Microsoft has warned that hackers are making use of the zero-day SharePoint flaw to distribute ransomware, adding an extra risk to the serious vulnerability.

The SharePoint flaw, known as "ToolShell", was spotted over the weekend, sparking an immediate patch from Microsoft — though initially only for some versions of the server software, all supported versions are now protected — amid concerns hackers were already taking advantage of the vulnerability.

According to Eye Security, the security company that first spotted the flaw, at least 400 SharePoint servers were compromised of the 23,000 scanned as of yesterday. US government agencies were among known victims, though the National Cyber Security Centre said it had so far seen limited hacks in the UK.

Now, Microsoft has warned via an update to its running blog on the incident that it was seeing hackers known as Storm-2603 that are believed to be based in China use the SharePoint flaw to infect servers with ransomware.

"Expanded analysis and threat intelligence from our continued monitoring of exploitation activity by Storm-2603 leading to the deployment of Warlock ransomware," Microsoft said in the post.

Microsoft added that further attacks are expected until users are fully patched. "With the rapid adoption of these exploits, Microsoft assesses with high confidence that threat actors will continue to integrate them into their attacks against unpatched on-premises SharePoint systems," the post added.

SharePoint targeted by Chinese hackers

Microsoft admitted that as early as 7 July it had seen hackers trying to exploit the SharePoint flaws in order to target organisations.

That included Storm-2603 as well as Chinese state actors Linen Typhoon and Violet Typhoon, the company said, noting those latter hacking groups have focused on government targets by making use of known exploits.

When it comes to Storm-2603, Microsoft said it wasn't clear if it was actually based in China, but said it appeared to focus on stealing MachineKeys using on-premise SharePoint vulnerabilities.

"Although Microsoft has observed this threat actor deploying Warlock and Lockbit ransomware in the past, Microsoft is currently unable to confidently assess the threat actor’s objectives," the company said. "Starting on July 18, 2025, Microsoft has observed Storm-2603 deploying ransomware using these vulnerabilities."

China denied any involvement in a statement reported by Reuters.

Microsoft said attacks were happening beyond these hacking groups: "Investigations into other actors also using these exploits are still ongoing."

Kevin Robertson, CTO at Acumen Cyber, said in a statement sent to ITPro that ransomware could be used by criminals targeting a ransom but also by state actors with other motives.

"This highlights that it's not just state sponsored threat actors benefiting from this dangerous vulnerability," he said. "Money-motivated attackers are also jumping on the bandwagon."

He added: "However, some state sponsored attackers will also be using ransomware. They could be conducting reconnaissance on networks and then when they have what they need, dropping ransomware to cause further chaos for victims."

Patch failure

The original "ToolShell" flaw impacting SharePoint was first spotted in May at a Trend Micro ethical hacking competition called Pwn2Own, for which a researcher at Viettel earned $100,000.

Trend Micro's Zero-Day Initiative posted on 16 May: "Dinh Ho Anh Khoa combined an auth bypass and an insecure deserialization bug to exploit Microsoft SharePoint. He earns $100,000 and 10 Master of Pwn points."

Microsoft subsequently rolled out a patch for the flaw via a July 8 security update. However, ten days later, the patch appeared to have been bypassed by hackers.

Acumen's Robertson said that Microsoft's "negligence with the initial patch left organizations completely exposed." He added that this set of flaws could haunt SharePoint users for a long time. "Let's hope Microsoft does a better job next time and upholds its responsibility to protect its expansive customer base," he added.

After the second wave of attacks suggested a patch failure, Microsoft pushed out another update. At first, it only applied to SharePoint 2019, but is now available for SharePoint 2016 as well.

Microsoft said: "Customers should apply these updates immediately to ensure they are protected." The company added that customers should address the authentication side of the attacks with Antimalware Scan Interface and Microsoft Defender Antivirus or equivalent solutions for all on-premises SharePoint instances, with full details of necessary mitigations in its blog post.

MORE FROM ITPRO

• ExpressVPN updates Windows app to fix vulnerability
• Warning issued after SharePoint flaw puts entire corporate networks at risk
• Admins beware, these Microsoft 365 features are being cut in 2025

The UK's National Cyber Security Centre (NCSC) has spotted a "limited number" of British victims of the SharePoint zero day, known as "ToolShell," as victims of the vulnerability start to stack up globally,

Over the weekend, Microsoft warned about the threat of active attacks using a vulnerability in on-premise SharePoint servers that would allow hackers to execute code on a network.

Microsoft has advised admins to rollout updates immediately, though there isn't yet a fix for SharePoint 2016. SharePoint Online in Microsoft 365 isn't impacted by the zero day flaw, according to the tech giant.

Eye Security, which first spotted the flaw, said an early internet scan had spotted 100 organizations compromised using the flaw, largely in the US and Germany, though that was before the zero day was widely reported so the impact is expected to be much wider.

"Who knows what other adversaries have done since to place other backdoors," Vaisha Bernard, chief hacker at Eye Security, told Reuters.

Daniel Card of PwnDefend added: "The SharePoint incident appears to have created a broad level of compromise across a range of servers globally."

It's as yet unclear who is behind the attack, but Charles Carmakal, CTO at Google-owned Mandiant Consulting, reportedly said multiple groups of hackers are now using the vulnerability.

“At least one of the actors responsible for this early exploitation" is linked to China, he noted.

SharePoint attacks impact UK firms

The NCSC said that attacks making use of the SharePoint flaw had been detected in the UK.

"Microsoft and the NCSC are aware that an exploit for this vulnerability exists in the wild and have observed active attacks targeting on-premises SharePoint Server customers, including a limited number in the UK," the security agency said in an advisory.

The cybersecurity agency said any UK companies that are compromised by the flaw should report it to the agency.

US agencies hit

Beyond the UK, reports reveal that the SharePoint zero day has been used to compromise servers at two federal government agencies in the US, according to the Washington Post.

Microsoft has said it is working closely with US agencies including the Cybersecurity and Infrastructure Security Agency (CISA) and the Department of Defense Cyber Defence Command, while the FBI has said it is investigating alongside authorities in Australia, Canada, and beyond.

CISA's acting executive assistant director Chris Butera said in a statement that the agency was alerted to the zero day by a trusted partner and reached out to Microsoft.

"'Microsoft is responding quickly, and we are working with the company to help notify potentially impacted entities about recommended mitigations," Butera said.

"CISA encourages all organisations with on-premise Microsoft SharePoint servers to take immediate recommended action."

Targeted attack that gets past patches

Security company Rapid7 said it was observing active exploitation in its customers' environments and warned that the attack appeared targeted.

"This vulnerability is being used in widespread, aggressive campaigns to achieve RCE [remote code execution], establish persistent access, and extract cryptographic keys that allow attackers to forge valid authentication tokens," the company warned in a blog post.

"This campaign is not opportunistic — it is deliberate, capable, and designed for persistence even after patching."

Indeed, the firm noted that Microsoft said the flaw is related to one patched earlier this month, adding that the new vulnerability may be a "patch bypass".

"Microsoft has indicated that the patches for the new vulnerability, CVE-2025-53770, include more “robust protections” than the July update for the previous vulnerability CVE-2025-49704," Rapid7 said in its post.

The NCSC said two flaws are being used in the attack, pairing the SharePoint server zero day with a second used to sneak into systems.

"This vulnerability allows an attacker to remotely execute arbitrary code via the deserialization of untrusted data," the agency said.

"A separate vulnerability, CVE-2025-53771, allows this attack to be performed while bypassing authentication."

Any unpatchable systems should be disconnected from the internet in the meantime, said one security expert.

"We are urging organizations who are running on-prem SharePoint to take action immediately and apply all relevant patches now and as they become available, rotate all cryptographic material, and engage professional incident response," Michael Sikorski, CTO and Head of Threat Intelligence for Unit 42 at Palo Alto Networks, told AP News.

"An immediate, band-aid fix would be to unplug your Microsoft SharePoint from the internet until a patch is available."

MORE FROM ITPRO

• MCP servers used by developers and 'vibe coders' are riddled with vulnerabilities
• Industry welcomes the NCSC’s new Vulnerability Research Initiative – but does it go far enough?
• Shifting left might improve software security, but developers are becoming overwhelmed

Microsoft has warned hackers are actively exploiting a newly-discovered vulnerability in on-premises SharePoint servers and urged enterprises to patch immediately.

The attack allows malicious actors to gain unauthorized access to organizations’ infrastructure using remote code execution (RCE), which in turn gives them access to all SharePoint content, including internal configurations and file systems.

The tech giant also warned it also allows them to execute code over the network.

The vulnerability has been given the official designation CVE-2025-53770, although the US Cybersecurity and Infrastructure Security Agency (CISA) reports it’s also being called 'ToolShell'.

In a blog offering guidance to customers, Microsoft said SharePoint administrators should immediately apply updates for SharePoint Server Subscription Edition and SharePoint Server 2019, which were issued on 20 July and 21 July respectively. Links to the official downloads are available through the blog.

An update for supported versions of SharePoint 2016 isn’t yet available, but the company says it’s working to develop these. SharePoint Online in Microsoft 365 isn’t affected.

