Coach's Tech Tips

Check mailbox and OneDrive sync size, disable unused add-ins (File > Options > Add-ins > COM Add-ins > Go), and turn on Cached Exchange Mode with a shorter sync window such as three months, via Account Settings. A bloated PST/OST file is often the real culprit, not your PC.

Coach's tip: if Outlook is still crawling after that, check for a stuck search index rebuild running quietly in the background.

A shared mailbox is a team inbox people log into and reply from (like info@yourbusiness.com); a distribution list just forwards a copy of each message to everyone's own inbox. Use shared mailboxes when several people need to see and manage the same conversations, and distribution lists for simple broadcast messaging. Shared mailboxes are free with most M365 plans up to a storage limit.

Coach's tip: don't turn every group into a shared mailbox — they add clutter to everyone's Outlook if left permanently open.

Message recall only reliably works if both sender and recipient are on the same Exchange/M365 organisation, both are using Outlook desktop, and the recipient hasn't already opened it — so treat it as a long shot, not a guarantee. A faster fix is often to phone or message the recipient directly and ask them to ignore or delete it.

Coach's tip: set a one to two minute "delay delivery" rule in Outlook as a permanent safety net, so genuine mistakes never actually leave your outbox.

Use File > Automatic Replies in Outlook (or Settings > Mail > Automatic replies on the web) rather than a manual rule, because it also stops sending duplicate replies to the same person. Set both an internal and external message, and always set an end date so it doesn't run forever after you're back.

Coach's tip: name a specific backup contact in the message — "contact Jane" gets a faster response than "someone will be in touch."

Large attachments, an overstuffed Deleted Items or Junk folder, and old newsletters are usually the biggest space users. Use the mailbox size tool (File > Account Settings, or the admin centre for shared mailboxes) to see what's eating space, then archive old mail to an Online Archive or local PST rather than deleting years of history outright.

Coach's tip: sort by size, not date — a handful of emails with huge attachments is often 80% of the problem.

When a company-wide email spirals into a reply-all thread, mute the conversation (right-click > Ignore or Mute in Outlook) so it stops filling your inbox without you missing anything important elsewhere. For persistent offenders, consider whether a distribution list needs "reply all" disabled at the admin level.

Coach's tip: if you're the one who needs to reply, reply to the original sender only unless everyone genuinely needs to see it.

Create signatures centrally via a signature management add-in or an Exchange transport rule if you want consistency across the team, rather than relying on everyone to set up their own. Keep it simple: name, role, phone, one logo, and one or two links — heavy images and multiple banners often get blocked or look broken on mobile.

Coach's tip: test your signature by emailing yourself from a phone; that's where most signature disasters get spotted.

Multi-factor authentication stops the vast majority of account takeovers, because a stolen password alone is no longer enough. In Microsoft 365, an admin turns it on via security defaults (Microsoft Entra admin centre > Properties > Manage security defaults) or, better, a Conditional Access policy — roll it out to admins first, then everyone.

Use an authenticator app (Microsoft Authenticator) rather than SMS where you can, since texts can be intercepted. Coach's tip: give staff a week's notice and a one-page guide so day one isn't chaos.

Security defaults are a free, one-size-fits-all baseline that turns on MFA for everyone; Conditional Access lets you set smarter rules, like requiring MFA only from unfamiliar locations or devices, or blocking legacy authentication entirely. If you're a small business just starting out, security defaults are better than nothing; Conditional Access gives finer control without annoying staff on trusted devices.

Coach's tip: always exclude at least one emergency "break-glass" admin account from strict policies, stored safely, so you're never locked out of your own tenant.

Legacy (basic) authentication is an older way apps sign in that doesn't support MFA, and it's one of the most common paths attackers use to break into mailboxes. Modern Outlook, Teams and mobile apps don't need it, so blocking it via Conditional Access or Exchange Online settings closes a door most businesses don't realise is open.

Coach's tip: check your sign-in logs for legacy auth attempts before you block it, so you catch any old device or app that still needs updating first.

