Microsoft 365 support in Florida, in short
Mycelium 365 is a Microsoft-only managed service provider with a team member based in Florida — Cori Avery — supporting United States clients in their own timezone, backed by an Australian engineering team. We own your Microsoft 365 tenant, identity, devices and Azure workloads, and we frame the security work around the regulations that actually apply to you here: the HIPAA Security Rule, the FTC Safeguards Rule, PCI DSS and CMMC flow-down. We hold no office premises in Florida, and we will not pretend otherwise.
Supported in US hours
A United States-based team member picks up US work in the US day, rather than everything queuing behind an overseas business day. Staffed windows are set out in your service agreement.
US regulatory framing
HIPAA and HITECH where protected health information is involved, the FTC Safeguards Rule for title and lending, PCI DSS for card estates, and CMMC readiness for defense supply.
Evidence, not assurances
Configuration exports, audit-log retention and tested restores — the artefacts an assessor, an insurer or a client security questionnaire will actually accept.
Your United States team member
United States clients are supported by Cori Avery, who is based in Florida rather than visiting it. That is the difference between a provider that serves the US and a provider that has someone in it: the person you speak to about your environment is awake and working when you are, on your calendar and your public holidays, and she is a named individual you can look up before you call us.
Behind her sits the Australian engineering team that builds and runs the Microsoft platform — the same engineers, the same standards and the same tenant baseline our Australian clients get. The division of labour is honest rather than marketed: Cori is the United States relationship and the person accountable for how your service feels day to day, and the deep Microsoft 365, Entra ID, Intune and Azure work is done by the engineering group.
We deliberately do not claim round-the-clock coverage on this page. What we claim is what is true: a team member in the United States working United States hours, and an Australian team that covers a different part of the clock as a consequence of geography rather than as a product feature. The staffed windows that apply to your account are written into your service agreement, in numbers, before you sign anything.
The wider team, their backgrounds and their credentials are on our leadership page, and how the business started is set out in our story.
Healthcare in the United States? Start here instead
This page covers Florida as a geography. If you are a covered entity or a business associate handling protected health information, the detail you need — HIPAA Security Rule safeguards mapped to Microsoft 365 controls, Business Associate Agreements, audit logging, HITECH breach notification and clinical device management — is on our dedicated United States healthcare page.
Managed Microsoft 365 for US healthcareWhat we run for Florida businesses
Florida technology estates tend to be shaped by three forces at once: a regulatory overlay that varies sharply by sector, a fraud environment concentrated on payments and closings, and a weather calendar that puts a hard test on continuity every year. All three are platform problems, and all three are solved in configuration rather than by adding headcount to a helpdesk.
Managed Microsoft 365
Tenant administration, Exchange Online hygiene, SharePoint and Teams structures that survive staff turnover, and a licensing position reconciled to actual headcount rather than to whatever was purchased two renewals ago.
Managed Microsoft Entra ID
Conditional access, phishing-resistant multi-factor authentication, privileged identity management and guest governance — the control set every US insurance questionnaire and Safeguards Rule assessment asks about first.
Managed Intune and endpoints
Windows, macOS, iOS and Android brought under one compliance policy, including shared front-of-house devices, clinical workstations and warehouse handhelds that never sit on a corporate network.
Microsoft Defender and security operations
Defender across endpoint, email and identity with managed detection behind it, tuned to the attack patterns that actually hit Florida businesses: credential phishing, mailbox rule manipulation and payment redirection.
Backup and recoverability
Microsoft 365 data and Azure workloads backed up with restores that have been attempted rather than assumed — including the retention periods a HIPAA or Safeguards assessor expects to see documented.
Storm-season continuity
Hurricane closures are a scheduling problem for a cloud-first business and an existential one for a business still tied to a server closet. We document the recovery plan, test the failover, and make sure staff can work from wherever they evacuated to on managed devices.
