Notebook / Microsoft 365

Microsoft 365 for a two-person company: what we set up and what held us back.

Kenea is two partners. We set up our Microsoft 365 between 15 and 17 September 2026 with one fixed idea: a single site, numbered folders and everything repetitive done by a script. This note covers what stayed and what cost us two days.

Author: Alfonso del Busto · Published: 18 September 2026.

One site, five libraries

We did not create a Teams team per client or a site per project. There is a single SharePoint site, the Kenea Hub, with five numbered document libraries so that the order on screen is the order of work: 01 Clients, 02 Projects, 03 Sales, 04 Company and 05 Templates.

• Every client gets the same folder: 01 Brief and sources, 02 Proposal, 03 Contract, 04 Build, 05 Deliveries, 06 Meetings and 07 Archive. Old versions of a document move to 07 Archive; they are never deleted.
• Every internal project has four stages: 01 Definition, 02 Design, 03 Build and 04 Operation. An empty folder says as much as a full one: if 03 is empty, the project has not been built.
• The site's front page is one page with the logo, a five-entry index and three shortcuts: clients, projects and operations. No news, no banners.

Mail: one licence, two aliases

A single Business Basic licence with two aliases, hola@ and contacto@, instead of one mailbox per address. The domain stays at Arsys: SPF with -all, DKIM active with Microsoft's two selectors and DMARC at p=none while we read the reports. Verified on 13 September 2026.

The repetitive part, by script

Creating forty folders by hand invites a mistake on the fourth. We did the first provisioning with PnP.PowerShell; then we wrote a Python script of about two hundred lines, with no dependencies, that talks to Microsoft Graph: it audits the site, creates missing folders without touching existing ones, uploads files (in chunks above 3 MB), moves versions to the archive and edits the front page. It authenticates with our own application registered in Entra ID as a public client, with a device code: no stored secrets, and the token lives in a file readable only by the user.

The three blockers

1. Security defaults. With them on, Entra ID rejects device-code sign-in from an unregistered machine (error 530035), and a tenant without a P1 licence has no Conditional Access to replace them with finer rules. Turning them off was a conscious decision, with MFA active on both accounts.
2. Public client flows disabled. A new application is born without permission for the device-code flow; the error (7000218, “client secret missing”) does not say that what is missing is a switch on the authentication tab. It cost us an afternoon.
3. What Graph does not cover. Graph creates folders, uploads files, edits a page's title area and deletes web parts. It does not change the site's home page or its menu: that is the SharePoint REST API, which requires a separate consent and does not accept Azure CLI tokens.

What we would do again

Number things. One site. Identical folders for every client. And a script instead of a written procedure, because the script runs and the procedure gets forgotten. What a two-person company can do without is everything else: channels, planners and news pages nobody will read.