The SMB Business Stack We Run: Microsoft-Centric, Remote-First, No Lock-In

We run a fully remote workforce on a deliberately small stack. Every line in the table below earns its keep on three criteria: it solves a problem we have, it scales linearly with headcount with no minimums and no annual contracts, and it does not require a server room behind it.

We are Microsoft-centric without being blindly Microsoft. Where Microsoft has a product that is also clearly the best option, we use it. Where Microsoft has a product that exists for the sake of a feature parity check (Calling Plans instead of Direct Routing, Yammer, Viva, Sway, Bookings), we skip it. The contract terms matter more than the bundle discount. The point of the stack is to make technology support the team, not tax it.

The stack at a glance

Item	Role
Dell XPS 9000-series laptops	Standardized hardware so swap, repair, and provisioning paths stay simple.
Microsoft AutoPilot	Self-provisioning so a new laptop builds itself when the user signs in.
Microsoft Entra ID	Single source of truth for identity. Every service authenticates against it.
Microsoft Intune	Device compliance, MDM, and the security baseline on every endpoint.
Yubico FIDO2 keys	Phishing-resistant MFA for every interactive sign-in.
Microsoft Authenticator	Exception path for service contexts that cannot use FIDO2, such as developer VM auth.
Bitwarden Teams	Shared and personal password vault at per-seat monthly pricing.
Microsoft Defender for Endpoint	AV and EDR on every Windows machine, deployed via Intune.
ConnectWise Control	Per-technician remote support sessions for help desk work.
Microsoft Teams	Chat, video meetings, and screen sharing.
Microsoft Teams Phone (Direct Routing)	The Teams app as the phone with PSTN through a local SBC vendor.
Microsoft SharePoint	Shared file storage organized by team, department, and external project.
Microsoft OneDrive	Personal file storage and Outlook attachment scratch.
Afi.ai	Tier-one M365 backup with point-in-time restore in minutes.
Synology Active Backup for M365	Tier-two warm copy on a Synology NAS.
Azure Blob (Hyper Backup target)	Tier-three immutable cold offsite in a separate tenant and region.
Custom Azure resources	Internal apps and infrastructure we build and run ourselves.
Cloudflare (DNS and registrar)	Domain ownership, DNS, and the boring records made one-click.
Cloudflare WARP and Zero Trust	Secure remote access for users and apps without a VPN client.
Ubiquiti UniFi	Office network, wireless, and security cameras on one controller.
Verizon	Primary cellular for users who need reliable coverage anywhere.
T-Mobile	Secondary cellular for low-impact, non-critical roles.
Starlink	Internet for remote sites and field deployments.
Adobe Acrobat Pro	The PDF tool users are fluent in and that does what they need.
Line-of-business SaaS	ERP, payroll, and industry-specific tools, tied into Entra via SSO.

Endpoints, identity, and deployment

One hardware standard, one identity provider, one device-management plane.

AutoPilot ships every Dell XPS direct from the vendor to the user's house, pre-tied to our tenant; the user types email and PIN and the machine builds itself. The desk that wraps around it is in the WFH workstation kit.

Microsoft Entra ID is the source of truth. Conditional Access runs the show: device must be compliant, user must be in a known posture, MFA must be FIDO2-grade. We issue two Yubico keys per user (one daily-driver, one spare) and keep Microsoft Authenticator off most phones. The exception is service contexts that cannot accept FIDO2 today, such as developer authentication into Azure VMs, where Authenticator is the right tool. The full lockdown sequence lives in the M365 tenant lockdown runbook.

Bitwarden Teams covers shared and personal vaults. ConnectWise Control sits on every Intune-managed endpoint for the moments where the help desk needs to take the wheel.

The Microsoft 365 backbone

Microsoft 365 Business Premium is the SKU. It bundles Entra ID Premium P1, Intune, Defender for Endpoint, and the productivity apps. At per-seat pricing it is the single most cost-effective line in the entire stack. The security posture this SKU enables is in the M365 security floor for SMB.

Teams runs chat, meetings, and screen share. Teams Phone with Direct Routing gives us the reliability and convenience of Teams as the phone, with the support and pricing of a local SBC vendor. The combination is hard to beat: one app for chat and calls, a real human at a regional vendor when the routing needs attention.

SharePoint is the company file system, organized by team and department, with separate sites per external project so an oversharing accident on a project site cannot expose the company drive. OneDrive is for personal files and Outlook attachment scratch. The line between them is clear and we hold it.