In addition to applying the updates, or while waiting for one to become available, Microsoft advises the following steps to mitigate potential attacks:

• Use supported versions of on-premises SharePoint Server
• Apply the latest security updates, including the July 2025 Security Update
• Ensure the Antimalware Scan Interface (AMSI) is turned on and configured correctly, with an appropriate antivirus solution such as Defender Antivirus
• Deploy Microsoft Defender for Endpoint protection, or equivalent threat solutions
• Rotate SharePoint Server ASP.NET machine keys

CISA has offered the following additional steps to reduce the risk of compromise:

• Configure Antimalware Scan Interface (AMSI) in SharePoint and deploy Microsoft Defender AV on all SharePoint servers.
• If AMSI cannot be enabled, disconnect affected products from service (sic) that are public-facing on the internet until official mitigations are available. Once mitigations are provided, apply them according to CISA and vendor instructions.
• Follow the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
• For information on detection, prevention, and advanced threat hunting measures, see Microsoft's Customer Guidance for SharePoint Vulnerability and advisory for CVE-2025-49706. Organizations are encouraged to review all articles and security updates published by Microsoft on July 8, 2025, relevant to the SharePoint platform deployed in their environment.
• Monitor for POSTs to /_layouts/15/ToolPane.aspx?DisplayMode=Edit
• Conduct scanning for IPs 107.191.58[.]76, 104.238.159[.]149, and 96.9.125[.]147, particularly between July 18-19, 2025.
• Update intrusion prevention system and web-application firewall rules to block exploit patterns and anomalous behavior. For more information, see CISA's Guidance on SIEM and SOAR Implementation.
• Implement comprehensive logging to identify exploitation activity. For more information, see CISA's Best Practices for Event Logging and Threat Detection.
• Audit and minimize layout and admin privileges.

Microsoft customers urged to act on SharePoint flaw

Experts have lined up to underscore the critical nature of this vulnerability.

Martin Riley, CTO at cybersecurity firm Bridewell, said the exploitation of the flaw represents an "unprecedented risk" due to an attacker's ability to completely bypass authentication and identity controls such as MFA.

“This vulnerability is not just about data theft – it can enable attackers to harvest credentials, steal cryptographic keys, and impersonate users even after the patch is applied unless keys are rotated,” he said.

“Leaders must prioritize mitigations immediately, even if this impacts productivity. The cost of inaction is far greater than the inconvenience of temporary restrictions.”

MORE FROM ITPRO

• Hackers are duping developers with malware-laden coding challenges
• Warning issued after SharePoint flaw puts entire corporate networks at risk
• Hackers are using PDFs to impersonate big brands like Microsoft in a new threat campaign

Security researchers have issued an alert over threat actors exploiting a recently disclosed vulnerability in Microsoft Sharepoint, warning the weakness could allow attackers to compromise the entire network.

Researchers from Rapid7’s incident response team have published findings from an investigation where hackers compromised a Microsoft Exchange service account by exploiting a vulnerability in a public-facing application.

The attacker was able to access a SharePoint server without authorization, and subsequently used the admin privileges on an Exchange service account to move around the network “compromising the entire domain”, the report stated.

The report noted that after gaining initial access to the target’s corporate environment the threat actor was able to persist on the network undetected for two weeks.

Rapid7 said it has begun exploring suspicious activity tied to the Microsoft Exchange service account, including the installation of the Horoung antivirus software, which was not authorized in the environment.

Horoung is a popular antivirus solution in China, available on the Microsoft store, and was used in the attack chain to create a conflict with other security products active on the system, and weaken the environement’s overall security posture.

Hackers used Chinese antivirus software to disable existing security tools

After exploiting CVE-2024-38094, the attacker installed the Horoung antivirus in order to disrupt the existing security software on the system enabling malicious lateral movement activities.

First among these was to compromise a Microsoft Exchange service account with domain administrator privileges to enable further lateral movement around the environment.

Using authentication event logs from the organization’s domain controllers, Rapid7 were able to track the lateral movement events of the attack and construct a timeline covering the incident’s two-week dwell time, beginning with the exploitation of the target’s public-facing SharePoint server.

The conflict caused by the installation of Horoung allowed the attacker to use Python to install and execute Impacket from GitHub. Impacket is a collection of open-source network protocols, which are usually used to facilitate lateral movement on a target environment.

Rapid7 found the attacker used the Exchange service account to authenticate via RDP, going on to disable the system's Windows Defender Threat Detection (WDTD), adding an exclusion for a malicious binary called msvrp.exe, used to establish command and control.

“This binary is a tool called Fast Reverse Proxy (FRP), which allows external access to the system through a NAT-configured firewall,” the report noted

The attack also executed the Mimikatz program to harvest credentials, clear event logs, and disable system logging, helping obfuscate the threat actor’s TTPs.

Rapid7 recorded a litany of additional tools leveraged by the attacker including a renamed version of Mimikatz (66.exe), certify.exe to create ADFS certificates, and everything.exe – a tool frequently used in ransomware attacks to find files for encryption.

Finally, the threat actor appeared to attempt to destroy third party backups via multiple methods, according to the report, but were ultimately unsuccessful.

Rapid7 added that it did not observe any attempts to encrypt data in the environment, however, which is the usual indicator of a ransomware attack, leaving the exact nature of the attack undetermined.

Security professionals have raised concerns that Microsoft SharePoint appears to be ‘breaking into files’ and scanning users’ password-protected ZIP archives. 

The discovery was made by Andrew Brandt, a principal security researcher at Sophos, after he found that files containing malware for research purposes were scanned by Microsoft’s 365 virus detection software. 

Brandt outlined his claims in a Mastodon thread, revealing that several password-protected ZIP files had been flagged as ‘malware detected’ by antivirus software. 

Following the malware flag, Brandt noted that this “limits what I can do with those files - they are basically dead space now”. 

“Apparently Microsoft SharePoint now has the ability to scan inside of password-protected ZIP archives,” he wrote. 

“How do I know? Because I have a lot of ZIPs (encrypted with a password) that contain malware, and my typical method of sharing those is to upload those passworded ZIPs into a Sharepoint directory.

“This morning, I discovered that a couple of password-protected ZIPs are flagged as "Malware detected" which limits what I can do with those files - they are basically dead space now.”

The discovery sparked initial concerns that Microsoft is actively scanning password-protected files, raising concerns over security and privacy. 

One user suggested that the practice is a reason why they’re “moving away from MS cloud” and that it crosses “ethics boundaries”. 

“There is a bit of an ethics boundary being crossed here when they are starting to just break into files and archives under the guise of ‘security’ (which may just be used as a facade for them).”

In a reply on the Mastodon thread, Brandt noted that SharePoint uses a “word list” to check and potentially flag the content of files. 

Given the password was ‘infected’ - a common archive password used in the cyber security community - SharePoint appears to have flagged this particular file. 

“[SharePoint] says it uses a word list,” he said. “The password was ‘infected’ which is not in the least bit secure, but I hadn’t seen it poking around inside of passworded ZIPs before now, and was under the impression it wouldn’t do that.” 

Brandt added that while this practice is understandable from a generalist perspective, for malware analysts in particular it could prove inhibitive. 

“While I totally understand doing this for anyone other than a malware analyst, this kind of nosy, get-inside-your-business way of handling this is going to become a big problem for people like me who need to send their colleagues malware samples,” he said. 

“The available space to do this just keeps shrinking and it will impact the ability of malware researchers to do their jobs.”

File scanning practices

Although this has raised some concerns over the scanning of files, the practice is well-documented by Microsoft in an explainer for its built-in antivirus protection for SharePoint, OneDrive, and Microsoft Teams. 

“The Microsoft 365 virus detection engine scans files asynchronously (at some time after upload). If a file has not yet been scanned by the asynchronous virus detection process, and a user tries to download the file from the browser or from Teams, a scan on download is triggered by SharePoint before the download is allowed,” the explainer reads. 

“All file types are not automatically scanned. Heuristics determine the files to scan. When a file is found to contain a virus, the file is flagged.” 

In a Twitter thread reacting to the news, Dr. Vesselin Vladimirov Bontchev (@‘VessOnSecurity’) said the practice isn’t quite as concerning as it seems. 

“Scanners have been doing this since the ‘90s,” he wrote. “I think McAfee’s scanner was the first to try the password ‘infected’ if it encountered an encrypted ZIP archive.”

Bontchev pointed out that the practice of ‘protecting’ a ZIP archive potentially containing malware has traditionally been a tactic to improve safety and prevent unknowing users from downloading malicious software. 

“The idea here is not secrecy. The idea is safety. These archives with malware are (or at least were) often sent by email from one researcher to another,” he explained. 

“It's easy to mistype someone's email address and we wanted to make sure that if some random person, other than the intended recipient, received the malware by mistake, they wouldn't infect themselves by accidentally running it.”

ITPro has approached Microsoft for comment on the matter. 

Microsoft has announced price increases for both Office 365 and Microsoft 365 services that will come into effect in March next year.

The changes will apply to its commercial and business services, with consumer and education subscriptions remaining the same.

The increase will also apply globally, with local market adjustments for certain regions, however only US pricing is available at present: Microsoft 365 Business Basic is going up from $5 to $6 per user and Microsoft 365 Business Premium will increase from $20 to $22. Office 365 E1 will rise from $8 to $10, Office 365 E3 will jump up from $20 to $23, Office 365 E5 will move from $35 to $38 and Microsoft 365 E3 changes from $32 to $36.

