Microsoft 365 deployment checklist for Kenyan organisations

A Microsoft 365 deployment checklist should cover eight things in order: licences and users, domain and DNS, identity and multifactor sign-in, devices, email and data migration, Teams and network readiness, a security baseline, and training with ongoing support. Get them in this order and most of the problems Kenyan organisations hit, such as bounced email, locked-out staff and unused licences, never happen.

We first published a five-step checklist focused on rolling out Teams. This version replaces it, because most deployments we see today involve far more than Teams: moving email off cPanel or Google Workspace, securing laptops, and meeting the expectations of the Data Protection Act 2019. Use it whether you are a 10-person firm in Westlands or a school or NGO with staff across several counties.

1. Licences and users

Start by listing everyone who needs an account and what they actually do. A receptionist who only needs email and Teams does not need the same plan as a finance manager who handles payroll data. Mixing plans is allowed and usually saves money.

• Group staff by need: email and Teams only, desktop Office apps, or advanced security.
• Remember the business plans cap at 300 users; above that, look at E3 or E5.
• List shared addresses such as info@ and accounts@ separately; they are often set up as shared mailboxes rather than as extra users.
• Check whether you qualify for education or non-profit pricing before you buy.

Our guide to Microsoft 365 for small and medium businesses compares the plans side by side.

2. Domain and DNS

Your email address depends on your domain, and changing where email goes means editing DNS records. In Kenya, .co.ke and .or.ke domains are often registered through a local registrar or a former web developer, and the login has been lost. Sort this out first, not on the night of the switch.

• Confirm who controls the domain and that you can log in to its DNS.
• Verify the domain in Microsoft 365 with the TXT record Microsoft provides.
• Plan the MX, SPF, DKIM, DMARC and Autodiscover records, but do not change MX until migration is ready.

3. Identity and multifactor sign-in

Every Microsoft 365 account is a door into your organisation’s data, so lock the doors before you move anything valuable in.

• Create users with consistent names, job titles, departments and phone numbers. Email signatures and the address book rely on them.
• Turn on multifactor sign-in for every user, and help each person set up the Microsoft Authenticator app.
• Keep global admin rights to two or three named people, with separate admin accounts from their daily ones.
• On Business Premium or E3 and above, add conditional access policies to block risky sign-ins.

4. Devices and Intune

Staff will open company email on personal phones and carry laptops home in matatus. Microsoft Intune, included in Business Premium and the enterprise plans, lets you set rules for those devices without taking them over.

• Enrol company laptops so they are encrypted, updated and protected by Microsoft Defender.
• Use app protection policies on personal phones, so company data can be wiped without touching personal photos.
• Install the Office apps and OneDrive on each laptop, and sign staff in with their new accounts.

5. Email and data migration

Now move the data. Copy mailboxes, calendars and contacts from the old system in the background while staff keep working, then switch the MX record at an agreed time, ideally a Friday evening or weekend. Run a final pass afterwards to catch mail that arrived during the change.

• Move personal files to OneDrive and shared folders to SharePoint or Teams, not all into one place.
• Bring in old PST archives from laptops so they are searchable and backed up.
• Tell staff exactly what will change, when, and who to call on the first morning.

Our Microsoft 365 migration page explains how we move email from Google Workspace, Zimbra, cPanel and other tenants.

6. Teams set-up and network readiness

Teams is where a deployment succeeds or quietly fails. Decide on a structure before staff create dozens of overlapping teams, and check your internet connection can carry the calls.

• Create a small set of teams by department or project, with named owners, and decide who can create new ones.
• Set guest access and external chat rules before you invite clients or partners.
• Check office bandwidth and Wi-Fi coverage, especially upload speed, and consider a backup line if calls are business-critical.
• Install Teams on desktops and phones so staff can join from anywhere.

7. Security baseline

Many organisations pay for strong security and never switch it on. Before you call the deployment done, set a baseline and record it.

• Review your Microsoft Secure Score and work through the high-impact items.
• Turn on phishing protection for links and attachments, and publish DMARC for your domain.
• Apply least-privilege admin roles instead of making everyone a global admin.
• Set up data loss prevention and retention for personal data, in line with your Data Protection Act 2019 obligations.
• Decide how you will back up Exchange, OneDrive, SharePoint and Teams, because Microsoft does not do it for you.

See how we approach Microsoft 365 security for Kenyan organisations.

8. Training and support

Licences only pay off when people use them. Plan short, role-based training rather than one long session, and make it obvious where to get help.

• Train staff on Outlook, Teams meetings and chat, and sharing files from OneDrive instead of attaching them.
• Give managers and power users extra sessions on SharePoint, Planner and, if you have it, Copilot.
• Name a help desk contact, internal or a partner, and share it before go-live.
• Hold a follow-up Q&A a few weeks later, and review licence use before renewal.