Microsoft 365 Consulting Services Buyer's Guide 2026

A CIO at a mid-market enterprise inherits a stalled Microsoft 365 rollout. The consultant hired in week 1 pitched comprehensive M365 capability. By month 6, the productivity apps work but the Power Platform layer is missing, the SharePoint custom dev stalled, and the Teams apps the CEO wanted look like off-the-shelf templates.

This post is the 2026 buyer guide Sapota's Microsoft Business Apps team gives CIOs and operations leaders evaluating M365 consultants. The M365 vs O365 confusion clarified, the Power Platform layer that most consultants underestimate, SharePoint custom dev when it still matters, and the 7 questions that filter bad consultants in 30 minutes.

M365 vs O365: the confusion that pre-empts every engagement

The terminology shift in 2020 caused enduring confusion. The fast answer:

• Office 365 (O365) is the productivity-app subscription. Word, Excel, PowerPoint, Outlook, Teams, OneDrive, SharePoint Online, Exchange Online. The pre-2020 brand name.
• Microsoft 365 (M365) is the broader suite. Includes everything in O365 plus Windows 11 Enterprise, Enterprise Mobility + Security (EMS), Intune for device management, advanced threat protection, and Microsoft Defender.

Most enterprise customers use M365 even when they say "we use O365". The shift matters because M365 consulting scope is broader than O365 consulting scope.

A consultant who pitches O365 expertise but cannot engage on Intune device management, EMS, or Defender configuration is half a consultant for most M365 engagements.

The Power Platform layer that most consultants underestimate

The biggest gap in 2026 M365 consulting is Power Platform plus Dataverse capability. The pre-2022 generation of consultants treated Power Platform as optional. The 2026 reality: 30 to 60 percent of engineering hours on a typical M365 rollout land on the Power Platform layer.

Why the shift:

• Power Apps for line-of-business apps. Custom apps that used to require SharePoint web parts or InfoPath now ship on Power Apps. Faster to build, easier to maintain, accessible to citizen developers.
• Power Automate for workflow. Approval flows, document routing, integration with external systems all live on Power Automate. The 2020 SharePoint workflows are deprecated; Power Automate is the replacement.
• Power BI for embedded analytics. Dashboards in SharePoint pages, dashboards in Teams tabs, dashboards in custom apps. The Power BI embed in Power Apps pattern covers the row-level security setup.
• Dataverse as the database layer. Custom data models for Power Apps, custom relationships, custom security roles. The Dataverse cluster covers 30 patterns.

A consultant without deep Power Platform capability is missing the layer where modern M365 differentiation happens.

SharePoint custom development still matters

The "no-code Power Platform" pitch overstates the case. SharePoint custom development is still relevant for specific use cases:

• Custom web parts. SPFx (SharePoint Framework) extensions deliver custom UI inside SharePoint pages. Citizen-developer tools cannot build them.
• Search refinement. Custom search verticals, custom result types, custom refinement rules. Out-of-box search covers basic needs; complex enterprise search needs custom dev.
• List view formatting. JSON-based column and view formatting beyond what the UI exposes.
• Custom site templates. Provisioning scripts that ship branded site structures across the organisation.
• Migration tooling. Custom code for moving content from legacy systems (file shares, Lotus Notes, third-party DMS) into SharePoint.

Consultants who claim "everything goes on Power Platform" are over-simplifying. The right consultant has SharePoint custom dev capability and explains when it fits versus Power Platform.

Teams app development is its own discipline

Microsoft Teams apps cover 4 categories:

• Tabs. Embedded web pages inside Teams channels or chats. Iframe-based, hosted externally, simple to ship.
• Bots. Conversational interfaces using Bot Framework. Natural-language interaction, custom logic, integration with backend systems.
• Messaging extensions. Compose-box extensions that surface external content into Teams messages.
• Adaptive cards. Rich interactive content in Teams messages. The modern pattern for actionable notifications.

Teams app development needs specific expertise (Bot Framework SDK, Microsoft Graph API, Teams Toolkit, adaptive card schema). It is not generic web development. Consultants pitching Teams capability without specific Teams app shipping examples are pitching capability they have not earned.

The 7 questions to vet any M365 consultant

Question 1: 3 most recent M365 deployments

Specific clients (anonymised if NDA), specific scope, specific outcome metrics. A consultant with 3 recent specific examples is shipping; a consultant without is pitching.

Question 2: Power Platform plus Dataverse expertise

The diagnostic: ask about polymorphic lookups in Dataverse, rollup vs calculated columns, or Power Automate concurrency patterns. Real Power Platform engineers explain the trade-offs; surface-level consultants handwave.

Question 3: SharePoint custom development capability

Can the consultant ship SPFx web parts, custom search verticals, list view formatting, provisioning scripts? Specific recent examples matter. Most M365 consultants stopped at SharePoint 2013 patterns and never updated.

Question 4: Teams app development experience

Specific Teams apps shipped (tab, bot, messaging extension, adaptive card). The Bot Framework and Teams Toolkit experience matters. Generic web developers cannot ship production Teams apps cleanly.

Question 5: Security configuration depth

Conditional Access policies, Defender configuration, Intune device management, EMS implementation, multi-factor authentication rollout. M365 security is a discipline of its own. Consultants who pitch productivity apps but skip security depth produce environments that fail audits.