These are the first "substantive" price increases to Office 365 since it was launched a decade ago, according to Microsoft, with only minor changes to the suites coming in over the last ten years. The reasoning for hiking them up now is partly to do with the higher demand for cloud-based services brought about by the pandemic, according to Jared Spataro, the corporate vice president for Microsoft 365.

"As leaders around the world look to empower their people for a more flexible, hybrid world of work, it's clear that every organisation will need a new operating model across people, places, and processes," Spataro wrote in a blog post. "We're committed to building on the value we've delivered over the past decade to continuously provide innovation that helps our customers succeed and thrive today and well into the future."

The changes follow a period of immense growth for Microsoft and its cloud services; the firm recently surpassed the milestone valuation of $2 trillion and it has more than 300 million paid seats for Office 365. The tech giant has also added more than 20 apps to Office 365 since it originally launched, including Microsoft Teams, OneDrive and SharePoint.

Microsoft has suffered a second global outage within a week, with users being unable to access their Outlook accounts, the tech giant has confirmed.

The reports come just days after the company said it had fixed a global outage that affected its Microsoft 365 platform. Microsoft services including Azure, Outlook, Office, Power Platform, Dynamics365, and Microsoft Teams were down for around five hours on Monday.

This latest outage began at around 2am ET, with Microsoft initially suggesting the issue was only affecting users based in India, according to a status update on Twitter. However, customers from around the world soon replied that they were also experiencing problems.

"We've collected additional data from the affected infrastructures to determine impact to our Exchange online protocols," the tech giant tweeted. "Additionally, we've identified this issue to be affecting users worldwide. Further details can be found in your admin center under EX223208."

Microsoft has said that a recent configuration update to components that route user requests was the cause of the outage. It has now "reverted" this update and will continue to monitor the service for signs of recovery.

The company's outage on Monday was also blamed on unexpected errors relating to a recent update, although reverting this update did not immediately solve the problem.

"Rolling back the previously described change did not resolve the incident as expected," Microsoft said on its Office status page. "We're evaluating additional options to remediate the problem."

For Wednesday's outage, the rollback has "mitigated impact" for affected features in SharePoint and Teams, Microsoft tweeted. It also said that the majority of users were "seeing recovery".

Microsoft has unveiled this month's Patch Tuesday — and it's another big one.

The September edition of the regular security update addresses a whopping 129 flaws, of which 23 have been labelled critical.

"That brings us to seven straight months of 110+ CVEs," notes Dustin Childs, head of communications at Trend Micro's Zero Day Initiative. "It also brings the yearly total close to 1,000. It certainly seems like this volume is the new normal for Microsoft patches."

The vulnerabilities hit a variety of Microsoft products, with 37 in Windows, 16 in SharePoint, ten in Dynamics, and eight in Office. While there's a high number of flaws, none are being used actively by hackers, Microsoft said. The full details are available in Microsoft's release notes.

"While none of the critical vulnerabilities appear to be under active attack (at the time of review), there is a higher count of vulnerabilities Microsoft has chosen to label as critical — at least in comparison to the last few months," noted Gill Langston, head of security at SolarWinds MSP, adding that most of the remaining flaws are marked as important rather than low or moderate.

One of the more alarming set of vulnerabilities was in SharePoint, which could allow remote code execution, while there's also a patch for Windows Defender Application Control. Another severe flaw was found in Exchange Server, which could allow hackers to takeover and execute code via a malicious email sent to an affected Exchange Server.

"That is about the worst-case scenario for Exchange servers," said Childs, adding that a similar Exchange bug that's now patched was quickly taken up by hackers. "We'll likely see this one in the wild soon. This should be your top priority."

The large volume of patches could be a problem for companies supporting remote workers, noted Justin Knapp, product marketing manager at Automox, advising companies take the time to ensure patches are rolled out across their decentralised workforces' devices.

"As many organisations continue to struggle to support the ongoing distribution of remote workers, Microsoft continues to pile on the updates," he told Threatpost. "Finding an efficient method for rolling out these patches has become even more imperative as companies begin to abandon the idea of a short-term fix and shift operations to embrace remote work as part of a lasting, long-term progression of how organisations operate moving forward."

Indeed, this month's set of patches is a good reminder to limit admin rights, notes Langston. "[Several] of this month’s vulnerabilities are privilege-specific, meaning that users who do not have administrative rights pose less of a risk than a user with full rights to a system," he said.

"As is best practice, it’s a good idea to audit the rights you allow your users to have on workstation systems. While it’s more convenient to simply make them administrators, limiting their rights on workstations can reduce the risk when they inevitably click on that link or visit a malicious webpage."

The latest incarnation of Microsoft's Office 365 for Business offering is now on general release, and consists of several new product bundles aimed at SMBs, mid-market and enterprise users.

These product bundles all feature the 2013 versions of the software giant's Exchange, Sharepoint and Lync online products, while the look and feel of the new overall suite is in keeping with that of Windows 8.

Microsoft has also launched something called Office 365 ProPlus, which will allow users to supplement their existing cloud deployments with online versions of its Office 2013 applications.

The software giant also plans to expand the enterprise social capabilities of its online productivity suite, by rolling out voice, presence and instant messaging features that draw on the company's Lync and Skype products by June of this year.

IT Pro also understands that cloud-based versions of Microsoft's business task management software Project and its diagram creation tool Visio have also been added to the role-call of Office 365 offerings for the first time.

During a webcast announcing Office 365 for Business, Kurt DelBene, president of the Office division at Microsoft, said the product was designed to work best with Windows 8 and take advantage of touch-based devices.

"But none of this matter if IT can't manage it, so we've added new compliance, flexibility and management [capabilities]," he added.

The release marks the first time the Office desktop application has been offered up as a commercial cloud service, he added.

However, this does not mean Microsoft is planning to stop offering users the option to deploy it on-premise.

"With this announcement, [we've created] the most ambitious release of Office ever...We know cloud will be a journey, and we will continue to release on premise products."

Julia White, general manager for Office division technical marketing at Microsoft, went on to walk through the technical capabilities of the release, emphasising that users can pick up where they left off when switching devices to access the same documents.

"My content is always up to date because its saved to the cloud," she added.

Business talkMicrosoft claims one in five of its enterprise customers now use Office 365, while SMB and mid-market adoption has grown by 150 per cent over the past 12 months.

Mark Herbert, business development manager at Office 365 Syndication Partner Inty, said existing Office 365 users should be automatically upgraded to the latest edition within the next three months.

"Users can put off the upgrade by up to 60 days, but everyone will be upgraded whether they like it or not," he told IT Pro.

"It's a very well engineered process, so people shouldn't even know it is happening."

Meanwhile, Clive Longbottom, service director at market watcher Quocirca, said the new release has much to recommend it, and should push more business users to consider cloud.

"Microsoft seems to have got it right, overall. There will be issues, as the interface is not the same, so there may be a need to re-train users," he told IT Pro.

"Office 365 for the enterprise gives far more [in terms of functionality] and will remove the need for users to carry out patches and upgrades [like they would with on-premise]."

Microsoft has released the preview version of the next iteration of its Office business productivity software suite, which boasts Skype integration and enhanced cloud functionality.

The software giant walked end users through the next version of its software suite, Office 15, during an event in San Francisco earlier today.

The modern office thinks cloud first.

During it, Microsoft chief executive, Steve Ballmer, described the product as the most ambitious Office release to date.

"Our entire product line is being updated to get ready for Windows 8. The flagship application, our highest volume and the most important one we sell is Microsoft Office," said Ballmer.

"[It's] a new generation of Microsoft Office and the preview for this will be available today. It brings some of the same boldness and beauty we've shown you with Windows 8."

Release dates and pricing information were not disclosed, but Ballmer suggested the latter was proving something of a sticking point for the Redmond giant. "We've got a lot of work to do to bring the price down."

Keeping it cloud

In Office 15, documents will be saved to Microsoft's online stoarge service, SkyDrive, by default. However, end users will still be able to store files locally.

The product will be available to buy as a cloud service and as a packaged product, although Ballmer hinted that the days of on-premise Office could be numbered.

"You can still buy the software. That's not going away. At least, not at this stage of the game," he said.

"The modern office thinks cloud first...When you try the preview, you will sign up to a service. It will suit people that want to sign up to a service, rather than a piece of software."

Kirk Koenigsbauer, corporate vice president of the Microsoft Office division, treated end users to a run through of some of the other features of the new software suite.

Some of these, including Peeks - which allows users to see information within other apps without leaving the email client - have already been leaked during technical previews.

Brand-new look

Each application in the suite has been given an updated interface and is optimised for use with touchscreen devices, with Koenigsbauer using a Samsung tablet to showcase each one.

Users will need to sign in to access their documents, settings, profiles and templates each time they use Office. The applications will then show them exactly where they stopped work during their previous session.

"They [the documents will] roam with you, as you move from device to device," explained Koenigsbauer.

For the first time, Office users will also be able to make Skype calls, as well as Lync calls, instant messages, and emails.

Following on from the software giant's acquisition of social networking site Yammer last month, the firm's workspace collaboration offering, Sharepoint, will now also feature tighter integration with social media outlets.

"With Sharepoint, you can follow and keep tracking of anything...here's a list of people and sites I'm following. It will also suggest documents [you] should be focusing on. It's a great way to keep yourself connected," Koenigsbauer added.

