CyberOne

Microsoft 365 Licensing & Microsoft Azure Cloud Subscriptions Managed Service

CyberOne Managed Licensing and Subscriptions simplifies Microsoft 365 licensing and Azure cloud subscription management. We help you select the right plans, optimise spend, manage renewals, add or remove users, maintain compliance and ensure governance. Backed by Microsoft security expertise, we reduce admin effort and keep your environment scalable and cost-effective.

Features

• Centralised Microsoft 365 tenant licensing management across all user accounts.
• Azure subscription provisioning, RBAC setup and secure access controls.
• Licence optimisation reviews identifying unused licences and cost reduction opportunities.
• Automated renewal tracking with proactive alerts and renewal planning support.
• Optional: User onboarding and offboarding including licence assignment and removal.
• Secure billing consolidation with clear chargeback reporting by department.
• Governance controls for subscription sprawl, tagging, budgets and policies.
• Remote administration support for licence changes and subscription adjustments.
• Compliance alignment for Microsoft agreements, audit readiness and reporting.
• Optional: Monthly service reporting covering consumption, changes, risks and recommendations.

Benefits

• Reduce wasted spend by removing unused licences and subscriptions quickly.
• Simplify procurement with one partner managing Microsoft licensing end-to-end.
• Speed up user onboarding by assigning correct licences immediately.
• Improve governance by controlling subscription growth and enforcing policies.
• Maintain compliance with clear visibility of entitlements and usage.
• Reduce admin effort through managed changes and renewal tracking.
• Increase security by applying least privilege access to Azure subscriptions.
• Avoid service disruption with proactive renewals and billing oversight.
• Gain predictable costs through consolidated billing and budget management controls.
• Make faster decisions using monthly insights, trends and optimisation actions.

• Education pricing available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at ben.harding@cyberone.security. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

132333508337923

Contact

Ben Harding
+44 3452 757575
ben.harding@cyberone.security

About the service

• Service categories:
  • Applications
    • Collaborative
      • Conferencing and virtual event
        • Web Conferencing Applications
      • Email
        • Email
      • Enterprise community
        • Enterprise community
      • Team collaboration
        • Team collaboration
• Multi cloud support: Yes

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: Microsoft 365, Microsoft Azure, Microsoft Power BI, Microsoft Dynamics 365, Microsoft Security, Microsoft Sentinel
• Cloud deployment model: Public cloud
• Service constraints: No
• System requirements:
  • Computer & Processor: 1.6 GHz or faster, Dual-core.
  • Operating System: Windows 11, Windows Server 2025
  • Memory: 4 GB RAM; 2 GB RAM (32-bit)
  • Display: 1280x768 screen resolution (32-bit requires hardware acceleration)
  • Graphics: Graphics hardware acceleration requires DirectX9 or later.
  • Browser: Current version of Edge, Safari, Chrome or Firefox
  • Internet functionality requires connection.
  • Microsoft account and/or organisational account for licensing

User support

• Email or online ticketing support: Yes
• Support response times: ENHANCED HOURS 24x7 x 365 Days P1: Critical - i.e. System Outage 30 Minutes P2: High - i.e. System Fault 1 Hour STANDARD HOURS Monday – Friday 8am - 5:30pm P3: Medium - i.e. Device Fault 2 Hours P4: Low – i.e. Single User Fault 4 Hours P5: Very Low – i.e. Request For Info, Standard MACD 8 Hours
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Fully managed service. Support is commercially scoped pending a full discovery workshop phase.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Users are provided guidance with license requirements. We will help to tailor user requirements to specific Microsoft 365 and Azure services and furthermore, provide ongoing support of those licenses for the end user.
• Service documentation: Yes
• Documentation formats: PDF
• Documentation accessibility standard: WCAG 2.2 AA
• End-of-contract data extraction: The data within the Microsoft 365 and/or Azure environments are property of the end client. CyberOne access at the end of the contract is removed, therefore there is no need for data extraction.
• End-of-contract process: At the end of the contract, dependent on what the end client organisation intends to do. License procurement and provisioning services will move to the new provider (or internal IT team where applicable). Service support will cease after the offboarding process has been completed. Offboarding processes are followed to ensure that there is no service disruption whilst maintaining a professional and seamless handover to a new provider.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
  • Other
• Application to install: Yes
• Compatible operating systems:
  • Android
  • IOS
  • MacOS
  • Windows
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Access to the service portal is via a web browser and can be accessed via mobile with no differences to the experience.
• Service interface: Yes
• Description of service interface: The service interface is via the support portal where users can access ticket information, raise new tickets, provide updates on existing cases and close tickets. Notifications from CyberOne will also be received via the service portal. Communication with end-users is via telephone where needed, ticket updates for passive comms and via portal to ensure users always know the latest updates on their requests.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: Dependent on the device or browser used, users can increase the text size available and control focus indicators.
• User support accessibility: WCAG 2.2 AA
• API: No
• Customisation available: Yes
• Description of customisation: Different reporting options are available to monitor and manage service and license utilisation. This customisation can be determined at the onboarding stage of any opportunity with the buying organisation.

