Managed IT
Managed Microsoft 365 for Dealerships
Microsoft runs the datacenters. Helion runs everything inside your tenant, from sign-ins and admin rights to email, backup and the AI that gets connected to it.
Managed Microsoft 365 for dealerships means one team runs your tenant every day, from sign-ins, multi-factor authentication and admin rights to email filtering, sharing settings, a real backup of mail and files, and whatever AI gets connected to it.
Last updated: October 15, 2026
Microsoft Runs the Cloud. Your Tenant Is Still Yours.
Microsoft’s own shared responsibility model is blunt about it. For software like Microsoft 365, Microsoft looks after the datacenters, the servers and the network. The customer always keeps four jobs, the data, the devices, the accounts and the access controls, multi-factor authentication included. That customer is the dealership. Plenty of stores bought the licenses and assumed the rest came in the box.
Managed Microsoft 365 is how Helion Technologies picks up those four jobs as part of managed IT for dealerships, run by the same team that handles your cybersecurity and FTC Safeguards compliance. It’s ongoing work. If you think someone is already inside your mailboxes, start with the Microsoft 365 breach assessment, which is a one-time hunt for signs of an intruder. This page is about who runs the tenant every day after that.
Buying Microsoft 365 isn’t the same as running it. We run it, for every store, every day.
Shared responsibility
Who Owns What in Your Dealership’s Microsoft 365
Read across any row. The middle column is the part nobody at the store was hired to do, and it’s where the trouble starts. Microsoft holds up its end. It always has. The tenant settings, the people and the data were never Microsoft’s job, so they sit with whoever the dealership puts in charge of them, and in a lot of stores that turns out to be a busy office manager, a part-time IT person or nobody at all.
| Area | Microsoft handles | Left to the dealership | What Helion does |
|---|---|---|---|
| Datacenters and uptime | Servers, networks, physical security and keeping the service online | Nothing on the hardware side | Tells a Microsoft outage apart from a problem in your stores, so the help desk call starts in the right place |
| Sign-ins and MFA | Provides multi-factor authentication and sign-in rules | Switching them on for every account, including the managers who hate the prompts | Multi-factor authentication on every account, and sign-in rules that block logins from places your staff never work |
| Admin rights and permissions | Provides the roles and permission settings | Deciding who gets admin rights and what each person can open | Admin rights only for the people who need them, and new hires set up by job instead of copied from someone else’s account |
| Email and phishing | Filters spam and known malware at the front door | Tuning the filters, training staff and acting on what still gets through | Email protection tuned for dealership mail, with security alerts watched around the clock by live, US-based analysts |
| Sharing and guest access | Provides sharing controls for OneDrive, SharePoint and Teams | Deciding what can leave the building and who outside can see it | Sharing limits that keep deal files inside the dealership, and a look at what’s already been shared out |
| Backup and restore | Keeps deleted email 14 days by default and deleted files 93 days | A separate copy the dealership controls, for anything older or bigger | A separate backup of mailboxes, OneDrive and SharePoint, so a restore doesn’t depend on a recycle bin |
| Copilot and connected apps | Copilot shows each person whatever that person can already open | Cleaning up permissions before any AI or app gets switched on | Permission cleanup first, then Copilot licenses if you ask for them, though we don’t push them |
| Licenses and leavers | Bills by the seat | Matching licenses to who works there and closing accounts when people leave | License counts matched to your staff list, and accounts closed when someone leaves the dealership |
The retention numbers come from Microsoft’s own pages on deleted email in Exchange Online and the SharePoint recycle bin. The sign-in row isn’t optional for a dealership, either. The FTC Safeguards Rule already requires multi-factor authentication for anyone accessing an information system that holds customer information, and your Microsoft 365 holds plenty of it. You likely own the tools for it already, as we explain in the right way to do MFA. For an outside yardstick, CISA’s secure configuration baselines for Microsoft 365 read a lot like the middle column.
From the field
What Erik Tells Dealers About Microsoft 365
We asked Erik Nachbahr, Helion’s founder and a CISSP, what dealers get wrong about Microsoft 365. His four answers follow, in his own words. Not one of them is about a missing feature. Every one of them is about who’s actually running the thing, and whether anyone checked what it can reach.
Worried someone’s already in?
