framework — NIST CSF, Essential 8 or SMB1001?" (If they can't name one, be cautious.)
• "What does a typical engagement for a business our size look like, and what do we get at the end?"
• "Do you help us implement the findings, or just report them?"

Guide 6

How to evaluate AI automation providers for your Auckland small business

AI automation is having a gold rush moment. Every web agency and IT shop now offers "AI solutions." Some of it is genuinely useful; a lot of it is expensive and oversold. Here's how to cut through the noise and figure out whether an AI automation provider is actually worth your time and money.

What AI automation actually means for a small business

At a practical level, useful AI automation for SMEs usually means one of these things:

• Workflow automation: Connecting your tools so data flows between them automatically (e.g. a new enquiry in your website form → created as a lead in your CRM → sends a follow-up email). Tools like Make, Zapier or Power Automate power most of this. It's not always "AI" but it's genuinely useful.
• AI chatbots / voice agents: An AI that can answer customer enquiries on your website or phone line, handle FAQs, book appointments or triage leads 24/7. Works well when your enquiries are repetitive and predictable.
• Document processing: Automatically extracting data from invoices, forms or emails and pushing it into your systems. High ROI for businesses drowning in manual data entry.
• AI copilots: Using tools like Microsoft Copilot to help staff draft emails, summarise meetings, analyse data or create documents faster. Often the quickest win with the least implementation risk.

Red flags in AI automation sales pitches

• They can't show you a working example for a business your size and type
• The proposal is heavy on buzzwords (agentic AI, LLM orchestration) but light on specific outcomes
• They own the automation and you can't access or edit it yourself — you're locked in forever
• No clear answer on what happens when the automation breaks or the AI hallucinates wrong output
• Pricing is entirely custom with no ballpark figures until you've signed an NDA

Good questions to ask before signing

• "Can I see a live demo of a similar workflow you've built for another client?"
• "Who owns the automation once it's built, and can our team edit it without coming back to you?"
• "What's the ongoing cost — monthly retainer, per-usage, or one-off?"
• "What's your process when the AI produces wrong output or the workflow breaks?"
• "What's the simplest version of this we could start with to prove the value before committing to a larger build?"

A realistic starting point

If you're new to AI automation, start with one high-volume, repetitive task — appointment booking, lead follow-up, invoice processing. Prove ROI there before expanding. A good provider will suggest this themselves rather than pushing a comprehensive overhaul on day one.