Keizer Computer It

Microsoft has installed Copilot on business computers automatically.

It's worth getting your files in order before you use it.

Copilot can see any file the person using it can already open.

In most businesses, that's a lot more than it should be.

Files get shared with "everyone" for convenience. Folders get opened up for a project and never closed again. It piles up over the years, and no one notices, because no one goes looking through it all.

Once Copilot is in the mix, people don't have to go looking. They ask a question, and it answers using anything it's allowed to see, including files that were left open to the whole company by mistake.

So before you let the team use it, get someone to check your file permissions, starting with HR and finance. People should only be able to see what they need to.

Whoever controls your domain name controls your whole business.

Your domain is the address behind your website and your email. It sits in an account at whatever company you registered it with, like GoDaddy.

Anyone who can log into that account can point your website and email wherever they like.

At a lot of small businesses, nobody knows who has that login. It was set up years ago by a web guy who's long gone, or it's under one staff member's personal email with a password that hasn't changed since.

If someone gets into that account, they don't need to hack anything else.

They can send your website visitors to a fake page that still shows your real address.

They can take over your email and reset the passwords on everything tied to it.

They can send your clients an invoice from your real address, and your clients will pay it, because it came from you.

So go and check who controls the account, whether it's got two-factor login switched on, and whether the domain lock is turned on, which stops anyone moving your domain elsewhere.

While you're in there, set it to auto-renew so it can't expire.

If you deleted a OneDrive file recently and went looking for it in your Recycle Bin… surprise, it's not there.

Starting in May 2026, files deleted from OneDrive or SharePoint in the cloud no longer appear in your local Recycle Bin or Trash.

They are removed directly from your device and can only be recovered from the OneDrive or SharePoint web‑based recycle bin.

1. Go to onedrive.com or your SharePoint site

2. Click "Recycle bin" in the left menu

3. Right-click the file and select "Restore"

You typically have 30 days before files move to the second‑stage recycle bin (which most people don’t know about), and up to 93 more days there, depending on your organization’s settings.

After about 123 days, they’re gone for good.

If you signed up for AI tools over the past 18 months and haven't reviewed them since, you're probably wasting money.

A March 2026 audit of 102 small businesses found that 87% had significant waste in their AI subscriptions, with a median of $18,000 wasted per year.

Most owners go through the same pattern. You signed up for ChatGPT, then Claude, then a transcription tool, then a meeting note-taker, then a writing assistant. Most of these tools now do what the others do.

Three signs your AI stack needs an audit:
▶️ You're paying for two tools that do the same thing
▶️ Your team stopped using a subscription you're still paying for
▶️ You can't quickly explain the ROI of each tool

While you're at it, check the security too:
✅ Make sure every tool is on a business plan with a "Do Not Train" clause. Consumer plans feed your data into the model.
✅ Remove access for ex-employees. AI tools get forgotten during offboarding.
✅ Check what's connected to your Microsoft 365 or Google Workspace. AI tools often have access to your email and files you never noticed.

If you've ever spent 5 minutes hunting through Teams trying to find a meeting recording, there's a feature you should be using.

It's called the Meet app, and it's already built into Teams. No Copilot license required.

The Meet app gives you a single dashboard for every meeting you've had or are about to have. Click on any meeting and you get the agenda, recording, transcript, chat, and shared files, all in one place.

To find it:

1. Open Teams

2. Click the three dots on the left navigation bar

3. Search for "Meet"

4. Right-click and pin it so it stays in your sidebar

Once pinned, you'll see two views: upcoming meetings and past meetings. Click any past meeting to see everything tied to it.

Finding what was discussed in last month's leadership review used to take 5 minutes of digging through your calendar, recordings, and SharePoint.

With Meet, it takes 30 seconds.

Your business email is worth more than your bank account.

Stolen Microsoft 365 credentials remain the most common starting point for SMB breaches in 2026, and the reason isn't just that attackers can read your messages.

Once someone has access to your email, they can reset the password for every other account tied to that address.

Your bank, your accounting software, your CRM, your cloud storage.

Email is the master key to your entire digital business.

What attackers typically do once they get in:

▶️ Set up mailbox forwarding rules so they keep seeing your replies after you change the password

▶️ Send invoice fraud emails to your clients from your real account, often changing wire transfer details

▶️ Sit for weeks, learning your business, before making a move

Three things that meaningfully reduce this risk:

✅ Use phishing-resistant MFA where possible (FIDO2 hardware keys or Windows Hello for Business). Authenticator app prompts are better than nothing, but they can still be bypassed.