Office 365 isn't a new version of the Office desktop suite; it's a cloud service offering the key server-based versions of desktop applications Exchange mail server with Forefront malware and spam protection, SharePoint document management (which can also power a public-facing Web site) and Lync Online for communications (presence, instant messaging and audio and video calls).

This is similar to the BPOS cloud service Microsoft has been running, but it has newer versions of the server-side software that are multi-tenant and (Microsoft claims) better suited to running as a cloud service. You also get online versions of Word, Excel, PowerPoint, OneNote and Outlook and some subscriptions even include the full Office Professional Plus suite. There's also an Office 365 marketplace for third-party tools that work with the service.

Office 365 is commonly seen as competing with Google Apps so we decided to look at them both.

Google Apps for Business includes Gmail with Postini spam and malware filtering and basic smartphone management, Calendar and Contacts, Google Docs (including spreadsheets and presentations), Chat, Groups mailing lists, Sites (for both intranet and public Web sites).

There's a control panel for managing users and what they can do with the Google Apps tools. You can also control user access to various other Google services like Picasa (which may get more important as Google combines personal and Google Apps accounts into a single account type) and add third party services from the Google Apps Marketplace.

Office 365 is commonly seen as competing with Google Apps so we decided to look at them both to see how similar the services really are and how they compare to each other.

Administration interface

As cloud services, you manage Google Apps and Office 365 online. Despite the simple layout, the Google Apps control panel is confusing until you learn where everything is. Options are scattered between Domain Settings, Settings, Advanced tools and the various links from the Dashboard tab which duplicate the Settings hierarchy. The Dashboard is also cluttered with adverts for optional tools in the Google App marketplace and adverts for new features.

The Google Apps admin page is cluttered with adverts for new features and third-party tools.

The Office 365 admin console is cleaner and better laid out, with a pane for switching between managing users, services and domain, clear explanations of what the main management tools are for next to the links to manage them. There are also handy shortcuts at the bottom of the window and links to relevant resources and community discussions.

By comparison, the Office 365 dashboard is clear and well laid out; you can see immediately what to do.

Google Apps has two levels of administration rights; the 'super admin' who has full access and admins to whom you can delegate some administration tasks. You can give different users a different mix of rights but you have to remember who can do what.

Office 365 has five named admin roles; you can give someone the rights to manage billing, passwords, users or services if you don't want them to have full admin rights. If you need more granularity, you can also set up administrator roles for Discovery Management, Records Management, UM (Unified Messaging) Management and other tasks in the Exchange Control Panel. It's more complex than Google Apps, but enterprises will welcome having the option.

Winner: Office 365. Microsoft's administration interface is not only better organised, it's also easier to handle when delegating management rights to others.

Setup and user management

There's a setup guide to get you started on Google Apps which walks you through things like verifying the domain you're using , creating user accounts and changing your MX records to point to Gmail (you need your own domain to use Google Apps). It's mostly clear and simple, but the duplicated instructions and sometimes circuitous inteface make setup a very fragmented experience. Setting up the Postini spam service tells you it may take up to an hour and again you have to change the MX records to redirect mail to the Postini service and configure some settings in Google Apps email by hand - all of which should be far more automated and suggests that Google has still not fully integrated the Postini acquisition with its platform.

Office 365's Forefront Online Protection for Exchange, SharePoint and Lync Online are running by default so all you have to do is create or migrate users. You only need to configure settings if you want to use an optional vanity domain, to get finer control or if you're integrating with on-premise servers. Thankfully the guides to doing this are clear and detailed.

You can create Office 365 users individually assigning admin rights and turning on services for them at the same time - or by importing a CSV file. You can also connect to an existing on-premise Exchange server and migrate users and mailboxes, or synchronise with your Active Directory to manage Office 365 users with roles and policies the same way you manage existing users (so you can delete a user in AD and they're removed from Exchange Online). You even get PowerShell cmdlets that let you configure Office 365 from the command line.

The Forefront rules and filters are very powerful but the interface is more complex.

To create Google Apps users you can set them up one by one in the control panel or import a CSV file - but most enterprises will use the Google Apps Directory Sync to get user details from AD or Lotus Domino, which the setup guide doesn't cover. This is a one-way sync and you have to leave the tool running on your local server and make changes to users in AD and propagate them up to Google Apps. To migrate mailboxes you have to run an Outlook sync utility individually and you can't migrate distribution lists, so you have to recreate them. It's initially confusing which tools you need for synchronising and migrating different information and settings to Google Apps, especially as the help pages often refer to old tools that have been replaced.

What Google Apps calls 'groups' are merely mailing lists. To control who gets which Google services you need to set up organization units. These cover both the core offerings like Gmail and the wide range of other Google tools whose terms and conditions your business will be deemed to have accepted if users from your business sign in with their Google Apps account - so this is mainly useful for disabling access to Picasa or YouTube if you don't want to accept those terms.

If business users sign into other Google services with their Google Apps account, the business is bound by the terms and conditions, so you can block this.

There's a separate option for whether users get access to functions and features from Google Labs, which could be a new option in Gmail or a tool like Google Moderator for managing a question and answer session at a company meeting (it's unclear what happens to these tools as Google recently announced that it is shutting down Google Labs). You can also use organization units to restrict which domains users can send email to, but you can't use them to control any other settings so it's nothing like as powerful as AD groups. You can't delete an organization without moving or deleting the users first, and deleting a user gives you the choice of deleting their documents or moving them to another user.

Both Microsoft and Google promise single sign-on. If you have Active Directory and AFDS 2, Office 365 users can use their Windows login to sign on to the local network (including any business apps you've integrated with that login) and to Office 365 services. Your Google Apps sign in gives you access to all the online Google services (including services that aren't part of Google Apps if the administrator allows this). It's possible to use a SAML bridge and the provisioning API to make that work with your in-house LDAP directory and local apps, but this is far from trivial to set up and it won't work with Google desktop applications.

Winner: Office 365. Microsoft's product is easier to set up and integrate into your company's existing infrastructure.

Mail server, malware and spam

Office 365 has a simple interface for basic admin options like managing passwords and security groups but you can also use the full Exchange Online interface. This is identical to the Web interface for Exchange Server, so it will be very familiar to Exchange admins. You get a comprehensive set of tools for setting up features like role-based access control, transport rules (such as adding disclaimers to external email) and reports to help you track down any problems along with auditing logs for compliance. If you don't need them then you can stick to the basics and be set up in minutes.

All the key email management features in Office 365 are available through a straightforward interface if you don't want to use the full Exchange interface.

Gmail has vastly fewer options because you don't get to control a mail server, although you do have some control over routing and mail gateway settings. The options are mostly on the level of setting up a vanity URL for users, choosing whether users can use Gmail Labs and chat or allowing Docs results to show up in a Gmail search. With Google looking after the mail server, most businesses won't need more admin options.

There are useful features in Google Apps that aren't turned on by default, and the interface is basic but clear.

Both Google Apps and Office 365 have a mailbox limit of 25GB. There's isn't an archiving option from Gmail, but with Office 365 you have a choice between third-party archiving services or a specific Office 365 plan with unlimited storage for email archiving.

Google Apps for business includes Postini Services for spam and malware detection, but you can't use it is you have multiple domains or if you want to use the Postini Discovery ediscovery and archiving service (in those cases you need to pay for Postini spam services separately). The Postini admin console is separate from the main Google Apps console and has tabs for viewing and deleting or approving messages detected as junk or viruses in the past three days, a week or for as long as it keeps records. The only option for virus blocking is whether you get email notifications that a mail has been quarantined, so you can check and release it if it's a false positive.

For spam you can whitelist individual senders, domains or mailing lists and block specific addresses or domains, set up inbound and outbound content filters for specific words, phrases or patterns and create attachment filters by size or type. You can also choose five levels of spam blocking, from lenient to very aggressive, and use category filters to put more emphasis on blocking explicit, 'racially insensitive' and financial spam. Oddly, IP whitelists to avoid spam filters go under the email settings pane, not in the Postini configuration page.

The Forefront admin console is also separate and has a very different interface from the rest of Office 365; it's powerful but also confusingly complicated for anything except checking quarantined email - we'd like to see this simplified for admins who don't already have Forefront expertise. What you get are the powerful Forefront Online Protection for Exchange (FOPE) tools; not just malware and spam filtering, but options to safelist specific IP addresses, options for auditing and tracing messages and extensive filtering rules for both inbound and outbound email. You can therefore write rules to stop your users emailing out confidential information such as credit card numbers. You can upload dictionary files when you have a lot of values to use in a filter and manage rules by type; there are a lot more options compared to Postini.

Neither service lets you add additional reputation services or real-time block lists, but both let you use SPF for your own reputation - only Google Apps supports DKIM so far.

Winner:Tie. There's no outright winner in this category. Gmail is perfect if you want to get up and running as quickly as possible, while Office 365 provides fine grained controls and capabilities that will suit particularly fastidious organisations.

Mobile management

With Google Apps for Business, you can manage Android devices (as long as they run Android 2.2 or later). You can set a policy that enforces a password of a particular strength and wipe lost devices and users can remotely locate or lock their phone or make it ring. You have to manage rolling out device security as it requires an app users download from Android Marketplace, but turning on device security stops them using Android Marketplace until the app is installed (there's a direct link to get around the chicken and egg problem here).

There's also a connector to allow you to manage BlackBerry users of Google Apps from a BlackBerry Enterprise Server, and options for applying password and other device policies to smartphones using Google Sync or Exchange ActiveSync, which can end up as a confusing mix of management options.

