Why the IT Bloke Who Set Up Your Office Network Ten Years Ago Might Not Be the Right Person for Cloud

There is a pattern that plays out across thousands of UK small businesses. Someone — a friend of the owner, a relative, a bloke from the golf club — set up the office network years ago. He installed the server, ran the cabling, configured the router, and has been the person you call when the printer stops working or someone forgets their password. He might be good at what he does. The problem is that what he does and what your business now needs are not the same thing. Moving to Microsoft 365 or Google Workspace is not a bigger version of setting up a Windows Server. It is a different discipline. Cloud identity management, conditional access policies, data loss prevention, SharePoint architecture, and Entra ID configuration are not skills that transfer automatically from on-premises networking. A third of UK small businesses report that technical skills gaps are a barrier to cloud adoption, and the person who built your network in 2014 is statistically unlikely to have retrained for a cloud-first world. This is not about loyalty. It is about competence matching the task.

The Skills That Got You Here Will Not Get You There

Setting up an on-premises network in 2014 required a specific skill set. Running Cat5e cable, configuring a Windows Server with Active Directory, setting up a NAS for file shares, managing a local Exchange server or POP3 email, and troubleshooting printer drivers. These are real, legitimate skills. They kept your business running for years.

Cloud platforms require a different set of skills. Microsoft 365 administration means understanding Entra ID (formerly Azure Active Directory) for identity management, configuring conditional access policies that control who can access what from where, setting up SharePoint Online for document management rather than a mapped network drive, managing Teams governance, and implementing data loss prevention policies. Google Workspace has its own equivalents — Google Admin console, organisational units, Drive sharing policies, context-aware access.

The gap between these two skill sets is not trivial. A 2023 SoftwareOne study found that 95 per cent of IT decision-makers believe their teams have been negatively affected by the cloud skills gap. Over 80 per cent of UK firms report that IT skills shortages are affecting their operations. The person who set up your office network is not failing because they are incompetent — they are failing because the technology moved and they did not move with it.

The pace of that movement matters. Microsoft alone updates its 365 platform with hundreds of feature changes per year. Entra ID conditional access policies that did not exist three years ago are now considered baseline security configuration. Google Workspace has introduced context-aware access, DLP rules, and Vault retention policies that require ongoing study to implement correctly. The professional IT sector keeps pace through continuous certification and vendor training — the Microsoft 365 Certified: Administrator Expert exam, for example, is updated regularly to reflect platform changes. An informal IT contact who set up your network a decade ago and has not pursued structured training since is working from a mental model of technology that no longer exists.

What Goes Wrong When the Wrong Person Handles Cloud Migration

The consequences of a poorly executed cloud migration are not theoretical. They are specific and they are expensive.

Identity and access misconfigurations are the single biggest risk. If your IT person sets up Microsoft 365 without properly configuring Entra ID, conditional access, and multi-factor authentication, you end up with an environment where every user has the same access to everything, there are no controls on which devices can access company data, and a compromised password gives an attacker the keys to your entire organisation. This is not a hypothetical — it is the default configuration if nobody actively changes it.

Data placement errors cost time and money to fix. If your IT person migrates files from a local server to SharePoint without planning the site structure, permissions model, and naming conventions, you end up with a flat dump of files that nobody can navigate. Staff revert to emailing documents to each other, which defeats the purpose of the migration. The average UK SMB cloud migration runs 14 per cent over budget, and a large share of that overrun comes from rework caused by poor initial planning.

Security gaps go unnoticed until they are exploited. On-premises security meant a firewall, antivirus, and locking the server room. Cloud security means configuring audit logging, setting up alerts for suspicious sign-in activity, managing app permissions, and implementing retention policies. If your IT person's security model stops at "we have antivirus," your cloud environment is exposed in ways that your old server room never was.

Compliance failures carry regulatory weight. UK GDPR requires you to know where your data is, who can access it, and how long you retain it. If your Microsoft 365 tenant is not configured with appropriate retention policies, data residency settings, and access controls, you are not compliant — regardless of what your IT person told you. The ICO does not accept "my mate set it up" as a defence.

The Skills Gap Checklist

Before you decide whether your current IT person can handle a cloud migration, ask them these questions. The answers will tell you what you need to know.