Endpoint protection covers antivirus plus things like ransomware behaviour blocking, device encryption checks and centralised alerting, so your IT support actually sees a threat instead of only the affected PC. Windows Defender is a genuinely solid baseline, but a managed endpoint solution adds visibility across every device and a central response when something is caught.

Coach's tip: the biggest gap isn't usually the software — it's nobody watching the alerts it generates.

A VPN is useful for reaching internal resources like an on-premises server or NAS that isn't otherwise published to the internet, but for most cloud-based businesses on M365 or Google Workspace, secure sign-in with MFA and Conditional Access does the heavy lifting instead. Consumer "privacy" VPN apps are a different thing entirely and rarely what a business needs.

Coach's tip: ask your IT support what the VPN is actually protecting — if the honest answer is "nothing anymore," it's fine to retire it.

BitLocker (Windows Pro/Enterprise) and FileVault (Mac) encrypt the hard drive so a lost or stolen laptop doesn't hand over your files and saved passwords to whoever finds it. It's built into the operating system at no extra cost and has minimal performance impact on modern hardware.

Coach's tip: write down the recovery key somewhere safe (your IT support or password manager) — encryption without a recorded key can lock you out of your own machine.

Sending a safe, simulated phishing email to your own team (many M365 and third-party tools support this) shows you who clicks, without any real risk, so you know where training is genuinely needed. Follow it with short, blame-free coaching for anyone who clicked — the goal is awareness, not punishment.

Coach's tip: repeat it every few months; one test creates a moment of awareness, regular tests create a habit.

A password manager (such as 1Password, Bitwarden, or the one built into your browser or OS) generates and stores a unique, complex password for every site, so a breach at one company doesn't hand over the keys to everything else. It also removes the temptation to reuse "Password123!" style variations that are trivially guessable.

Coach's tip: roll it out with a 20-minute team session showing people how to save and autofill — adoption fails when it feels like homework.

Length matters more than complexity for resisting modern cracking attempts — a random 16+ character passphrase of three or four unrelated words is stronger and easier to remember than "P@ssw0rd1!". Avoid predictable patterns like a capital letter at the start and a number or symbol at the end, since attackers' tools already expect that.

Coach's tip: let your password manager generate it — you don't need to remember most passwords at all, only the one that unlocks the manager.

Microsoft Entra and Google Workspace can both flag or block sign-ins from unusual locations, impossible travel (logging in from two countries within minutes), or after repeated failed attempts. Turn on sign-in risk alerts so someone actually gets notified, not just a log entry nobody reads.

Coach's tip: test it by asking your IT support to trigger a simulated risky sign-in — it's the only way to know the alert actually reaches someone.

Change the password immediately, revoke all active sign-in sessions (Microsoft Entra admin centre or Google Admin console both offer "sign out everywhere"), and check for new mail forwarding rules or app permissions the attacker may have added. Then check sent items and mailbox rules for signs of what they did while inside.

Coach's tip: attackers often add a quiet forwarding rule to a personal address — check for that first, it's the most common calling card.

A shared login (one password everyone uses) makes it impossible to tell who did what, and it can't easily be revoked for one leaver without disrupting everyone else. Where the software allows it, give each person their own account, even a free or basic one, and use role-based permissions instead.

Coach's tip: if a tool genuinely only supports one login, put it behind your password manager's sharing feature so nobody sees the raw password.

When someone leaves, disable (don't delete immediately) their M365 or Google account, remove them from shared mailboxes and Teams or groups, revoke app passwords and MFA devices, and change any shared passwords they knew. Keep a simple checklist so it's the same steps every time, regardless of who's doing the offboarding.

Coach's tip: disable first, delete a few weeks later — that gives you time to redirect mail and recover files without rushing.

Passkeys replace a password with a cryptographic key tied to your device and biometric (fingerprint or face), so there's no password to steal, phish or reuse in the first place. Microsoft, Google and most major services now support them, and they're genuinely simpler for users once set up.

Coach's tip: start with your own admin accounts, then roll out to the wider team once you're comfortable with the recovery process if a device is lost.