Fine control of smartphone security in an interface that will be familiar to any Exchange administrator.

Office 365 has a more unified and comprehensive approach. Exchange Online gives you the same mobile device management as Exchange Server using ActiveSync Policies which work to some extent on virtually all smartphones including Android, iPhone. BlackBerry and Symbian as well as Windows Mobile and Windows Phone. You can enforce strong passwords and encryption, control individual device features (like Bluetooth), configure sync options like whether attachments can be downloaded on a phone and wipe devices automatically if the password is wrong too many times. You can also block or quarantine specific mobile devices from connecting. Users can even block or wipe their own phones.

Winner: Office 365's unified and comprehensive approach to smartphone management makes it the clear winner here.

Document management

Google Docs has no equivalent to SharePoint Online. Sites is a nice simple tool for creating internal or external Web pages and with Google Docs, you can control whether users can publish or share documents outside the business and whether documents default to being private or public. Otherwise sharing is an ad hoc thing that users control.

SharePoint Online combines workflow, document management and Web publishing and it looks professional straight away.

SharePoint Online combines Web page authoring for external sites with a full document management tool with libraries, lists, templates, discussion tools, shared calendars, RSS feeds, workflow, check in and check out options and version control plus powerful search options. Your Team Site includes pages for every user where they can blog, share links and documents or access their files on the move. Taking advantage of all the options is more complex but it's also far more powerful.

Winner: Office 365 has much more capable sharing features, but these are correspondingly more complicated to manage. If you need them though, then it's worth bearing with.

Chat and talk

Google Chat is the same simple but powerful tool available to the public; users can see presence for Google Apps contacts inside Gmail and start a text, voice or video chat from there once they've downloaded the plug-in. Alternatively they can use the Windows Google Talk software for text and voice chat or file transfer. Management is minimal; you can block chat outside the organisation or just warn users but you can't block file transfers.

Microsoft's Lync Online is more powerful. The extensive management options let you choose whether users can transfer files, make audio or video calls and talk to people outside the business or just colleagues.

Users can see each other's presence and status in Outlook and Outlook Web Access (including information from someone's Exchange calendar), and in any Office app where you're collaborating. It's possible to start a chat, voice or video call from there or from the Lync client. Microsoft is also promising Lync clients from a range of smartphones, offering IM first and voice features later. If you have an in-house PBX you can also set up unified messaging (like dialling phone calls from Outlook) and integrate voicemail with Exchange Online although we weren't able to test this.

Lync Online automatically federates with Windows Messenger and AOL for instant messaging.

Lync Online automatically federates with Windows Messenger and AOL for instant messaging. It can also federate with on-premise Lync servers if permitted by the server admin.

Google Apps can federate with any XMPP service, but to make that work you have to edit the SRV record in your domain by hand (or ask your domain hoster to do it for you), and you then get federation with all the services Google is connected to - you don't get to choose which are allowed or blocked. Similarly, you can allow users to chat with any Gmail or Google Apps user or block them all; you can't pick and choose which Google Apps-using companies they can communicate with and you can't block or allow chat access for specific users (individually or by groups).

Lync Online also incorporates the features of LiveMeeting; you can switch from an IM chat to an online meeting with up to 250 people with audio, video and Web conferencing, and you can schedule meetings in advance through Outlook. If you want to let people phone in to a meeting without needing Lync (customers for example), you can buy an audio conferencing service for Lync Online from BT.

Winner: Office 365. Google App's chat and messaging features are fine for most users, but for more fine-grained controls, Office 365 is better.

Online apps

Online apps like Google Docs are primitive compared to the richness of the full Office suite. In general, the features of the Office Web Apps and Google Docs are broadly similar, but while many like the sparse interface of Google Docs for its simplicity, the Office Web Apps tend to have the edge in sophistication.

Create a PowerPoint presentation in the Office Web Apps and you get good-looking themes and images you place are automatically sized to fit; a Google Docs presentation starts out in plain black and white and the designs aren't as appealing.

The Office 365 Outlook Web App has good self-service features for users (and you only see the admin links if you're an administrator).

Office Web Apps make inserting images from your hard drive the same simple experience it is in a local app. Google Docs gives you a wider choice for inserting images from a URL or a Google image search in a document, but it's a completely different dialog box in a presentation where inserting an image has fewer options and is a clunkier experience. The mismatch of features between different document types in Google Docs is more extreme and more jarring than in the Office Web Apps.

Sharing is better integrated in Google Docs, with a big blue Share button on the page that opens a popup dialog box. The Office Web Apps make you save the document and take you away from the editor to choose who to share it with, and take you back to viewing but not editing the document. This is because Microsoft assumes that you won't share a document until you've finished working on it. Updates appear live in Google Docs; this also happens in the OneNote Web App but the other Microsoft Web apps make you save your own changes to see edits by other users.

There are many features in both Outlook and Outlook Web that are missing from Gmail from macros to Quick Steps. Gmail equivalents tend to have fewer features which some users prefer because they're simpler. Gmail's stars, labels and priority buttons let you do much the same things as Outlook's flags, categories and folders with the advantage that a message can have multiple labels instead of being in only one folder.

You can turn an email into a Gmail task and then make a reminder, although this isn't quite as immediate as setting a follow-up flag for a specific day directly on an email. Filters the Gmail equivalent of Outlook rules have far fewer actions; in Outlook you can play sounds, send an automatic reply or even print a message that matches a rule. Gmail does include all the mostly commonly used ones though such as filing, forwarding and deleting messages.

Google Apps for Business Gmail users finally get the option to request read receipts, but these have to be enabled by the administrator and Gmail doesn't respond to delivery or read receipt requests in emails sent from Exchange. Gmail only shows the request when you close the message (Outlook shows it when you open the message) and you have to decide for each message as Gmail doesn't have Outlook's don't ask me again' checkbox. Even more irritating; if you don't want to send the receipt the button you click is marked not now' and Gmail will ask you again every time you read the message.

Apart from creating resources using Google's complex naming structure, you have only a few controls for calendar sharing.

Google Calendar can include shared resources - like rooms and projectors that need booking - which you create by typing in the details one at a time. Oddly there isn't a drop-down picklist to ensure the resources are given consistent names or a wizard to help with the complex naming conventions Google suggests, so you could end up with six conference rooms and one meeting room if you're not careful. If you follow the convention suggested, all resources that start with the same three letters will be grouped into a hierarchy but you can't do this manually.

Exchange Online has templates for creating resources like rooms (as well as equipment that isn't in a fixed location); you can even say which users can reserve rooms without permission and how often.

The Google Calendar features for end users aren't quite as powerful or complex as in Outlook, but you get the important options like overlaid calendars and recurring appointments. The Quick add tool that lets you type in a sentence, including the day and date of what you need to do, which then sets an event on the right day at the right time is a phenomenal time saver.

Winner: Tie. The Microsoft Web Apps for crediting documents are more sophisticated than Google's equivalents, but Google Docs has better sharing and collaboration features. Exchange Online has a plethorea of configurable options, but many organisations won't need these and may prefer Google's less feature-packed but also less cluttered approach.

Office and working offline

Depending on which plan you sign up for Office 365 includes download rights for the professional version of Office 2010, which includes OneNote, Publisher and Access as well as the usual Word, Excel and PowerPoint. You can load and save documents from all of them into the SharePoint Online site included in Office 365 and use the online collaboration features to edit documents at the same time in the main apps.

Depending on which plan you sign up for Office 365 includes download rights for the professional version of Office 2010.

This is a bargain; you get the full power of Office and the back-end servers that enable all the features, from using Information Rights Management to control who can distribute a file to asking people to update a database by replying to email. One great feature for businesses; you can host PowerPoint presentations online and present to a group of people on the Web, letting them ask questions and make comments ideal for training or sales pitches.

Also available are the publicly accessible Office Web Apps; Word, Excel, PowerPoint and OneNote all but PowerPoint let multiple users edit the same document at the same time. SharePoint synchronisation neatly takes care of making documents available offline as well as accessing them from anywhere online.

Although offline access to Gmail and Google Docs (without the deprecated Gears plugin) is still only available to Google employees, Google recognises that offline document access matters. You can run software to sync Outlook with Gmail, Calendar and Contacts, and to move Outlook Notes to Google Docs (though they're read-only, it doesn't sync notes filed in folders - and if you use Outlook on multiple PCs you have to run the tool on all of them because categories, follow-up flags and other settings don't sync fully otherwise).

There's a connector toolbar for Office that lets you sync documents to Google Docs; the latest release fixes many of the problems in the first version, but it's not as polished as the SharePoint integration and converting files into Google Docs for editing online doesn't preserve all document features (the same thing happens when you open an email attachment in Google Docs). You can't edit watermarks, smart art, charts or footers in Office Web Apps, but you can see them in the read-only viewer and they're preserved in the document so you get them back when you open it back in Office. Google Docs doesn't show those details and doesn't keep them if you edit the document. Even fonts and line spacing can change when you move Office documents in and out of Google Docs.

Winner: Office 365. Microsoft's offline support is far from polished, essentially being dependent on SharePoint and subscription access to the full Office suite, but this is also, unsurprisingly, far more capable than Google's cumbersome and crude offline tools.