Azure infrastructure
Legacy line-of-business applications and file servers moved into US Azure regions for US data residency and low latency, with cost governance so the monthly bill is a budget line rather than a surprise.
Microsoft 365 Copilot and AI governance
Before Copilot is switched on, oversharing is cleaned up and sensitivity labeling is in place — because in a US healthcare or financial services tenant, an AI assistant surfacing the wrong document is a reportable event, not an awkward moment.
Tier inclusions sit on our packages page. Organisations staring down a customer security review or a policy renewal usually open with a controls review so the shortfalls are documented in fact before a dollar of remediation is approved.
The Florida sectors we know best
Florida's economy is unusually diverse for a single state, and the regulatory burden changes completely between one client and the next. A title agency and an ambulatory clinic five minutes apart answer to entirely different rulebooks, and a platform built for one is wrong for the other. These are the sectors we work in most often.
Healthcare and allied health
Practice groups, ambulatory clinics, behavioral health and senior-care operators handling protected health information. The controls conversation is HIPAA Security Rule first: access control, audit controls, integrity, transmission security, and a signed Business Associate Agreement with every vendor that touches PHI. Microsoft 365 can meet those safeguards, but only when the tenant is configured for them — encryption in transit and at rest, audit logging retained long enough to be useful, ePHI kept out of unmanaged personal devices, and a breach-assessment trail that satisfies HITECH notification timing.
Real estate, title and mortgage
Title agents, brokerages, lenders and closing attorneys are covered by the FTC Safeguards Rule, which asks for a written information security program, a qualified individual accountable for it, access controls, encryption, multi-factor authentication, vendor oversight and an incident response plan. Business email compromise around closing wires is the dominant loss event in this sector, so email authentication, impersonation protection and inbox-rule monitoring are baseline rather than an upsell.
Hospitality, attractions and retail
Hotels, restaurant groups, attractions and their suppliers run seasonal workforces, shared devices and card-present payment estates. The technology pattern is standard identity lifecycle for high-turnover staff, kiosk and shared-device configuration in Intune, and network and device segmentation that keeps cardholder-data systems out of scope creep under PCI DSS 4.0.
Logistics, ports and distribution
Freight forwarders, customs brokers, 3PLs and distributors moving cargo through PortMiami, Port Everglades and JAXPORT. Shift-based shared logins, EDI integrations and rugged scanners define the estate, and invoice-redirection fraud against a high-volume payables team is the risk that actually costs money.
Aerospace, defense supply and manufacturing
Suppliers to primes along the Space Coast and manufacturers across the state increasingly face CMMC flow-down and NIST SP 800-171 expectations in their contracts. That drives data classification, restricted external sharing, hardened identity and evidence retention — and often a decision about which Microsoft cloud environment a given contract requires.
Professional services and family offices
Accounting practices, law firms, wealth managers and single-family offices concentrated across South Florida. Confidentiality, retention and privileged access are the drivers: sensitivity labeling, information barriers where a conflict wall is required, and administrative roles that are time-bound rather than permanent.
The United States compliance picture
There is no single national data protection statute in the United States, which is exactly why compliance here is harder to navigate than in a country with one. What you face instead is a stack: a federal rule for your sector, a state breach notification law, a contractual flow-down from your largest customer, and an insurer asking a fourth set of questions at renewal. All four ask for different words and the same underlying controls.
For healthcare, the HIPAA Security Rule and the HITECH breach notification timelines set the bar, and a Business Associate Agreement is required with every vendor that can touch protected health information. For non-bank financial institutions — title agents, mortgage brokers, lenders, auto dealers, investment advisers — the FTC Safeguards Rule requires a written information security program with a named accountable individual. Card estates answer to PCI DSS 4.0. Defense suppliers see CMMC and NIST SP 800-171 arriving through contract clauses. And Florida's own Information Protection Act sets state breach notification obligations on top of all of it.