Scaling

• Independence of resources: Service continuity: Microsoft offerings are delivered by highly resilient systems that help to maintain peak service performance. Service continuity provisions are part of the system design. These provisions enable Microsoft to recover quickly from unexpected events such as hardware or application failure, data corruption, or other incidents that affect users. These service continuity solutions also apply during catastrophic outages (for example, natural disasters or an incident within a Microsoft data centre that renders the entire data centre inoperable).

Analytics

• Service usage metrics: Yes
• Metrics types: License utilisation reports can be offered for Microsoft 365 licenses. For Azure, Compute (CPU and Memory) and Storage consumption reporting is also available.
• Reporting types:
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Supplier type

• Supplier type: Reseller providing extra features and support
• Organisation whose services are being resold: Managed Licensing, Consulting, Professional Services and Managed Services

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
  • Other locations
• User control over data storage and processing locations: Yes
• Datacentre security standards: Supplier-defined controls
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CHECK service provider
• Protecting data at rest: Physical access control, complying with another standard
• Data sanitisation process: Yes
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: In Microsoft Azure, end-users have several options for exporting data, depending on the services they are using. Overview of the data you can export: Virtual Machine (VM) Data, Logs and Metrics, Resource Templates, Data Lake Storage, Blob Storage, Azure Active Directory (AD) Information.; ; In Microsoft 365, end-users/administrators can export data from:; - Outlook - emails, calendars and contacts in PST format.; - OneDrive - Download files or entire accounts.; - SharePoint Online: Download documents and lists; - Power BI: Export reports and data visualizations; - Dynamics 365: Export data to Excel or other databases.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • PDF
  • XML
  • HTML
  • DOC
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Microsoft Cloud Platforms are available 24x7x365 and maintain 99% availability.
• Approach to resilience: Not applicable. The data centre is Microsoft-owned.
• Outage reporting: All outage alerts are reported via email. Furthermore, the status of the Microsoft service can be monitored at https://portal.office.com/servicestatus and via API

Identity and authentication

• User authentication needed: Yes
• User authentication: Multi-Factor Authentication (MFA)
• Access restrictions in management interfaces and support channels: Access to management interfaces is confined solely to trusted IP addresses and clearly defined Role Based Access Controls restrict access to individuals who specifically need access to functionality or data.
• Access restriction testing frequency: At least every 6 months
• Management access authentication: Multi-Factor Authentication (MFA)

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: ISO27001

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Any configuration changes within the Microsoft cloud platform are documented within the Ticketing system and communicated to relevant stakeholders for approval prior to any scheduled changes. All changes are documented.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Potential threats are assessed via continuous internal, external, application, network and agent-based vulnerability scanning, supplemented via regular penetration testing. Identified vulnerabilities are prioritised based on factors such as severity, potential impact and likelihood of exploitation. Remediation, including the application of security patches, is performed in a timely manner after evaluation and testing, typically shortly (< 24 hours) after vendor patch release. Threat data is procured from a number of third-party sources and integrated into our vulnerability management process.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: CyberOne utilise our in-house Security Operation Centre to monitor all systems for potential compromises using a combination of automated monitoring tools and manual security assessments. When a potential compromise is detected, our incident response team, consisting of experienced security analysts, investigates further. Depending on the nature of the compromise, response actions may include isolating affected systems, disabling compromised accounts, and implementing further containment measures. Critical and high-priority incidents are actioned immediately.
• Incident management type: Supplier-defined controls
• Post-quantum cryptography secure: Yes
• Incident management approach: Microsoft works continuously to provide highly secure, enterprise-grade services for Microsoft customers, but security incidents are an inevitable reality that you must thoroughly and swiftly manage. Microsoft online services security teams and the various service teams work jointly and take the same approach to security incidents:; - Preparation; - Detection and Analysis; - Containment, Eradication, and Recovery; - Post-Incident Activity