Service levels and support

The Google Apps dashboard repeatedly told us that there might be a problem with an unspecified Google Apps service; whenever we clicked through to the dashboard all the services showed as having no issues, but seeing the warning virtually all the time was concerning. Office 365 has a similar service health dashboard; neither service had any major outages or failures while we were testing them, but Office 365 didn't keep warning us of non-existent problems.

Despite frequent warnings about a problem, Google Apps didn't record any disruptions to the service.

Both services promise 99.9% availability. Google Apps measures this on a monthly basis with a credit of three days of service if the SLA is not met in a month; Office 365 credits 25%, 50% or 100% of the service cost if the SLA falls below 99.9%, 99% and 95% respectively.

Google Apps has no planned downtime; Office365 does schedule maintenance when usage is likely to be low for example Lync might be unavailable for five minutes at 1am on a Saturday morning and dates and times are listed five days in advance in the support area.

Support is definitely better with Office 365. Support is requested using the admin console and your requests are managed there, but 24-7 phone support is also available with response times from 15 minutes to four hours depending on the severity.

Issues with Office 365 can be broken down by exactly which part of the service is affected.

Google Apps also has 24-7 phone support but only for critical problems that involve more than half your users and affect the Google Apps Web services. If the problem was with mobile emails you'd be stuck with email support, which doesn't cover weekends.

Winner: Office 365, but only just. It's tough to judge how reliable a cloud service is, but Microsoft's technical support has better availability which is reassuring.

Verdict

Google Apps has a flat price of 33 per user per year; Office 365 has a range of prices from 6.50 to 17.75 a month, depending on whether you want Office, Office Web Apps, SharePoint, Lync or archiving it can be more expensive but you can choose what services you want to pay for and there are discounts for volume pricing (including transferring existing Exchange and SharePoint server licences to Office 365).

Google Apps is in a constant state of flux.

Google Apps is in a constant state of flux; the whole service is migrating to a new platform, there are two versions of the control panel available, there are options to give users access to previews of new interfaces and features from Google Labs which itself is going away, with no indication of what happens to the features it provides and new features like return receipts arrive periodically. Getting continuous, instant improvements is one of the benefits of cloud services, but if you're managing the service and supporting users you might prefer Microsoft's approach where updates come at regular intervals and you can choose whether to adopt them immediately or by a specific date.

That underlines one key difference between the two services that has little to do with features; Office 365 has the professional feel of a service planned in advance and designed for administrators; Google Apps has the feel of a service that has grown by leaps and bounds, but sometimes in a rather haphazard way that's not always consistent.

In the end, the two services are both powerful but they suit different audiences.

In the end, the two services are both powerful but they suit different audiences. If your business already uses Microsoft tools, Office 365 is the logical progression, giving you server workloads that integrate with and make the most of your existing investments. It's a comprehensive, powerful, end-to-end cloud platform for business that doesn't make you do everything online, which many businesses find a step too far. You can have all the power of Exchange and SharePoint without the bother of configuring and running them.

If you need a mix of on-premise and cloud services, having to manage both Active Directory and the Google Apps control panel is more work than being able to do everything through System Center. Google Apps is a better fit for businesses starting from scratch online with no legacy systems who can benefit from the simplicity without having to keep the service in sync with on-premise tools, but it has definite limits.

MICROSOFT OFFICE 365 SYSTEM REQUIREMENTS Operating system: Windows XP SP3 or later; MacOS X Leopard 10.5 or later; Windows Server 2003 or later Office client: Office 2007 SP2; Office 2008 or later; Lync 2010 Administration and Office Web Apps: a modern web browser Active Directory-based features: single forest GOOGLE APPS SYSTEM REQUIREMENTS Modern web browser

Retail giant Tesco and tech behemoth Microsoft have penned a contract which will see the supermarket chain purchase plenty of collaboration software.

As Tesco has started growing globally, it has sought better collaboration services to ensure the company does not become too fragmented.

The deal with Microsoft will provide those services, with the SharePoint, Exchange and Lync technologies expected to provide immediate rewards.

"We have lots of colleagues in Tesco, doing lots of jobs all over the world," says Mike McNamara, group chief information officer (CIO) at Tesco.

"These technologies can help bring us together to share learning and expertise, views and opinions, thoughts and ideas."

Tesco will also be able to enjoy access to the Microsoft Services' Enterprise Strategy programme, which will offer advice to the retail firm on delivering projects.

"Tesco is one of the most innovative global retailers and this commitment confirms their position in the industry as a company that is focused on its customers, as well as driven by forward-thinking leaders," said Bill Gonzalez, general manager for the worldwide distribution and services sector at Microsoft.

At the time of publication, Microsoft had not confirmed how much the eight-year deal would be worth.

This kind of deal represents where Microsoft is successful. Its online services division, however, continues to leak money.

In the Redmond giant's recent quarterly results briefing, the division revealed its loss widened to $728 million from $688 million a year ago.

Microsoft has launched Service Pack 1 (SP1) for Office 2010 and SharePoint 2010.

The software giant hopes the update will "address customer feedback as well as the security, stability and performance of our products," according to the Microsoft Office Blog.

We are grateful to those customers and partners who have taken time to provide us the feedback that makes our products and services better.

The new service pack contains all the existing cumulative and public updates already released for the 2010 suite as well as new fixesfor each product.

The service pack is available through a number of channels including the Download Centre. Users with Office Automatic Updated enabled will be able to download the pack manually from Microsoft Update initially, but after 90 days an automatic update will be available.

Those with Office Click-to-Run streaming setups will have to wait until the beginning of July for the update.

On the subject of the SharePoint update, Microsoft said: "For SharePoint customers planning to deploy Service Pack 1, it is also recommended to install the June 2011 Cumulative Update for SharePoint when it becomes available in the coming weeks."

The company was keen to emphasise how important customer feedback has been in getting the service pack out the door.

"We are grateful to those customers and partners who have taken time to provide us the feedback that makes our products and services better," it said.

Google has brought the ability to edit and share Microsoft Office documents to its own Google Docs.

Dubbed Cloud Connect, the move is seen by some as a direct attack on Microsoft's own SharePoint software. The offering enables users to work on Word, PowerPoint or Excel documents in Microsoft Office 2003, 2007 or 2010 at the same time in two different locations.

However, unlike Share Point, this add-on for Google Docs is free.

"Millions of businesses are experiencing radical productivity gains with web-powered tools, and today Google Apps collaboration is ready for every employee," Shan Sinha, Google Apps product manager, wrote on the Official Google Enterprise blog.

"You can edit a Word document's table of contents from Dublin while co-workers adjust formatting and make revisions from Denver. Instead of bombarding each other with attachments and hassling to reconcile people's edits, your whole team can focus on productive work together."

However, the system only works on Windows PCs and Google has admitted it is unable to create the same add-on for Mac users.

"Unfortunately due to the lack of support for open APIs on Microsoft Office for Mac, we are unable to make Google Cloud Connect available on Macs at this time," Sinha added.

"We look forward to when that time comes so we can provide this feature to our Mac customers as well."

Google also announced it is to offer a 90-day "Appsperience" to enable businesses to test out whether its Apps model would fit into their corporate environment.

"Appsperience [lets] businesses encumbered with 1990s technology experience modern collaboration and the burst of productivity that's possible now," Sinha said.

"Whether you manage IT for your whole business, lead a department, or manage a complex project like an industry event, a nominal fee covers 90-day unlimited use of Google Apps collaboration plus hands-on support from Google experts."

Microsoft and T-Systems have signed a five-year deal with Shell as the energy giant looks to help its workers collaborate more effectively.

The oil and gas firm is already one of Microsoft's biggest SharePoint customers, but from April 2011, the company should be able to take advantage of a customised service.

Microsoft and ICT provider T-Systems will work together on providing the service.

"For us as a globally operating company, SharePoint is a key instrument for smooth cooperation in projects with decentralised teams," said Shell's vice president for IT services Jay Crotts.

"This joint solution will allow us to appreciate considerable cost reductions and greater flexibility."

Shell will be taking advantage of a hybrid cloud model in its use of SharePoint.

"It is highly significant for us that Shell, one of our largest SharePoint customers, is now receiving the application in a hybrid cloud, thus putting them at the top of the innovation tree in this area," added Jan Piet van Roon, global client director for Shell at Microsoft.

The announcement comes after Shell signed a deal with Logica last week, worth 300 million (250 million).

That agreement will see the Logica and FleetCor Technologies supply the energy company's Commercial Fleet fuel cards programme across Europe and Asia.

Both moves indicate Shell is increasingly looking to outsourcing rather than running big operations in-house.

Are you getting the most out of your IT expenditure? It's a simple question that not enough companies ask themselves seriously. But think about it. Can you lay your hands on up-to-date information as quickly as you'd like, or do you have to ask someone else to compile the information you need and then wait for them to get round to it?

When you get the figures are you sure they're right or could they contain mistakes from being retyped or perhaps they were right two weeks ago when the basic data was collected but things have changed in the time it took for that data to be summarised and to reach your desk?

If you have to wait to get the information you need, what about your staff? Are they also being frustrated by not having accurate or timely information available to support their decisions? And, without accurate and timely information are you sure the decisions being made are the right ones or are you just not making decisions because you don't have the right information to hand?

You've likely spent a considerable amount on IT over the years. This article aims to show you how you can improve the return on that investment to get faster, more accurate information to help you and your staff make the right decisions at the right time.

