Microsoft 365 security checklist for business
Plan a Microsoft 365 security review: MFA, administrator access, devices, email, leavers and recovery. A practical checklist for UK businesses.
Plan Microsoft 365 security →Microsoft 365 Licensing and Support
Review Microsoft 365 subscriptions, tenant security and ongoing support with SCG Solutions. Match licences to your team, understand the controls in use and make administration and recovery responsibilities clear.
Match licensing and support to the way your team works
Start with the users, applications and devices that need Microsoft 365. Check assigned subscriptions against actual requirements and contract commitments. A licence without an active user may still support an agreed retention or transition arrangement, so investigate before removing it. Any saving depends on the existing estate and commercial terms.
Review security separately from the seat count. Microsoft documents security defaults and Conditional Access as approaches to requiring MFA, with different licensing and configuration requirements. Business Premium includes capabilities such as Intune and Defender for Business, but entitlement alone does not establish that policies apply or devices are protected.
Agree who maintains tenant settings, approves access, handles joiners and leavers, reviews alerts and supports recovery. Check changes with your existing IT team and use an approved secure process for necessary access. Do not send administrator passwords or recovery codes through the contact form.
What a review covers
Subscription inventory
Record assigned seats, actual needs, renewal dates and contractual commitments.
Licences matched to roles
Check the apps, devices and security capabilities each role requires.
Sign-in security
Review MFA policy coverage, privileged access and approved exceptions.
Joiners and leavers
Agree approvals, account access, data handling and licence decisions.
Configured protection
Check deployment and policy evidence rather than relying on a subscription name.
Clear support ownership
Define administration, incident escalation and recovery responsibilities.
Who we work with
We are independent of any single network or vendor, so the recommendation follows the requirement.
Network & security
Network, endpoint and Microsoft 365 controls are matched to the risk and the tools you already have.
- Check Point
- Huntress Managed EDR
- Microsoft 365
- Fortinet
- Palo Alto
- Ubiquiti
- Forcepoint
Network and vendor names and logos are the trademarks of their respective owners, shown to describe the services SCG Solutions supplies.
Bring these questions to your review
- Who owns the tenant and can approve changes?
- Which users and workloads need each subscription?
- How is MFA required and which exceptions remain?
- Which devices and mailboxes are covered by policies?
- How are staff, guest and supplier access reviewed?
- What can be recovered, by whom and with what evidence?
Practical buying guidance
Plan the decision before requesting a quote
Use an SCG Solutions guide to gather requirements, avoid common compatibility assumptions and prepare a useful supplier conversation.
Microsoft 365 Licensing and Support — Common Questions
How do we identify licences we no longer need?
Compare subscriptions, assignments and usage with the current staff and workload requirements. Check contract terms, retention and service dependencies before cancelling or removing a licence. A headcount mismatch is a reason to investigate, not proof of a saving.
Does everybody need the same licence?
Not necessarily. Requirements vary by role, applications, devices and security controls. Review current Microsoft licensing requirements and the proposed configuration before assigning different plans. Include shared devices, frontline roles and policies that apply across the tenant in the assessment.
Does Business Premium secure devices automatically?
No. Microsoft lists Intune and Defender for Business among its capabilities, but devices and policies still need appropriate deployment, configuration and maintenance. Ask for evidence of coverage and an owner for alerts and exceptions. Include supported operating systems and personal-device boundaries in the review.
What happens to an account when somebody leaves?
Use an approved leaver process covering access, connected applications, mailbox and file handling, retention and licence changes. The administrator should check dependencies and required data before deleting accounts or removing subscriptions. Record who authorises each step and how completion is confirmed.
Can you support Microsoft 365 as well as supply it?
SCG Solutions can discuss licensing, administration and support requirements. Agree the scope, support arrangements, retained responsibilities and secure access process with your authorised IT contact before work begins. Confirm how requests, incidents and changes will be logged and approved.
Does changing licence supplier require a tenant migration?
A supplier change and a tenant migration are different activities. Establish which is proposed and check existing subscriptions, commitments, partner relationships and service dependencies. Agree the process and dates before making changes; do not assume every transition is identical.
Plan your next step
Compare related options, check what needs to work together and prepare the details for a useful conversation.
More IT & Cloud Services
Where we cover microsoft 365 licensing and support
We deliver this across the UK. These 8 are where a director is actually based — each page names who you would be dealing with, and what the local economy is made of.
Plan your Microsoft 365 support
Tell us your approximate user count, existing subscriptions and the support or security gaps you want to address. We can discuss scope, responsibilities and a quote with your authorised IT contact.