Question 6: Identity and governance discipline

Azure Active Directory configuration, group policy strategy, shared mailbox management, retention policies, eDiscovery readiness. Governance is the layer most consultants under-resource until the compliance team escalates.

Question 7: Post-launch support model

Defined scope for the first 90 days, named engineer for continuity, response SLA, escalation path. M365 environments need 4 to 8 weeks of post-launch tuning. Consultants who plan to rotate off at go-live leave significant value on the table.

What M365 consulting actually costs

The cost depends on scope, complexity, and consultant tier.

Boutique partners (4 to 8 engineers)

USD 60K to USD 200K for typical mid-market M365 rollout. Single-tenant migration, Power Platform layer build, basic SharePoint plus Teams configuration. Sapota and similar boutique partners fit here.

Mid-tier consultancies

USD 200K to USD 600K for the same scope. Adds project management overhead, more PMs, slower decision cycles. Right for clients that need formal governance.

Big-4 firms (Accenture, Deloitte, EY, PwC)

USD 500K to USD 2M+ for enterprise M365 rollouts. Significantly more overhead. Right for regulated industries or multi-country programs. Wrong for most mid-market engagements.

Sapota engagement model

2-week paid trial scoped to one concrete deliverable. The client decides whether to convert to USD 1,800 to USD 2,400 per engineer per month rolling monthly. No lock-in.

Typical M365 project shape

What a Sapota M365 engagement looks like:

1. Discovery and assessment (2 to 3 weeks). Current-state audit, M365 licence review, Power Platform usage assessment, security posture review.
2. Architecture and governance (2 to 3 weeks). Tenant structure, identity strategy, security baseline, Power Platform environment strategy, SharePoint information architecture.
3. Migration (4 to 12 weeks). Email migration to Exchange Online, file migration to SharePoint and OneDrive, identity migration to Azure AD.
4. Power Platform build (4 to 16 weeks). Custom Power Apps, Power Automate flows, Power BI dashboards, Dataverse data model.
5. SharePoint custom dev (2 to 8 weeks). Custom web parts, search refinement, list view formatting per use case.
6. Teams app development (4 to 12 weeks). Custom tabs, bots, messaging extensions per business requirement.
7. Training and adoption (2 to 4 weeks). End-user training, admin training, change management.
8. Hypercare (4 to 8 weeks). Post-launch support, issue triage, process tuning.

Total: 6 to 18 months depending on scope and starting state.

Red flags that filter bad consultants

The 5 patterns that recur on failed M365 engagements:

Red flag 1: O365-only capability

Consultants pitching M365 capability but unable to engage on Intune, EMS, or Defender are half-consultants for modern M365 scope. Filter at the first technical question.

Red flag 2: "No-code is the future" pitch

Consultants pitching pure Power Platform without SharePoint custom dev capability are missing the layer where complex enterprise use cases live. SharePoint custom dev plus Power Platform plus Teams app development is the modern capability bar.

Red flag 3: Cannot name Teams apps shipped

Generic Teams capability is not capability proof. Specific shipped apps with named clients matter.

Red flag 4: Vague identity and governance answers

Conditional Access policies, MFA rollout, retention policies, eDiscovery. Consultants who handwave governance produce environments that fail audits 6 months in.

Red flag 5: Fixed-bid SOW without security depth

A 6-month fixed-bid M365 SOW that does not scope security configuration as explicit deliverable signals the consultant treats it as someone else's problem.

How to evaluate the answer quality

The 30-minute initial call should cover the 7 checklist items. Score each answer 0 to 2 (unable, surface, specific). A score of 10+ across the 7 signals a capable consultant. Below 8 signals capability gap. Below 5 is a hard skip.

The 2 most diagnostic items are #2 (Power Platform plus Dataverse) and #5 (security configuration depth). These two filter most consultants accurately.

Specific reading that helps vet consultants

Before signing the SOW, read the Power Platform architecture patterns the consultant should know:

• Multi-environment ALM for Dataverse.
• Polymorphic lookups in Dataverse.
• Power Automate concurrency, retries.
• Plugin execution pipeline.
• Dataverse webhooks to Service Bus.
• Power BI embed with row-level security.
• Service principal vs application user in Dataverse.
• Custom connector OAuth pitfalls.

A consultant who can engage at depth on these 8 has the Power Platform capability the modern M365 rollout needs. A consultant who handwaves them does not.

Need M365 consulting

Sapota's Microsoft Business Apps team covers Microsoft 365, Power Platform, Dataverse, Dynamics 365 Customer Engagement, and Dynamics 365 Finance and Operations. The team ships across Power Apps custom builds, Power Automate workflow, SharePoint Framework extensions, Teams app development, and security configuration.

Visit the Power Platform service page for the team capability list and engagement model. The complete Power Platform engineering guide covers 30 production patterns.

The 2-week paid trial scoped to one specific deliverable runs USD 1,800 to USD 2,400 per engineer per month after conversion. Walk-away terms documented up front. No lock-in.

M365 consulting is mostly capability matching

The platform decisions matter but the capability fit matters more. The right consultant for an enterprise M365 rollout with deep Power Platform plus SharePoint custom dev needs differs from the right consultant for an O365 productivity migration with basic Teams configuration. The 7 diagnostic questions exist precisely because pitch decks hide capability gaps.

CIOs and operations leaders who get this right vet consultants deliberately and walk away from bad fits fast. Those who get this wrong pick on brand or price and pay the cost in months 4 through 12 of the engagement.