✅ Set up Conditional Access policies in Entra ID to block logins from countries you don't operate in.

✅ Review your mailbox forwarding rules monthly. In Outlook, go to Settings > Mail > Forwarding. If you see a rule you didn't create, that's a sign your account is compromised.

The monthly audit takes 5 minutes and it’s one of the highest-leverage security habits you can build.

If an email asks you to download a tool to "view a document," stop and verify before clicking.

A growing attack pattern is tricking employees into installing real IT software on their own machines.

The software is called RMM (Remote Monitoring and Management), and it lets IT companies remotely control computers for support purposes.

Tools like ConnectWise ScreenConnect, Datto RMM, SimpleHelp, N-able, and LogMeIn are all legitimate and digitally signed by reputable vendors.

That's exactly why attackers love them. Antivirus software doesn't flag them as malicious because they aren't malicious. They're just being installed by the wrong person.

In February 2026, Microsoft documented a campaign that hit 29,000 users across 10,000 organizations.

The lure was a fake "IRS Transcript Viewer" email. The download was actually a repackaged ScreenConnect installer.

Once an employee ran it, the attacker had full remote control of their machine.

The same trick is being used with fake Zoom invites, fake Teams calls, and fake DocuSign emails.

A few things you can do:

▶️ Ask your IT provider to maintain an allow-list of approved RMM tools. Anything outside that list gets blocked from installing automatically.

▶️ Train your team that "download this viewer to see your document" is almost always a phishing attempt. Real documents don't require a new program.

▶️ Audit your endpoints for RMM software your IT provider didn't install. If you see something unfamiliar, fla

If your business uses a generic email like info@, sales@, or support@, there's a good chance you're paying for it incorrectly.

The default approach most SMBs take is to set up a regular user mailbox, share the password between staff, and call it a day.

That setup creates two real problems.

1) There's no audit trail of who sent what.

When someone leaves, they still have the password. And shared passwords are one of the most common ways small businesses get compromised.

2) You're paying for a Microsoft 365 license on a mailbox that no human owns.

Microsoft 365 has a built-in feature that solves both: Shared Mailboxes.

A Shared Mailbox lets multiple staff access the same email address (info@, support@, etc.) using their own personal logins.

Replies appear to come from the shared address.

Every action is logged under the individual employee. And it does not require a separate license if the mailbox stays under 50 GB.

How to set one up:

1. Sign in to admin.microsoft.com

2. Go to Teams & groups > Shared mailboxes

3. Click Add a shared mailbox

4. Enter a display name and email address

5. Click Add members and choose who gets access

Members can read, send from, and manage the shared address from their own Outlook within an hour.

When an employee leaves, you remove them from the mailbox in 30 seconds.

There are no password changes, and no risk of an ex-employee still reading client emails.

If you use Excel and Microsoft 365 Copilot, an upgrade from March 2026 might save you hours every week.

It's called Work IQ, and it changes how Copilot handles spreadsheets.

Before, you had to manually feed Copilot the data you wanted it to use. Copy figures from an email, paste them into Excel, then ask Copilot to clean it up.

Now, Copilot can pull context directly from your related emails, Teams chats, meetings, and files in your Microsoft tenant. It reads the source material itself.

You can do things like:

▶️ Reconcile a vendor invoice against the quoted price by pointing Copilot at the original email thread.

▶️ Update a sales forecast based on the recap of yesterday's pipeline meeting.

▶️ Reformat a messy data dump a client sent over.

To use it, you need a Microsoft 365 Copilot license and the document stored in your business tenant, not a personal OneDrive.

One note on security: Copilot can only access files the user already has permission to see.

If your SharePoint and OneDrive permissions are messy, Copilot will surface things you didn't intend to share.

Audit your file permissions before turning this loose on your team.

The one Outlook rule you need to set to save yourself from awkward conversations.

It's called "delay delivery." You set it once in classic Outlook, and from that point on every email you send sits in your Outbox for a specific time (that you set) before it leaves.

If you spot a typo, realize you sent the wrong attachment, or wrote something in frustration you wish you hadn't, you have can a standard 2-minute delay to give you enough time to stop it.

Just delete the email from your Outbox before the timer runs out.

To set it up in classic Outlook:

1. Go to File > Manage Rules & Alerts

2. Click "New Rule" and pick "Apply rule on messages I send"

3. Skip past the conditions so it applies to every email

4. Check "defer delivery by a number of minutes" and set it to 2

5. Save the rule

This is better than Outlook's built-in "Recall" feature, because it works every single time.