Can you explain the difference between Entra ID and on-premises Active Directory, and which conditional access policies you would configure for our environment? Have you completed a Microsoft 365 or Google Workspace administration certification in the past two years? Can you design a SharePoint Online site structure with appropriate permissions for our team, including external sharing controls? What data loss prevention policies would you recommend for our Microsoft 365 tenant? How would you configure multi-factor authentication for all users, and what exceptions would you allow? Can you set up audit logging and alert policies for suspicious sign-in activity? What is your approach to data residency and retention under UK GDPR within a cloud platform? Have you migrated another organisation of our size to Microsoft 365 or Google Workspace in the past 12 months?

If the answer to four or more of these is "no" or a vague deflection, you have your answer. This is not a test designed to catch people out — it is the baseline knowledge required to run a cloud tenant securely and effectively.

Why This Conversation Is Hard — and Why You Need to Have It

The reason small business owners avoid this conversation is obvious. The IT person is often someone they know personally. There is a relationship — sometimes a friendship — that predates the professional arrangement. Telling someone who has supported your business for a decade that they are no longer the right fit feels like betrayal.

It is not betrayal. It is the same decision you would make if your bookkeeper could not handle VAT returns or your solicitor did not understand commercial leases. Competence requirements change as businesses grow and technology shifts. The person who was perfect for your needs in 2014 is not automatically qualified for what you need in 2026.

The risk of avoiding the conversation is concrete. A botched cloud migration costs UK SMBs an average of five months in delayed digital modernisation projects. That is five months of reduced productivity, frustrated staff, and competitive disadvantage. The financial impact of the cloud skills gap across UK organisations runs into hundreds of millions of pounds annually.

There is also a sunk cost trap. Because you have relied on this person for years, and because they know your systems intimately, it feels like replacing them means losing institutional knowledge. It does — but institutional knowledge of a legacy environment has a shelf life. Knowing that the second-floor printer needs a restart every Tuesday is not the same as understanding how to configure a SharePoint site with appropriate permissions inheritance. The longer you delay the conversation, the more your business accumulates technical debt in a cloud environment configured by someone who does not fully understand the platform. Unwinding that debt later costs more than getting it right from the start.

How to Have the Conversation

Start from a position of respect. Acknowledge what the person has done for your business. Be specific — name the things they built, the problems they solved, the times they helped.

Then be honest. Explain that the business is moving to cloud and that cloud administration requires a different skill set from the one they have demonstrated. Offer them the chance to upskill — if they want to take Microsoft 365 or Google Workspace certifications and can demonstrate competence within a defined period, they can continue in the role. This is fair. It gives them agency.

If they cannot or do not want to upskill, offer a transition period. Ask them to work alongside the incoming IT provider for a month to hand over institutional knowledge — passwords, configurations, supplier contacts, the quirks of your setup. This protects the business and respects the person.

What you should not do is keep them in place out of guilt while your cloud environment runs without proper security, governance, or structure. That is not loyalty. It is negligence wearing a friendly face.

Finding the Right Replacement

The replacement does not need to be a large MSP or an expensive consultancy. A competent small MSP with cloud expertise can handle a Microsoft 365 or Google Workspace migration for a small business effectively. Look for current Microsoft or Google partner certifications, evidence of completed migrations at your scale, Cyber Essentials Plus certification as a minimum security credential, and clear answers to the same checklist you used to evaluate your current person.

The NCSC small business guide includes specific advice on choosing IT support providers, and it is worth reading before you start conversations with potential replacements. Do not replace an informal arrangement with another informal arrangement. Get a written scope, a fixed price for the migration, and a support contract with defined response times and responsibilities.

Plan the transition in three phases. First, an audit phase where the new provider assesses your current environment and documents what exists — including the undocumented configurations your original IT person carries in their head. Second, the migration itself, with a defined timeline, rollback plan, and user communication schedule. Third, a stabilisation period of 30 to 60 days where the new provider handles post-migration issues and trains your team on the new platform. Your original IT person can be invaluable during the audit phase, and involving them respects their contribution while ensuring nothing is lost in the handover.

One final point. Your original IT person might be perfectly capable of continuing to handle hardware, local networking, and on-site support even if they are not the right person for cloud. Not every role has to be all-or-nothing. If they are willing, a split arrangement — cloud managed by a qualified provider, local infrastructure managed by the person who knows it best — can preserve the relationship and serve the business.