An agile company is more likely to survive and prosper in today's challenging business environment winning and retaining customers, reducing costs, increasing turnover and profit. Access to timely and accurate information plays a large part in being agile. Here's how to get that data.

We'll explain the technologies involved in building IT systems to support better business decisions, showing how they can work for you. We'll explain why you may already have these systems without even knowing it or how you can get them at minimal cost. We'll keep the jargon to a minimum but provide lots of links to further reading so you as the business decision maker or your IT people in house or consultants can find out more.

Click the link below to read the full white paper.

Microsoft has introduced its cloud-based Office 365 product, designed to help businesses improve productivity.

The cloud service, which can be bought in various packages for businesses of various sizes, brings together Office, SharePoint Online, Exchange Online and Lync Online.

Office 365 is compatible with the "most popular" browsers, smartphones and desktop applications, according to Microsoft, and can be set up in only 15 minutes.

"Office 365 is the best of everything we know about productivity, all in a single cloud service," said Kurt DelBene, president of the Office division at Microsoft.

"With Office 365, your local bakery can get enterprise-calibre software and services for the first time, while a multinational pharmaceutical company can reduce costs and more easily stay current with the latest innovations."

On the low end of the scale, small firms can get hold of Office Web Apps, Exchange Online, SharePoint Online, Lync Online and an external website for 5.25 (4.62) per user, per month.

For larger organisations the 22.75 per user, per month deal would be more suitable, providing them with a plethora of features including Office Professional Plus, email, voicemail, enterprise social networking, instant messaging and videoconferencing.

The cloud offering will not be available until next year, but this week Microsoft has started testing Office 365 with a few thousand organisations in 13 different parts of the world.

This beta project will incorporate more organisations in the coming months.

Later in 2011, Microsoft Dynamics CRM Online will also be included in Office 365 and a package for education will also debut next year to provide students with cloud-based technologies.

Read on for our feature on why it is time for businesses to start thinking seriously about the cloud.

Windows Phone 7 is about to hit retail and there has been a lot of talk about its potential as a consumer-focussed operating system with relatively little mention of its viability for business users. The whole look and feel of Windows Phone 7 is very different both from earlier Microsoft smartphone operating systems and from any other smartphone operating system.

There will be plenty of business users wondering how well Windows Phone 7 will work for them. Here, we take an overview of Microsoft's new operating system from a business point of view, pending a more detailed examination once we've got our hands on some hardware and given it a thorough testing.

We'll start by making one important point about Windows Phone 7. It is not backwards compatible with earlier versions. If your company currently use phones that run Window Mobile 6.5 or earlier, and you have a number of third party applications that you use regularly, upgrading to Windows Phone 7 models will prove tricky.

You may have to get your own developers to do some work, or it might mean finding suitable, replacement third party applications in the new Windows Phone Marketplace. At the launch event Microsoft was tight-lipped about how many apps will be in the store when handsets go on sale. If your own favourites have not been updated for the new operating system, you will have to do without them or postpone upgrading.

There are three important areas for any enterprise or business smartphone user email, calendars and productivity. Let's look at each of these in turn to see how Windows Phone 7 stacks up.

The home screen on Windows Phone 7 phones have tiles'. These are basically icons which are automatically updated with live information, reminiscent of the Today screen familiar to users of Windows Mobile 5 and 6. Some of these tiles take you to hubs' - groupings of information that can be drawn from different applications. There are six hubs Marketplace, Games, Music and Video, Pictures, Office, and People.

The Office hub is the one you'll use for many productivity functions. Within it you can get to the all important document editing and creation features. It is easy to create new OneNote, Word and Excel documents and see others that have already been created. Cutting, copying and pasting of text and images is currently not possible, although Microsoft has announced a software update, due in the New Year, that will add these essential features.

When it comes to PowerPoint, you can do some basic editing and the viewing experience includes support for animations in presentations. Presentations looked pretty slick on the demo we saw, though it remains to be seen how well Windows Phone 7 will cope with real world presentations. We don't think you can actually give presentations from a phone we've not seen any evidence of Windows Phone 7 devices with video-out ports for connecting an external screen or projector.

Most importantly for enterprise users, Windows Phone 7 integrates with SharePoint 2010 so you can access shared office files and keep them synchronised. For those who don't have access to SharePoint 2010, there's Windows Live SkyDrive which is Microsoft's consumer online storage service. Free space is limited to 25GB and can be used for a range of different files across a handset not just for work-related documents but for photos as well, for example.

An added advantage of having a Windows Live account is that you can perform some remote security functions that the small businessperson might find handy. You can, for example, locate your handset useful if you've left it somewhere by setting it to ring even if it is currently set on silent or vibrate. These things might help you recover a lost handset. If all else fails, you can remotely lock or wipe the handset, restoring it to its factory settings and thereby protect all your valuable data from prying eyes.

Email has its own tile on the main screen. Email support runs to both personal email accounts and Microsoft Exchange. There are different screens for all, unread, flagged and urgent messages, and you can easily delete individual messages from any list. Lists of messages show the sender's name in large text, then a preview snippet of the message content, with a colour change indicating if you've read a message or not.

Another central activity for enterprise smartphone users is calendar management, and here Microsoft has taken something of a leap forwards. You can have a calendar tile' on the main screen of the handset and this is a double width tile so that it has the space to show some information about upcoming commitments.

Ata-glance calendar information is not particularly novel, but Microsoft takes the idea a step further in that the lock screen on a handset shows your next calendar appointment, so that you don't have to go through the bother of fully unlocking your phone and opening an app to check where and when your next time commitment is.

A real innovation is that a Windows Phone 7 device can display data from two calendars at once showing the pair vertically side by side. This means you can match up a work and home calendar, or maybe a calendar for yourself and your partner in order to avoid any scheduling conflicts.

Verdict

From what we've seen of Windows Phone 7 so far, the new smartphone operating system looks like a mixed blessing for business users. The interface has been significantly improved over previous Microsoft smartphone operating systems, but users dependent on third party apps, as well as copy and paste, may want to postpone upgrading for now.

Software vendor Microsoft has introduced a Premier Mission Critical Support add-on for enterprise customers requiring instant, personalised support for their most critical operations.

The new service comes as a bespoke add-on to Microsoft's existing Premier Support plan, and provides customers with a dedicated Microsoft Solution Engineer permanently on-call to provide instant support and expertise.

"It goes without saying that mission-critical solutions require higher levels of attention, given their potential to stop business in its tracks if an outage or other incident occurs," Microsoft Service chief technical officer Norm Judah said.

"Through a comprehensive set of services and support offerings, Microsoft Services is helping our customers identify and implement the right mission-critical technologies for their businesses, with the assurance that a staff of experts is on hand to support the customers' most important applications."

As such, the service has no off-the-shelf price. As part of the service, a dedicated team will conduct an assessment of customers' systems configuration and requirements, before tailoring a personalised package designed for their needs.

Microsoft guarantees a response within 30 minutes, with issues requiring attention from its product development teams given highest priority.

The package is available on a per-solution basis across a range of mission-critical Microsoft products, including .NET Framework, Microsoft BizTalk Server, Microsoft Exchange Server, Microsoft Office SharePoint Server, Microsoft Dynamics CRM, Microsoft System Center, Microsoft SQL Server and Windows Server.

The recession has forced business leaders to look again at how employees collaborate, and made managers more open to innovation.

These are the conclusions of a global survey of executives in Europe, North America and Asia carried out by Kelton Research for Avanade, the business technology firm.

Researchers found that close to 80 per cent of executives surveyed believed that, post recession, their companies are more open to innovation. Three quarters planned to increase spending on communications and collaboration tools.

The increasingly global nature of business, and in some organisations, a more dispersed workforce, is causing companies to place more value on collaboration, and tools to make that easier.

From the survey, 38 per cent of respondents felt that employees are now more likely to turn to others in the business for help in solving problems. According to Tyson Hartman, Avanade's global chief technology officer, the demand for real-time information in businesses is also causing companies to look again at the way they work.

Globally, Kelton Research found a shift among companies from cost savings to investment, especially in innovation.

However, significantly fewer businesses in the UK than in Germany said they were under pressure now to innovate just three per cent against 25 per cent while UK mangers were also more likely to focus on cost cutting (33 per cent against 31 per cent in Germany, and just 11 per cent in the US).

Attitudes to collaboration tools also varied widely, and suggest that communications and collaboration tools are considered more mainstream in Germany, the Nordics and Singapore than in the UK, or even the US.

More than 70 per cent of German executives, and 76 per cent of Swedes, felt collaboration tools were already "widely used, but only 39 per cent in the US, and 30 per cent of Britons agreed.

And according to Avanade, there is still a degree of resistance to the latest collaboration tools, with some executives even saying that they "dread" using them.

Chief among the objections, Kelton Research found, was the fear that collaboration "wastes time and energy".

Today's release of Microsoft's Office 2010 and SharePoint 2010 will spur the global economy and could help sort out the UK's new coalition government, too.

Microsoft today unveiled its latest versions of Office and SharePoint, which are now available for business licensing users, with a consumer version hitting shelves 15 June.

Speaking at an event in London today, Jeff Teper, the corporate vice president of Office business platform said Microsoft's partners will spur the economy to the tune of $6.7 billion around the world by selling services off the back of SharePoint 2010 integration - and that's not counting how much Microsoft itself makes off sales.

