Managed IT for not‑for‑profit organisations

If your organisation is covered by the Privacy Act, which includes not-for-profits with annual turnover above $3 million and any organisation providing a health service, a breach likely to cause serious harm must be assessed within 30 days and notified to the OAIC and the people affected. Organisations that make a ransomware payment and have turnover above $3 million must also report it to the Australian Signals Directorate within 72 hours. Our incident plans cover containment, evidence and these notifications.

Yes, with the right setup. Microsoft 365 Copilot works within each user’s existing permissions, so permissions, sensitivity labels and DLP need to be in place before rollout. We review access to client and case records, label sensitive information and agree which AI tools are approved. Decisions about client consent and how notes are used stay with your organisation’s policies.

Eligible not-for-profits can access Microsoft grants and discounts once validated. Microsoft no longer donates Microsoft 365 Business Premium licences, so most organisations now use discounted licences, and Connecting Up gives ACNC-registered charities access to donated and discounted products from Microsoft and other vendors. Grants generally cover paid staff and unpaid executives, discounted licences can extend to volunteers, and members, donors and the people you serve aren’t eligible. We check eligibility and match the available licences to staff, volunteer and board roles.

By role. Board members get secure access to board papers without operational systems, volunteers get limited access to the files and email they need, and contractors get time-bounded access that ends with their engagement. MFA, Conditional Access and regular access reviews keep it controlled as people come and go.

Yes. App protection policies through Microsoft Intune keep organisation email and files inside managed apps such as Outlook and Teams, block copying to personal storage and allow a remote wipe of organisation data only, without touching personal photos or apps.

Field staff get managed tablets and phones with encryption, MFA and remote wipe, mobile data and secure access to client records. Lone-worker safety apps and case apps run on devices that are kept patched and supported.

We handle the IT around the change: identity and single sign-on, device setup, Microsoft 365 integration, data moves, vendor access during the project and staff sign-in at go-live. The platform build itself sits with the vendor, and we coordinate with them throughout.

Yes. Larger not-for-profits often have a head of technology or a small internal team. Co-managed IT adds depth across Microsoft 365, security monitoring, backup, networks and escalation, without duplicating what your team already handles.

You can check the health of your environment at any time through your support portal, and you get a monthly snapshot of support, security and backup activity. Each quarter we meet to look ahead at new offices and programs, device replacements, platform changes, licensing and security improvements, timed around your budget and funding cycles. The reporting and meeting rhythm is set to suit your organisation.

The price depends on users, sites, the technology being managed and security requirements. Microsoft licensing, hardware and project work are identified separately, and we review licensing to keep that cost down. Use our Managed IT cost calculator for an indicative estimate.

We start by documenting your environment: access, devices, Microsoft 365, client and finance platforms, vendors, security controls and any open issues. We then bring each area under management in stages, beginning with monitoring and backup.

Charities registered with the ACNC must keep financial and operational records for seven years, and the records must explain their transactions and show how the charity is meeting its obligations. Keeping them in Microsoft 365 works well when the storage is structured, access is controlled by role, retention is set to match, and backups are tested, so records can be found and restored years later.