Microsoft 365 tenant self-check

Global Administrators can change anything, including other people's access. Microsoft recommends keeping the number of admins small and using lesser roles where they do the job.

If not: List every admin role holder in the Microsoft 365 admin center, remove anyone who doesn't need it, and move day-to-day tasks to narrower roles.

If a Conditional Access mistake or an MFA outage locks out your admins, these accounts are how you get back in.

If not: Create two cloud-only emergency accounts with a phishing-resistant sign-in method, exclude them from blocking policies, and test them each quarter.

Guide: Conditional Access baseline

An everyday account clicks links and opens attachments. Keeping admin rights off it limits what a successful phishing email can do.

If not: Give each admin a separate account for admin work, and remove admin roles from everyday accounts.

Partner relationships and delegated admin access can outlast the working relationship by years.

If not: Check Partner relationships in the Microsoft 365 admin center and remove roles from any partner you no longer work with.

A stolen password is the most common way into a Microsoft 365 tenant. MFA that people can skip doesn't stop it.

If not: Require MFA for all users through Conditional Access, or through security defaults if you don't have Entra ID P1.

Guide: Conditional Access baseline

Older protocols can't do MFA, so a password alone gets in. Microsoft attributes most password spray attacks to them.

If not: Check the sign-in logs for legacy clients, fix what still uses them, then block legacy authentication with Conditional Access.

Guide: Conditional Access baseline

Report-only is for testing. A policy left there logs what it would have done and stops nothing.

If not: Review each report-only policy's results, fix the failures it shows, then switch it on.

Guide: Conditional Access baseline

Leaked credentials and unusual sign-ins are flagged by Microsoft, but only help if someone reads them.

If not: Decide who reviews risky sign-ins and how often, or have them monitored as part of a security operations service.

An unenrolled laptop can't be checked, updated, encrypted or wiped remotely.

If not: Enrol the remaining devices in stages, starting with the people who travel or hold the most sensitive data.

Guide: Intune and Autopilot rollout

Encryption turns a lost laptop into a hardware cost. Central recovery keys mean a locked-out user isn't stuck.

If not: Apply an Intune encryption policy and confirm in the encryption report that every device is covered.

Guide: Intune configuration profiles

Without this, anyone with a password and an MFA approval can sign in from any computer.

If not: Once Intune compliance reports are clean, add a Conditional Access policy that requires a compliant device, starting in report-only.

Guide: Intune compliance policies

Updates that people can postpone indefinitely tend to be postponed indefinitely.

If not: Set Intune update rings with deferrals and deadlines, and check the update reports monthly.

Guide: Windows update rings

Microsoft occasionally ships an update that breaks a driver or an application. A pilot ring finds it on a few laptops instead of all of them.

If not: Split devices into pilot, broad and late update rings with staggered deferrals, and know how to pause a ring.

Guide: Windows update rings

By default, Intune treats a device with no compliance policy as compliant, so gaps in coverage are invisible.

If not: Assign compliance policies for every platform, check the reports, then set devices with no policy to Not compliant.

Guide: Intune compliance policies

For most businesses, MFA and blocked legacy sign-ins cover the main risk. Where staff carry sensitive data on their own phones, a lost phone can mean company data you can't remove.

If not: You don't need to enrol personal phones. If the data warrants it, Intune app protection on the Microsoft apps adds an app PIN and lets you wipe work data only.

Guide: Personal phones and app protection

Hand-built laptops drift from your standard, and they cost a technician's morning each time.

If not: Register new devices with Windows Autopilot through your supplier and set up a user-driven profile.

Guide: Intune and Autopilot rollout

These records help receiving servers reject mail that pretends to come from you, and help your real mail get delivered.

If not: Check your DNS for all three records, turn on DKIM signing in Microsoft 365, and move DMARC towards enforcement once reports look clean.

Attackers who get into a mailbox often add a quiet forwarding or inbox rule so they keep receiving mail after the password is changed.

If not: Review mailbox forwarding and inbox rules, block automatic external forwarding unless it is needed, and alert on new rules.

Microsoft's retention features have limits, and a compromised admin account can delete data inside the tenant.

If not: Put an independent backup in place, held outside the tenant, and schedule regular test restores.

A user on a lesser plan isn't properly covered by the device and sign-in rules you build for everyone else.

If not: Compare assigned licences with your user list, and remove licences held by former staff.

Guide: Business Premium explained

Whoever controls DNS controls where your email goes. Many businesses find their domain is in a former provider's account.

If not: Find the registrar and DNS host for each domain and move the accounts into the business's name.

Handovers fail when nobody wrote down what exists.

If not: Ask your provider for a documentation export now, using our tenant handover checklist as the list.

Guide: Tenant handover checklist