Microsoft 365 email checkup
Microsoft 365 has a setting for almost everything. Most firms have never seen half of them. We go through the ones that matter to email security, with read-only access, and tell you which are set the way you'd expect.
How we get in, and out
You assign us the Global Reader role (plus Security Reader where needed) on a named account for the length of the review. Both roles can see settings and reports but cannot change them. When the walkthrough is done, you remove the account.
What we review in Microsoft 365
-
MFA registration and enforcement
Who is registered, who is actually required to use it, and which methods are allowed. Text-message codes are noted where stronger options are available.
-
Security defaults or Conditional Access
Whether security defaults are on, or Conditional Access policies replace them, and whether those policies have gaps such as excluded users or trusted locations. Conditional Access is reviewed only where your licences include it.
-
Admin roles
Global administrators, who holds them, and whether they are separate cloud-only accounts. Emergency access accounts and how they are protected.
-
Legacy authentication
Whether any older sign-in methods or app passwords remain that bypass MFA.
-
Outbound forwarding
The outbound spam policy setting for automatic external forwarding, and the mailboxes that forward anyway.
-
Inbox rules
Rules that forward, delete or move mail into rarely opened folders such as RSS Feeds or Archive.
-
Audit logging
Unified audit log status, mailbox auditing, and how long sign-in and audit records are kept on your plan.
-
OneDrive and SharePoint sharing
"Anyone" links, guest access, and the organization-wide sharing level compared with how the firm needs to share.
-
Mobile devices
Which phones sync mail, whether app protection or device management is in place, and whether the firm can wipe its data remotely.
-
Email protection
Anti-phishing and impersonation policies, Safe Links and Safe Attachments where licensed, and external sender tagging.
-
Retention and litigation hold
Retention policies, litigation hold, and inactive mailboxes of former staff.
-
App consent
Third-party apps users have granted access to mail and files, and whether users can grant new ones without review.
Also on the list
-
Licensing
Business Basic, Standard, Premium and Enterprise plans side by side with what the firm uses. Unassigned and orphaned licences. Premium features already paid for and left switched off.
-
Backup
Whether Exchange, OneDrive and SharePoint data is backed up outside Microsoft, where it is stored, and how long it is kept.
-
Domain
SPF, DKIM for each custom domain, DMARC, and the other domains in the tenant you may have forgotten about.
Why the details matter here
Microsoft 365 defaults have improved a lot, but tenants set up before those changes keep their old settings. A firm that moved to Microsoft 365 in 2016 can still be running with choices nobody would make today.
The report says which settings date from when, and which are worth changing now.
On the other platform?
Firms on Google Workspace get the same depth of review. See the Google Workspace checkup.
Both platforms get the same five-part checkup, the same report and the same walkthrough.
Book a Microsoft 365 checkup
A one-minute form with your firm name, staff count and platform. We reply within two business days. Prefer email? [email protected]