A valid point - you can't match Microsoft's resources and in-house expertise.

But you are probably a much less appealing target. Also, you might be willing to lock it down more than Microsoft, which has to please all those millions of customers and wants to admin it at the lowest cost possible - including possibly minimizing support calls by using permissive settings - and not with the most security possible.

Indeed, one of my favorite inconvenient truths is that geo-blocking remains one of the most effective, and essentially free attack surface reductions you can make.

If all your staff are in a country, there's no reason for your internal tools to be accessible from any other country. If all of your customers are in a country, there's no reason for any of your web presence to be accessible from any other country.

Yes. Managing Exchange is not that hard. Having everyone's eggs in one basket though is just dumb.

Not that hard for you. I think, you’re overestimating the average employee. At my current company, the maintainers absolutely don’t have a clue how it works, and they are completely unusable when there is a problem with it. They don’t know even the basic things, they just blindly follow transcripts from Microsoft, like telecallers.