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 2%
• Between £500,001 and £1,000,000: 4%
• Between £1,000,001 and £2,500,000: 6%
• Between £2,500,001 and £5,000,000: 8%
• Over £5,000,001: 10%

Standards and certifications

• ISO/IEC 27001 certification: Yes
• ISO/IEC 27001 accredited by: BSI Assurance UK Limited
• ISO/IEC 27001 accreditation date: Tuesday 5 December 2017
• What the ISO/IEC 27001 doesn’t cover: N/A
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber Essentials Alternative: None of the criteria
• Cyber essentials plus: No
• Cyber Essentials Alternative: None of the criteria
• Other security certifications: Yes
• Any other security certifications:
  • CREST Security Operations Centre
  • CREST Cyber Incident Response
  • NCSC Assured Service Provider
  • NCSC Assured Service Provider Cyber Incident Response (Level 1)
  • Microsoft Intelligent Security Association & Verified Managed XDR Solution Partner

Social value

• Mission: Kick start economic growth:

  To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

  Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

  • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
  • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
  • Plans to engage the contract workforce in deciding the most important workplace issues to address
  • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
  • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
  • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
  • Activities to cascade good practice on fair working conditions throughout the supply chain
  • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
  • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary
  • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
  • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
  • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
  • Support for the contract workforce by providing career advice, and providing opportunities for staff working on the contract with in-work progression career development into known skills shortages or high growth areas
  • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
  • Volunteering opportunities for staff
  • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
  • Measures to identify, mitigate and manage modern slavery risks relating to the contract and how these will be implemented
  • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling
  • How these flow down the supply chain and are monitored Illustrative examples include reporting, site visits, audits, etc.
  • How to ensure business decisions re: price/cost, short lead times, payment timescales do not create modern slavery risks in the supply chain

  Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

  • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges
  • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
  • Activities to support relevant sector related skills growth and sustainability in the contract workforce. Illustrative examples: careers talks, curriculum support, literacy support, safety talks and volunteering

  Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

  • Activities that demonstrate a collaborative way to work with a diverse range of businesses as part of the supply chain
  • Methods for engaging with different parts of the community (including the education system and charities representing the community) and how communities come together to inform decisions, strategy and projects to leave a positive legacy for future generations
  • Plans for positive actions with community groups.
  • Plans to respond flexibly and adapt approaches to community engagement and initiatives
  • Collaborating with anchor institutions and community groups to make facilities available for education, training or community events
• Mission: Make Britain a clean energy superpower:

  To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

  Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

  • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
  • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
  • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement
  • Activities to reconnect people with the environment and increase awareness of ways to protect and enhance it
• Mission: Break down barriers to opportunity:

  By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

  Policy Outcome 6: Employment and training: For those who face barriers to employment

  • Understanding of the issues affecting the representation of disabled people in the workforce in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
  • Inclusive and accessible recruitment practices, and retention-focused activities, including those provided in the Guide for line managers on recruiting, managing and developing people with a disability or health condition
  • Introducing transparency to pay and reward processes
  • Working conditions which promote an inclusive working environment and promote retention and progression
  • Other measures to provide equality of opportunity for disabled people and those with health conditions into employment, including becoming a Disability Confident employer and inclusion of supported businesses in the contract supply chain
  • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce
  • Inclusive and accessible development practices, including guidance for line managers on recruiting, managing and developing people with a disability or health condition

  Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

  • Understanding of issues relating to entering the contract workforce
  • Creation of outreach activities to create a pipeline of employees for the future contract delivery
• Mission: Build an NHS fit for the future:

  That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

  Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

  • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
  • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion
  • Inclusive and accessible recruitment practices, development practices and retention policies that support-focused activities including those provided in the Guide for line managers on recruiting, managing and developing which support people with a disability or health condition
  • Actions to invest in the physical and mental health and wellbeing of the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at ben.harding@cyberone.security. Tell them what format you need. It will help if you say what assistive technology you use.