Most business laptops are good for 3-5 years of solid performance before ageing batteries, slower storage and rising software demands make replacement more cost-effective than repair. Budgeting for a rolling refresh, say a fifth of your fleet each year, avoids a painful all-at-once replacement bill and keeps everyone on supported hardware.

Coach's tip: check whether the laptop still receives security updates before assuming "it still works fine" is good enough reason to keep it.

Genuine paper jams are usually down to humidity, worn feed rollers, or paper stored somewhere too damp or dry — keep paper sealed until use and clean rollers periodically. "Low toner" warnings are often just a threshold estimate rather than empty, especially with third-party cartridges reporting differently to the printer's counter; check actual print quality before assuming a replacement is needed.

Coach's tip: a proper service or clean once or twice a year cuts jams dramatically — treat printers like any other piece of equipment that needs maintenance.

Start with the basics: airplane mode off, WiFi toggle actually on, and forget or reconnect to the network to clear a stale saved password. If it's one specific network that fails while others work fine, check the laptop's WiFi adapter driver is up to date and that the network isn't on a 5GHz-only band the adapter doesn't support well.

Coach's tip: a quick restart fixes more WiFi problems than any other single step — always try it before deeper troubleshooting.

Buying suits businesses that want to keep hardware longer and avoid ongoing payments; leasing suits businesses that want predictable monthly costs, easier budgeting, and automatic refresh every few years without a big upfront spend. Factor in that leased devices usually must be returned in good condition, so ask about wear-and-tear terms before signing.

Coach's tip: compare the total cost over the realistic lifespan you'd actually keep the device, not just the monthly headline figure.

Enrol the device into your management system, such as Intune or Google endpoint management, before handing it over, so security policies apply from day one rather than being bolted on later. Install standard apps, set up email and Teams sign-in, confirm MFA is registered, and test WiFi and printer access before the new starter's first morning.

Coach's tip: do this the working day before they start — first-day tech problems set a terrible tone and eat their manager's morning too.

A proper docking station, rather than a pile of separate cables, lets a laptop connect to monitors, network, keyboard and mouse with one cable, and makes hot-desking or working from home far less fiddly. Match the dock to the laptop's actual port type (USB-C or Thunderbolt) and check its power delivery is enough to charge the laptop while docked.

Coach's tip: label docks and cables per desk if several people hot-desk — mismatched docks cause more "my second screen doesn't work" calls than almost anything else.

Old laptops, phones and drives must have data properly wiped, not just deleted, before disposal or resale, and in the UK, WEEE regulations require electronic waste to go through proper recycling channels rather than the bin. A certified IT asset disposal provider can wipe data to a verifiable standard and issue a certificate of destruction.

Coach's tip: keep those certificates — they're useful evidence if you're ever asked how you handled data protection during disposal.

Check Teams has permission to use your camera and microphone in your operating system's privacy settings, which is the single most common cause, then confirm the correct device is selected in Teams' own audio and video settings rather than assuming the default is right. A quick sign-out and sign-in, or a restart of Teams, clears most other glitches.

Coach's tip: test your camera and mic a few minutes before an important call, not as the meeting starts — Teams has a built-in "make a test call" option for exactly this.

Channels inside a Team are for ongoing, topic-based, discoverable conversation that new joiners can scroll back through; chats are for quick one-to-one or small-group conversation that isn't meant to be a permanent record. Putting everything in chat means information gets lost and new starters can't catch up on context.

Coach's tip: if you find yourself explaining the same thing in three different chats, it probably belongs in a channel instead.

Use custom notification settings to mute channels you only need to check occasionally, and set priority access only for people who genuinely need to reach you urgently outside quiet hours. Quiet hours and quiet days settings can silence notifications outside working hours entirely.

Coach's tip: review your notification settings once — most people are drowning in Teams pings simply because they never touched the defaults.

Turning on recording with transcription captures both a video or audio file and a searchable text transcript, which is genuinely useful for anyone who missed the meeting or wants to search back for a decision. Always tell attendees a meeting is being recorded — most regions require it, and it's simply good practice.

