Microsoft 365 security checklist for business
Microsoft 365 security depends on how your tenant is configured and maintained, not just which licence you buy. Use this checklist to prepare a review with your IT team or SCG Solutions and agree who owns each action.
Start with the tenant, people and licences
Identify the Microsoft 365 tenant used by the business, the person authorised to approve changes and the supplier responsible for administration. List active staff, guests, shared mailboxes, business applications and devices. Include acquisitions or separate tenants: a review of one tenant does not cover another automatically.
Match the review to the subscriptions actually assigned. Microsoft lists Intune and Defender for Business among Business Premium capabilities. Entitlement does not prove that devices are enrolled or policies are working. Ask for evidence of deployment and identify any additional licensing needed before accepting a proposed design.
Sources for this section: Microsoft — Business Premium security questions
Review MFA and administrator access together
Microsoft recommends security defaults or Conditional Access to require multifactor authentication. Security defaults provides a baseline without an Entra premium subscription; Conditional Access requires appropriate licensing and offers more tailored policies. Confirm the existing approach before changing it: do not switch off a working control without a tested replacement.
Ask the administrator to demonstrate coverage and explain exceptions, including service accounts and older applications. Keep ordinary work separate from privileged administration where practical. Agree an approved emergency-access process, recovery contacts and a pilot group so a change does not lock the business out.
Sources for this section: Microsoft — set up multifactor authentication, Microsoft — security defaults
Check email, sharing and device coverage
Ask which policies apply to mailboxes and devices, which users are outside those policies and who reviews alerts. Include external forwarding, file-sharing permissions, third-party application access and lost-device procedures in the discussion. Agree a way for staff to report suspicious emails without forwarding sensitive attachments into a public enquiry form.
Make the boundary between personal and company devices explicit. Record supported operating systems, onboarding requirements, update ownership and what happens when a device cannot meet policy. If several security tools are already installed, review compatibility and response ownership before adding another agent.
Make access changes a repeatable process
Give joiners, role changes and leavers named owners and approval steps. When someone leaves, the business needs a decision about access, mailbox handling, files, connected applications and data retention. Do not remove a licence or delete an account before the administrator has checked the consequences for required data and service dependencies.
Review guest accounts and supplier access as well as employees. Record why access exists, who sponsors it and when it will next be checked. An account list is useful only if somebody can act on stale or inappropriate access with the correct approval.
Agree recovery evidence and follow-up actions
The NCSC advises organisations to back up critical data when using online services. Identify what must be recoverable, the required recovery point and the time the business can tolerate being without it. Ask the technical owner to explain retention, recovery options and any separate backup service rather than assuming that being in the cloud settles the question.
Finish with a prioritised action list: issue, owner, approval, target date and evidence needed to close it. A licence review, tenant configuration review and incident-response service are different deliverables. Confirm which you are commissioning, how changes will be tested and when the next review takes place.
Sources for this section: NCSC — back up critical data in online services
What to ask for in a Microsoft 365 review
Use evidence of coverage and ownership, not a list of product names, to assess the proposed work.
| Area | Evidence to review | Responsibility to agree |
|---|---|---|
| Identity and administration | MFA policy coverage, privileged accounts and approved exceptions | Policy changes, recovery access and regular access reviews |
| Email and devices | Applied policies, enrolled devices, supported versions and alert routing | Onboarding, updates, suspicious-email reporting and response |
| Data and recovery | Retention settings, protected data and recovery-test records | Restore requests, testing, business priorities and approvals |
| Staff and supplier access | Joiner/leaver records, guests and connected applications | Access approval, removal, data handling and review dates |
Your Microsoft 365 security checklist
Bring an inventory and your questions to the meeting. Do not send passwords, recovery codes or raw customer data.
- Name the tenant owner and authorised administrator.
- List users, guests, applications, devices and assigned subscriptions.
- Confirm how MFA is required and document exceptions.
- Review privileged access and the emergency-access process.
- Check email, sharing and device-policy coverage.
- Agree joiner, leaver and supplier-access responsibilities.
- Record required data, retention and recovery evidence.
- Prioritise actions with owners, approval steps and review dates.
Related services and next steps
Microsoft 365 security checklist for business — common questions
Does Microsoft 365 Business Premium make the business secure automatically?
No. A subscription provides capabilities, but those capabilities still need appropriate configuration, deployment and ongoing ownership. Review the actual tenant, users and devices instead of treating the licence name as evidence of protection.
Do we need Conditional Access to use MFA?
Not necessarily. Microsoft documents security defaults as a baseline approach and Conditional Access as a more tailored approach requiring appropriate licensing. Your administrator should assess existing policies, applications and requirements before choosing or changing the approach.
Is Microsoft 365 security the same as Cyber Essentials certification?
No. Tenant controls are only part of the organisation’s security scope. Cyber Essentials readiness and certification have their own requirements and assessment process. A Microsoft 365 checklist does not award a certificate.
Can SCG Solutions review Microsoft 365 alongside our existing IT team?
Discuss which responsibilities your team retains and which work you want SCG Solutions to quote for. Establish the scope, approved contacts and secure access process before anyone changes the tenant.
Plan your Microsoft 365 review
Tell SCG Solutions your approximate user and device count, current Microsoft 365 subscriptions and the areas you want reviewed. We can discuss the scope with your authorised IT contact.
Discuss Microsoft 365 support