Then start with the one-time Microsoft 365 breach assessment. It looks for signs of an intruder before anyone talks about running the tenant.
Four things Erik tells dealers Erik Nachbahr, Helion founder
Backup Retained isn’t backed up
“Microsoft doesn’t guarantee you backups of all of your data. It retains it for a bit, but that’s not a backup and restore, like what you typically expect.” A deleted email waits 14 days by default. A deleted file waits 93. After that, it’s gone.
Retention isn’t a restore.
Rights Permissions that were already too wide
“In dealerships where their networks are less secure, and they tend to have issues with people having permissions to things they shouldn’t already, when you add AI, now you’re spreading that even further.” A new hire’s account gets copied from whoever had the job before, the old access rides along with it, and three job changes later a salesperson can open the accounting share and the F&I manager’s mailbox without anyone deciding they should. Nobody notices, because nobody looks.
Messy rights travel.
Copilot Available isn’t the same as recommended
“Should they even be using Microsoft Copilot? No. Can you use it? Yes.” Helion gets dealers Copilot licenses when they ask. The order matters, though. Microsoft’s own Copilot privacy page says it surfaces whatever data each person already has permission to view, so a messy tenant gives you a very well-informed Copilot. Our post on what to lock down before you turn Copilot on walks through it.
Licenses on request. Cleanup first.
Access AI plugged in with admin rights
“Oftentimes AI is connected in with some high level administrative access. So all of that role-based security you have in place to control what types of things people are able to access, now they can access everything.” It usually takes one click. An app or an AI tool asks for permission to read every mailbox and every file in the tenant, someone who happens to have admin rights approves it in between two other jobs, and that’s that. The app is now one more identity in your tenant, which is why AI and machine identities need an owner too.
Read what it asks for.
Who Runs Your Microsoft 365
Every one of those 35,000 people signs in to something before the doors open. Our help desk is live from 6 a.m. to midnight Eastern, Monday to Saturday, with after-hours and weekend support included, and security monitoring runs around the clock with live, US-based analysts. Same team. Same phone number.
Microsoft 365 Backup Is Still Your Job
Moving to the cloud made backups feel old-fashioned. “Most dealers’ technology is cloud-based now,” Erik says, “so they just don’t think about backups at all.” Email moved to Exchange Online. The shared drive turned into SharePoint and OneDrive. Nobody set up the copy.
Microsoft’s safety nets are real, and they’re short. They catch a file someone deleted last week, which is handy, but they’re a thin net when ransomware scrambles a synced folder, when a departing employee empties a mailbox and nobody notices for a month, or when the controller needs last quarter’s version of a spreadsheet that’s been saved over 40 times since. We go deeper on it in whether you’re properly backing up Microsoft 365.
Retention isn’t a restore.
What Microsoft keeps
Deleted email for 14 days by default, 30 at most. Deleted OneDrive and SharePoint files for 93 days, counted across both recycle bins. Then Microsoft purges them for good.
A short safety net.
What a managed backup adds
A separate copy of your mailboxes, OneDrive and SharePoint, kept outside the tenant, so a mailbox or a folder can be rolled back to a point before the damage happened.
Your copy, on your terms.
How Managed Microsoft 365 Starts
-
1
Request the assessment
Fill in the short form for our complimentary IT and cybersecurity assessment. There’s no cost and no obligation, and you don’t need to be shopping for a new provider.
-
2
We look at your tenant
An engineer reviews sign-ins, admin rights, sharing, email protection, backup and connected apps, on-site or remotely, whichever suits you.
-
3
Findings arrive in writing
You see what’s set up, what’s missing and what a managed tenant would look like next to the systems you already run.
-
4
You decide what’s next
Fix it in-house, or hand us the daily work. Onboarding starts within weeks of signing. On the co-managed path your own IT manager stays in charge.
Common Questions
Not sure who runs it today?
A complimentary IT and cybersecurity assessment answers that in writing. Already know what you need? Get a price quote.
What does managed Microsoft 365 include for a dealership?
Doesn’t Microsoft already back up our email and files?
How is this different from the Microsoft 365 breach assessment?
Should we turn on Microsoft Copilot?
We already pay for Business Premium. Isn’t that enough?
Can our own IT person keep running Microsoft 365?
Microsoft keeps its datacenters running. Let us show you what’s going on inside your tenant.
Request a Complimentary Assessment →