Our answer is a single hardened baseline that every one of those rulebooks can be satisfied from. Strong authentication is universal, including admin and emergency accounts. Update cadence is measured, not assumed. Elevated roles are granted for a window and then expire. Sensitive records are classified so governance tooling can act on them. Telemetry is kept long enough to reconstruct what happened during an incident, and recovery is demonstrated by performing it. Our governance and compliance readiness engagement is where that gets mapped to your specific obligations rather than to a generic checklist.
US buyers running vendor risk reviews under HIPAA business associate and FTC Safeguards expectations ask for the provider's own security attestation, not only the client tenant configuration. Our own information security management system is certified to ISO/IEC 27001:2022 (QAS International, certificate AIT1045), covering the managed IT, cloud, cybersecurity and helpdesk services we deliver to clients. See our certifications.
How Florida coverage actually works
Cori Avery works from Florida and looks after US clients inside the American working day. There is no leased office behind her, and pretending otherwise would be the first dishonest thing we told you. Practically all of the work — directory administration, mailbox and licence changes, device enrolment, policy authoring, incident containment — is delivered across the wire because that is how modern Microsoft platforms are administered. When somebody has to physically stand in a server room or unbox hardware, that visit is quoted into the project up front. The regions below describe where our clients here actually sit and what is different about each of them.
Miami and Miami-Dade
Trade, freight forwarding, import-export brokerage and Latin American corporate offices. Cross-border data flows and bilingual staff shape the tenant: multilingual Microsoft 365 configuration, external collaboration with counterparties who are not on your tenant, and wire-fraud controls on an accounts payable function that moves real money daily.
Fort Lauderdale, Broward and West Palm Beach
Title agencies, real estate brokerages, community banks, marine services and family offices. This is Financial Data Exchange territory in miniature: the FTC Safeguards Rule reaches further than most owners expect, and closing-day wire instructions are the single most attacked message in the region.
Tampa Bay and St. Petersburg
Health systems, ambulatory practice groups, insurance and professional services. Practice management and EHR platforms sit alongside Microsoft 365, so the integration question is usually about identity and least privilege rather than about mailboxes.
Orlando and Central Florida
Hospitality, attractions, simulation and training, and the vendors that serve them. Seasonal head-count swings and shared front-of-house devices drive kiosk-mode Windows, shared-device sign-in and card-data segmentation for PCI DSS.
Jacksonville and North Florida
Logistics, port operations, distribution and financial services back-office. High-volume shift work, warehouse handhelds and a heavy dependency on line-of-business applications that predate the cloud by a decade.
The Space Coast and Southwest Florida
Aerospace suppliers, engineering firms and defense-adjacent manufacturers around Melbourne and Cape Canaveral, plus construction and senior-care operators through Naples and Fort Myers. Controlled Unclassified Information handling and CMMC readiness sit in the same conversation as storm continuity.
Every region and country we publish a page for is listed on the locations page, and our United States healthcare page covers the clinical and PHI-handling side of the same market in depth.
Proof, not promises
Managed-plan clients report support demand falling by as much as 95%. The mechanism is elimination rather than throughput: identical machine builds, updates that land, an identity directory without orphans, and no unmanaged drift between what was designed and what is running. Weighing up a provider headquartered offshore, that is the number worth interrogating — how rarely something breaks beats how fast a phone is answered.
What we have delivered is documented publicly. Our case studies set out where each client started, what changed and what it cost. The Microsoft Solutions Partner designation is awarded on measured delivery, not applied for and granted. No case study on this site names a Florida client yet, and we prefer admitting that to rebadging an offshore project as a domestic one.
Florida IT support FAQs
Talk to our United States team
Cori Avery is the first conversation for a Florida business, and it is a conversation inside your working day rather than a form that surfaces overnight. Thirty minutes is enough to walk your tenant, your regulatory exposure — HIPAA, Safeguards, PCI or CMMC, depending on what you do — and your storm-season recovery position, and to say plainly what is exposed. Email sales@mycelium365.com.au or use the contact form and note that you are in the United States so it routes correctly.
Book a US discovery call