Microsoft 365 tenancies drift. People leave and their licence stays. A setting is loosened for a project and never tightened. Somebody is made a global administrator to fix one thing in 2023 and still is.
None of it is dramatic and all of it accumulates. Here is an hour of checking that finds most of it.
1. Licences against people
Open the licences page and compare assigned against your actual headcount. Then open the active users report and sort by last activity.
You are looking for licences assigned to people who left, to accounts created for a project that ended and to duplicates created when somebody's name was spelled differently. Five to fifteen per cent of licences in a typical small business fall into one of those categories, which at current UK prices is real money.
2. Shared mailboxes paying for a licence
A shared mailbox under 50GB does not need a licence. Check whether info@, accounts@ and sales@ are sitting on full user licences because that is how they were set up years ago.
3. Global administrators
Two to four. If you have eight, that is eight accounts whose compromise gives an attacker complete control of your business's data.
Move day-to-day work to role-specific administrator accounts — Exchange administrator, user administrator — and reserve global administrator for the few tasks that genuinely need it. Keep one break-glass account, excluded from conditional access, with its credentials stored physically and its use alerted on.
4. Multi-factor authentication coverage
Not is MFA enabled. Which accounts are exempt.
There is almost always a list, and it is almost always the accounts most worth protecting: the director who found it inconvenient, the shared account used by three people, the service account created for an integration in 2022.
5. Mail forwarding
Run the forwarding report. Every rule sending mail to an external address should be explicable in one sentence by somebody in the business.
Anything unexplained is treated as a compromise until proven otherwise, because creating a hidden forwarding rule is the standard next step after a mailbox is taken. If you have not already blocked external auto-forwarding centrally, do that too — it is in the security settings checklist.
6. External sharing
Two questions. What is the current sharing policy for SharePoint and OneDrive, and what has already been shared under previous policies?
Run a sharing report and look specifically for anonymous anyone with the link shares, anything shared organisation-wide and files still shared by people who have left. This is also the prerequisite for any AI rollout, for the reasons in this article.
7. Guest accounts
Every external collaborator ever added to a Teams channel is probably still there. Contractors from finished projects, a supplier's account manager who has changed jobs, somebody from an agency you stopped using.
Sort guests by last sign-in and remove anyone dormant for six months. They can be re-added in thirty seconds if it turns out they were needed.
8. Sign-in activity
Look at the last week of sign-ins for anything geographically implausible, any successful sign-in from a country you do not operate in and repeated failures against a single account.
If you are on Business Premium and have not yet configured conditional access to block unexpected countries, this report is the argument for doing it.
9. Secure Score
Microsoft Secure Score lists recommendations with an impact rating. Do not chase the number — some recommendations require licences you do not have or trade-offs you have deliberately rejected.
What matters is that you have looked at every recommendation and either implemented it or consciously declined it. An undecided recommendation is a gap; a declined one with a reason recorded is a decision.
10. Message centre and service health
The item everyone ignores and the one that prevents surprises. Microsoft announces changes here before they happen — features being retired, defaults being changed, protocols being disabled.
Ten minutes a month reading the message centre is the difference between preparing for a change and discovering it on a Monday morning when something has stopped working.
Every unpleasant Microsoft 365 surprise I have dealt with was announced in the message centre, in advance, to an inbox nobody was reading.
Make it a habit
The full ten quarterly, and licences plus new administrator accounts monthly. Put it in the calendar with a named owner, because a check that belongs to everybody belongs to nobody.
Write down what you found and what you changed. The second review is much faster when you can see what the first one concluded.
If nobody in your business has the hour or the appetite, our system maintenance service includes exactly this review on a scheduled basis, with a written report of what changed since last time. Ask us for a tenancy health check.
