Microsoft 365 Integration in New Zealand

Audit the licence before you buy anything

This is the highest-value hour in the whole project, and it is frequently skipped because it does not feel like work.

Most New Zealand businesses on Microsoft 365 are paying for a good deal they do not use:

• Power Automate and Power Apps at a useful level, included in many plans. A great many approval workflows need nothing else.
• SharePoint lists, which cover a surprising amount of what people commission small databases for.
• Forms, for anything you were about to build a form for.
• Security and device management in higher tiers, often bought again from another vendor.
• Bookings, which replaces a scheduling subscription for simple cases.

Ask every firm to review what you hold before proposing anything. Occasionally it ends the project, and a consultant willing to let that happen is one worth keeping.

Configuration first, code when it runs out

The Power Platform genuinely covers a lot, and what it covers can be maintained by someone in your own business rather than by an invoice.

It runs out when:

• The rules are complex enough that a flow becomes unreadable.
• You need an audit trail that cannot be edited by anyone with list access.
• Volumes push you into premium connectors or per-user licensing that costs more than building.
• The integration has to reach a system no connector covers — usually your own software.
• The interface has to be better than a generated form.

Ask each firm to mark which parts of their proposal are configuration and which need code, and to justify the code. Configuration you can change next quarter; code comes back to them.

Put the work where your staff already are

The most valuable integrations are the ones that remove a tab.

What that looks like in practice:

• An approval arriving in Teams with enough detail to decide, and approve or decline in the message.
• A customer record visible in Outlook beside their email.
• A job created in your system generating its SharePoint folder, named correctly, permissioned correctly, with the template documents already in it.
• A calendar event created when a booking is made, with the right people invited.

Each removes a step somebody currently does by hand and forgets under pressure. That is where the return is — not in a dashboard.

Permissions need an owner and a conversation

Microsoft Graph applications request permissions, and the broad ones need an administrator's consent. "Read all files in all site collections" is a substantial grant and deserves a moment's thought.

Ask each firm:

• Exactly which permissions does this need?
• Can it be scoped to specific sites or mailboxes rather than everything?
• Is it acting as itself, or on behalf of the signed-in user?
• Who approves the grant, and is that recorded?

Acting on behalf of the user is usually the safer pattern where it fits, because the platform's own permissions still apply. An application with tenant-wide access has whatever access it was granted, forever, until someone reviews it — and nobody reviews it.

Ask who maintains it afterwards

Microsoft ships changes continuously and deprecates connectors and API versions on published schedules. Somebody has to be watching.

The questions worth asking:

• Can our own administrator change the flows, or does every adjustment come back to you?
• Is anything here using a preview feature that may change?
• Is ongoing compatibility included in support, or billed each time?
• What documentation do we get, and does it cover what to do when a flow fails?

Flows that stop quietly are the characteristic failure here. Ask how a failure reaches a person — the default in many builds is that it does not.

Know where the data sits

Microsoft's data residency for New Zealand customers is generally Australian, with a local presence developing. For most businesses that is unremarkable and nobody asks.

If a customer contract or your own policy requires data to stay in New Zealand, put it in the brief. It constrains what is possible, it affects which services can be used, and it is far better raised during quoting than during a security review.

Start with the thing people complain about

Do not commission a platform. Pick the one process people grumble about — usually an approval that goes missing, or files that end up in the wrong place — and fix that.

It delivers in weeks, it teaches you what your own licensing can do, and it earns the credibility for the next piece. Ask each firm what they would build first; the ones who name a single process have done this before.

Comparing five quotes

Read for:

• Who audited your existing licensing before proposing anything?
• Who separated configuration from code, and justified the code?
• Who named the exact permissions their app requires?
• Who explained what your own administrator can maintain?
• Who described how a failed flow reaches a person?

Describe the process that is causing trouble, which Microsoft 365 plan you are on, and which of your own systems needs to be involved. Firms who work in this platform daily will ask about your licence before they ask about your requirements.