SharePoint will create an "opportunity" worth $5.6 billion this year alone for Microsoft partners and third-party developers, the company said, hitting $6.7 billion next year.

The release will be an "engine of growth not just for end customers, but an engine of growth for these partners as they try to grow their businesses," Teper said.

The collaboration tools in the two systems could help out the new coalition government, too - and not just by boosting the economy, Teper joked. "They're going to need to collaborate... maybe we should make a stop at Number 10 on the way to the airport, see if we can share some tools with them," he said.

UK success?

Microsoft believes the software packages will be a success with local businesses too, citing 8.5 million pre-release downloads in the UK alone much more than previous editions have seen, Teper noted.

Globally, 90 million of Microsoft's 500 million existing customers have already bought licences for the 2010 lineup, Teper said.

Microsoft also trotted out big name UK customers like BT, Cancer Research UK and the Football Association, the latter of which is using SharePoint to manage the discipline process behind football fouls.

Consumer sales

Consumers will be able to pick up their copies in June, with Teper saying Microsoft expects "many, many of them to do that."

Part of that will be spurred by the new Web Apps, the free online version of Office, which will be available to the 400 million Windows Live users by June as well. "We think we're going to reach many many more people with this release than any other," Teper noted.

Between Office 2010 and last year's Windows 7 release, Microsoft expects the refresh cycle to finally really kick off. "We think we are going to get into a... refresh cycle with businesses and consumers with this new release," Teper said.

Jacob Jaffe, head of Microsoft's information worker business group lead, told IT PRO: "The combination of Office 2010 and Windows 7 is a great reason and a great milestone for our customers to think about doing that refresh."

Read on for our review of the Office 2010 beta.

SAP and Microsoft have teamed up for an enterprise Duet a new product to link up the companies' products.

Unveiled alongside the release of the SharePoint Server 2010 beta, Duet Enterprise is an extension of a previous system that brought SAP into Microsoft Office.

"We heard from customers their strong desire to generate more value from their existing IT investments," said Pascal Gibert, director of Duet product management at Microsoft. "Historically, customers who integrated Microsoft SharePoint and Microsoft Office with SAP applications faced a number of challenging tasks, including authentication between Microsoft SharePoint and SAP services, and the building and deployment of combined services and solutions."

"Duet Enterprise will empower people to blend SAP data and processes with Microsoft SharePoint content and collaboration tools to increase personal and team productivity across the PC, phone and browser," he added in a statement.

Duet Enterprise sorts out the interoperability and security issues, letting IT pros integrate SAP and Microsoft's SharePoint and Office into a single solution for end users.

Microsoft said Duet Enterprise would be available in the second half of next year.

Microsoft has unveiled that the public betas for Office 2010 and SharePoint Server 2010 will arrive next month.

The actual release date for the the final versions of the products is yet to be revealed, but Microsoft has said Office 2010 will arrive by the first half of next year.

SharePoint Server 2010 will feature a new ribbon interface similar to that arriving in Office. It will also bring tagging, more integration and document management, Microsoft said, as well as including Silverlight support and new APIs for web development.

Microsoft Visual Studio 2010, which saw its second beta arrive today, will also feature new SharePoint tools.

Click here for our review of the Office 2010 technical preview.

Microsoft has warned users about a bug introduced in its SharePoint business software, by a service pack update that causes it to shut down after 180 days.

Jeff Teper, corporate vice president at Microsoft SharePoint, said that Service Pack 2 (SP2) deployed for SharePoint Server 2007 had a bug.

The error improperly activated a product end date and meant that the copy of SharePoint expired as a trial installation 180 days after SP2 was deployed.

Teper said on SharePoint's official blog that the software would not be affected until after the 180 days were up.

He said: "Furthermore, product expiration 180 days after SP2 installation will not affect customer's data, configuration or application code, but will render SharePoint inaccessible for end-users."

Teper said that Microsoft was working on a hotfix to automatically fix the problem, which also affects Project Server 2007, Form Server 2007, Search Server 2008 and Search Server 2008 Express.

There was also a manual workaround involving customers re-entering their product ID number.

In March, Microsoft offered hosted versions of Microsoft Sharepoint as well as Exchange.

Microsoft is bringing its hosted versions of Exchange and Sharepoint to the UK, in a move which sets it against Google's Enterprise Apps.

At German tech fair CeBIT today, Microsoft announced that the Business Productivity Online Suite can now be trialled in 19 countries, including the UK. It offers Exchange Online and SharePoint Online as well as a package called Office Communications Online, which offers instant messaging and presence. It will be available for purchase in April.

Stephen Elop, president of the Microsoft Business Division, said in a statement: "We expect customers to save between 10 per cent and 50 per cent in IT-related expenditures as a result of deploying Microsoft Exchange Online, Microsoft SharePoint Online, Office Communications Online and Microsoft Office Live Meeting."

Businesses can subscribe to the entire Business Productivity Online Suite for 10.04 a month per user, or pick and choose between Exchange Online, SharePoint Online, Office Communications Online and Office Live Meeting. Microsoft said buying the whole package offers a savings of 38 per cent versus buying them individually.

Microsoft also announced the Online Deskless Worker Suite, which includes email, calendar and collaboration tools, at a rate of 2.01 per month per user.

Microsoft first announced the online package last autumn, calling it software plus services," rather than the standard "software as a service."

Microsoft said that massive pharmaceutical firm GlaxoSmithKline had already signed up for the Business Productivity Online Suite for it's 100,000 employees.

"The move to Microsoft Online Services will help GlaxoSmithKline cut operational costs by an estimated 30 percent and create a variable cost model that will provide increased flexibility in the future," said Ingo Elfering, vice president of Information Technology Strategy, GlaxoSmithKline.

Click here to read our review of Google Apps Premier Edition.

Microsoft has launched online versions of its SharePoint and Exchange software for business customers - but only for US customers, with availability in the UK to follow next year.

SharePoint and Exchange are Microsoft's collaboration and messaging products, which offer company-wide email, remote access to desktop machines, backup and restoration services, as well as file and printer sharing.

Exchange also allows Windows Mobile-based smartphones to access their email, contacts and calendar remotely.

SharePoint Online and Exchange Online have been in beta in the US since March, with Microsoft claiming to support around half a million users from 18,000 businesses. The service allows businesses to pay a monthly subscription of between $3 (2) and $15 per user per month, depending on their product requirements.

Microsoft claimed the hosted services can save a company up to 10 per cent on costs, by stripping out the initial investment and running costs of managing the infrastructure in-house.

The Redmond giant is clearly hoping Microsoft Online will give customers switching to other hosted options, including Google Apps, pause for thought.

A whopping 87 per cent of companies have cited SharePoint as a source of concern for sensitive data, according to a new survey.

While many organisations are adopting the Microsoft software package, the survey of 150 business managers worldwide found that most companies are largely unaware of what is happening within the information sharing environment.

Nearly two thirds (63 per cent) did not have the tools to monitor and control the use of SharePoint in their organisation, meaning they do not know if sensitive data is being shared in these sites, who is using these sites, who has access to them and who needs access.

Furthermore, more than one-third (34 per cent) of respondents do not have a policy defining acceptable usage for SharePoint. While more than 36 per cent of companies do not currently monitor usage of the software, nor was there anyone in the organisation responsible for ensuring SharePoint security and compliance.

The survey sponsor and access management and compliance firm, Courion said its findings were particularly worrying in light of the fact that analyst firm Gartner reports that approximately 50 per cent of small to mid-sized businesses (SMBs) surveyed are running some variant of SharePoint, primarily to meet their portal, content and collaboration needs.

The report said that users reported that SharePoint is so easy to install and deploy that it doesn't require significant IT expertise or involvement.

It said many IT directors find that, since they are already standardised on Microsoft products in their organisations, it was likely that SharePoint is already in their environment. This has made turning to software to an easy decision when their end users need a collaboration package.

Courion recommended that organisations establish risk-based governance and

controls in their SharePoint environments to ensure long term security and compliance with business policy and industry regulations.

Policy requirements include system administrators and security personnel knowing which SharePoint sites are on their networks and who owns them, as well as who has access to these sites and what permissions they have.

The vendor recommended establishing whether sites with sensitive data being managed using best practices consistent with the organisation's security policies and to amend them if not.

A Microsoft developers' website has slipped up and accidentally published details of when the next version of Office is due for release.

A question and answer (Q&A) article was posted on the developers' Codeplex site to accompany Monday's launch of an open-source podcasting kit for Office SharePoint Server, the company's collaboration and document management platform.

The article referenced "Office SharePoint 2009" and was spotted by a blogger, who subsequently enquired as to whether the rest of the productivity suite currently in development under the codename "Office 14" would also be available in 2009.

The reference was quickly changed to remove any reference to SharePoint 2009 and Microsoft group manager, Ludo Fourrage responded to the blogger's posting.

"I honestly have no idea how the next release of SharePoint will be named, I promise," Fourrage noted, adding that the Q&A had beentaken from customer conversations and did not contain any accurate information about the name or timing of the nest version of Office.

Microsoft has remained tight-lipped about details, including release dates, of Office 14, which will eventually replace the current 2007 version.

It did, however, last month say it would support the latest specification of the XML-based file format Open Office XML (OOXML) in Office 14. The standard has been the subject of controversial and ongoing rivalry with its own Open Document Format (ODF).