Coach's tip: set recordings to expire or auto-delete after a set period unless someone actively saves them, so you're not quietly accumulating a huge, unmanaged video archive.

Files shared in a Teams channel or chat are stored in SharePoint or OneDrive behind the scenes, meaning everyone works on the same live version instead of five different attachments called "final_v3.docx". Use the Files tab in a channel as the single source of truth rather than re-uploading updated copies over email.

Coach's tip: if you're still emailing attachments to colleagues who are in the same Team, you're creating exactly the version-control mess Teams was built to avoid.

Guests invited into a Team can typically see the channels and files they're added to, but not your organisation's other Teams, unless deliberately given access — it's worth checking your tenant's guest access settings match what you actually intend. For a single external meeting rather than ongoing collaboration, a meeting invite is usually simpler and safer than making someone a full guest.

Coach's tip: periodically review who has guest access — it's an easy thing to grant and an easy thing to forget to remove.

Your Teams status (Available, Busy, Do Not Disturb) and calendar sync tell colleagues when it's genuinely fine to interrupt you, which cuts down on unnecessary pings and back-and-forth scheduling. Block out focus time on your calendar if you need uninterrupted work, since Teams reflects that status automatically.

Coach's tip: a status that's always "Available" trains colleagues to interrupt you constantly — use it honestly and people adjust.

As the admin, you can enforce 2-Step Verification for every user from the Admin console (Security > 2-Step Verification), which is the single biggest step to stop account takeovers, exactly as with Microsoft 365. Give staff a grace period and clear instructions before making it mandatory so nobody gets locked out on day one.

Coach's tip: encourage Google Authenticator or a security key over SMS codes — SMS can be intercepted via SIM-swap attacks.

Files saved in an individual's "My Drive" belong to that person and can become orphaned or hard to find if they leave the business; Shared Drives are owned by the team or organisation, so access and files remain intact regardless of who joins or leaves. Move any business-critical folders into Shared Drives rather than a personal My Drive.

Coach's tip: when offboarding someone, always check their My Drive for anything important before suspending the account — it's the step most often missed.

Filters can automatically label, archive, forward or flag incoming mail based on sender, subject or keywords, which is far more reliable than manually sorting mail after the fact. Combine filters with labels, Gmail's flexible alternative to folders, so one email can sit in multiple relevant categories at once.

Coach's tip: start with one filter for your noisiest recurring sender, a newsletter or automated system, rather than trying to build a perfect system in one sitting.

If your business already runs on Google Workspace, Google Meet integrates seamlessly with Calendar and Gmail invites, meaning fewer extra logins and licences for something you already have. Mixing platforms is fine occasionally for external meetings, but standardising internally avoids "which link do I send" confusion and extra subscription costs.

Coach's tip: pick one primary platform for internal meetings and stick to it — the tool matters far less than everyone knowing which one to expect.

Google Vault lets you retain, search and export Gmail, Drive and Chat content for legal, compliance or investigation purposes, which matters if your business has any regulatory record-keeping requirements. It is not a backup in the traditional sense — it's a retention and search tool, so don't rely on it alone as your disaster-recovery plan.

Coach's tip: check whether your specific Workspace edition includes Vault before assuming it's available — it varies by plan.

Over time, staff often connect random third-party apps to their Google account for calendar syncing, scheduling tools or note-taking apps, each of which is granted some level of access to your data. Review connected apps periodically (Admin console > Security > API controls, or an individual's Google Account > Security) and remove anything nobody remembers authorising.

Coach's tip: treat "Sign in with Google" the same way you'd treat handing over a password — check what access it's actually asking for before clicking allow.

Large attachments in Gmail, big files and old versions in Drive, and Google Photos backups if enabled, are usually the biggest space users across a domain. The Admin console's storage reports show usage per user, so you can find and address the real culprits rather than guessing.

Coach's tip: check Google Photos backup settings specifically — many people don't realise their phone is quietly filling company storage with personal photos.