Defender for Endpoint runs on every Windows machine, deployed by Intune, with Defender for Office adding mail filtering on top.

We rolled out Entra SSO to every SaaS in the stack that supports SAML or OIDC. It is one of the highest-leverage things a small IT team can do. It cuts password sprawl, makes Conditional Access universal, and turns offboarding into one disabled account instead of a checklist.

Three-tier backup for Microsoft 365

Microsoft will keep your data available. Microsoft will not back it up to your retention policy in a way that survives a malicious admin, a ransomware event, or an accidental tenant deletion. We treat M365 backup as our problem.

1. Tier one: Afi.ai. Daily incremental backups across Exchange, SharePoint, OneDrive, Teams, and Groups. Per-user monthly billing, no minimum seat count, point-in-time restore from a clean web UI. This is the tier the help desk reaches for when somebody says "I deleted the email/file/Team last Tuesday." Restores complete in minutes.
2. Tier two: Synology Active Backup for Microsoft 365. Free with the NAS, which makes the marginal cost zero. Same data set as tier one, separate vendor, separate restore mechanism. The full setup is in the Synology M365 backup guide.
3. Tier three: Hyper Backup of the Synology to Azure Blob Storage with cool-tier immutable retention. The Azure container lives in a different tenant and a different region than our production M365 tenant. Even if a coordinated attack compromised our identity layer, this copy survives in an account the attacker has no path to.

Total cost across all three tiers, for a small team, is low double digits per user per month. The cost of a recovery without it, after a ransomware event, is the company.

Networking, connectivity, and remote access

Cloudflare runs the registrar, DNS, and edge security. Cloudflare WARP runs as a client on every laptop and Cloudflare Zero Trust enforces device-posture and Entra checks on internal apps. There is no inbound VPN listener anywhere on the company perimeter. There is no perimeter, really. We do not maintain one.

Ubiquiti UniFi is the office network: gateway, switches, wireless, and security cameras on the same controller. UniFi is the rare prosumer line that scales up to a small business without scaling out the price.

Cellular is split deliberately. Verizon is the primary line for staff who need reliable coverage everywhere. You get what you pay for, and they have been a good partner. T-Mobile fills the lower-impact, non-critical roles where the price difference is the point. Starlink rounds it out for remote sites and field deployments where wired internet is not on the table.

What we deliberately do not run: a corporate VPN, an on-prem file server, or an on-prem domain controller. None of them have earned a place in this stack.

Custom Azure for internal apps

The same Azure tenant that hosts our backup blobs also runs a small fleet of internal apps and infrastructure we build ourselves. Container Apps, managed Postgres, Key Vault, Application Insights, and Entra-protected ingress; the underlying recipe is in the enterprise app vibecode recipe. Owning this layer is what lets the IT stack adapt to the business instead of forcing the business to adapt to the IT stack.

The pragmatic choices and honest tradeoffs

A few places where the stack reflects pragmatism, not dogma.

Adobe Acrobat Pro. It is expensive, and there are cheaper PDF tools that handle the common workflows competently. We pay for Acrobat because users are fluent in it, the tool reliably does what they need, and the productivity tax of retraining around an alternative is higher than the licensing tax of staying.

Line-of-business SaaS. Every department brings tools the IT team did not pick: ERP, payroll, the field-service app, the e-signature service. We do not try to Microsoft-ify these. We tie them into Entra via SSO wherever the SaaS supports SAML or OIDC, enforce MFA via Conditional Access, and review license counts quarterly. That is the integration story, and it is enough.

MacBooks. A handful of users prefer macOS and we keep them on the team. Personally we would not seed Mac into a Windows-first shop on purpose, but Intune covers Macs well enough that the operational overhead is small.

Where the stack changes. At HIPAA or SOX scale, we would price the upgraded compliance SKUs and tighten Conditional Access further. Past 200 seats, the per-seat economics of some of these tools shift and the contract terms start to involve annual commitments. The "no lock-in" claim above is a small-business claim, not an enterprise one.

Bottom line

Every line in the table earns its keep on three criteria: it solves a problem we have, it scales linearly with headcount, and it does not require a server room behind it. The principle is to pick what is actually better, not what is in the same suite. The contract terms matter more than the bundle discount.

The stack should be the last thing your business has to think about. When it works, the team forgets it exists. That is the goal.

If you want the security floor underneath, the M365 security floor for SMB is the companion piece. If you want the security ceiling, the tenant lockdown runbook is next. And if you want the desk that wraps around the laptop, the WFH workstation setup covers the rest.