What IT does a solar or battery installer need as it grows from 5 to 50 people?

Why does installer IT break as the business grows?

Solar and battery installers grow in steps, not slopes. A new commercial contract, a housing association framework or a good grant season can add five engineers in a month. The IT that worked when the founder knew every password stops working the week nobody does.

Installers also have a mix most office businesses don't: most staff are on the road, much of the valuable data is photos and certificates, and a lot of access lives in manufacturer portals rather than in Microsoft 365. So the order of fixes is a little different. Our guide chapter on renewable energy IT strategy sets out the overall shape of a good setup. This article is about timing: what breaks first, and what to fix at each size.

What breaks at each stage?

The numbers are rough. A 12-person installer doing commercial work may hit the 30-person triggers early. A 40-person business that only does domestic work may not feel them until later.

At 5 people: get the foundations in the business's name

At this size the risk isn't hackers with sophisticated tools. It's that everything important is in one person's name: the domain, the email accounts, the phone numbers, the logins to the MCS portal, the wholesaler and the manufacturer portals. If that person is ill, leaves or falls out with the business, so does the access.

Put the domain and Microsoft 365 in the company's name, give everyone their own account with multi-factor authentication (MFA, a second check when they sign in) switched on, and take phone contracts in the business's name so customer-facing numbers stay when people move on. Microsoft 365 Business Premium is built for businesses up to 300 users, so the licence you pick now can carry you right through to 50 and beyond. Our article on setting up IT for a new business covers day-one choices in more detail.

At 15 people: control the devices and the jobs

This is the stage where most installers feel the pain first. Engineers are using personal phones for site photos and customer details. Jobs are tracked in a spreadsheet that three people edit. A laptop goes missing from a van and nobody knows what was on it.

Three things fix most of it. Enrol every company laptop and phone in Microsoft Intune, so devices are encrypted, updated and can be wiped. Move jobs into a SharePoint tracker with a folder per job (see our article on getting photos, paperwork and handover packs off site). And write a one-page joiners and leavers checklist that includes every manufacturer and wholesaler portal, not just Microsoft 365. The article on security rules for inverters, batteries and chargers explains why customer app accounts belong on that list too.

At 30 people: prove it to insurers and customers

Somewhere between 20 and 40 staff, outsiders start asking questions. A cyber insurer's renewal form asks whether you use MFA, how devices are managed, whether backups are separate from your main systems and how quickly you install security updates. A commercial customer, developer or public body sends a pre-qualification questionnaire asking for Cyber Essentials.

Most businesses aren't there yet. Only 10% of UK businesses have a specific cyber insurance policy, 47% use two-factor authentication and 5% hold Cyber Essentials, rising to 12% of small businesses (DSIT, April 2026). That gap is an opportunity: an installer that can answer yes to every question on the form wins work others can't bid for.

Greenversity is a good example of the insurer trigger. Its cyber insurer required stronger controls over its devices, and Indigo Unified Communications met that requirement by rolling out Microsoft Intune. See Cyber Essentials explained for what certification involves.

This is also when "the person who's good with computers" stops being enough. Their day job suffers, nothing is written down, and every fix is a favour. A helpdesk with published response times, whether in-house or outsourced, costs less than the lost hours. Our guide to what IT support costs in the UK sets out typical models.

At 50 people: monitor, recover and own the plan

At 50, an incident isn't an inconvenience; it stops dozens of engineers and puts customer data at risk. Breaches are also more common as businesses grow: 46% of small businesses and 65% of medium businesses reported a breach or attack in the last year, against 42% of micro businesses (DSIT, April 2026).

The additions at this stage are about time and recovery. A dedicated security team watching your systems 24/7 (a security operations centre) looks out for attacks when the office is closed. A recovery plan says how you'd get the job system, email and certificates back, and you test it. Only 25% of UK businesses have a formal incident response plan, rising to 57% of medium businesses (DSIT, April 2026). Someone senior owns the IT roadmap and reviews it against the sales pipeline, because the next framework will need devices and depot connectivity ordered before the engineers start.

Example: a 22-person installer wins a two-year commercial framework and plans to reach 40 people. Before the first new starter arrives, it enrols all existing devices in Intune, sets up the leavers checklist and portal list, and books Cyber Essentials, because the framework's questionnaire asks for it. Laptops and phones for new engineers are then configured centrally and ready on day one, instead of being set up in the car park.

In what order should you do it?

If you're already past one of these stages without the basics, don't try to catch up everywhere at once. The order that removes most risk fastest is the same at any size: MFA on every account, then devices under management, then a leavers process that covers portals, then backup, then certification and monitoring. Our 30-minute IT audit is a quick way to see where you stand.

What we see. Indigo Unified Communications supports more than 10 renewable energy businesses, and more than 50 construction, engineering and renewable energy clients overall, typically between 10 and 500 staff. The installers who struggle most aren't the smallest; they're the ones that doubled in a year without changing how IT was run. Onboarding a new client usually takes about two weeks, and our Platinum package includes Microsoft 365 Business Premium, a dedicated security team watching your systems 24/7 (a security operations centre) and Cyber Essentials support. IT support for renewable energy →

What to do next

1. Be realistic about where your business sits in the table above, and note which "what breaks" items you recognise.
2. Check that the domain, Microsoft 365, phone numbers and every portal are in the company's name, not a person's.
3. Switch on MFA everywhere and enrol every company device in Intune before you hire again.
4. Pull out your cyber insurance renewal form and any recent customer questionnaires, and list the questions you can't yet answer yes to.
5. Book a renewable energy technology assessment to turn the list into a plan tied to your pipeline.