A Microsoft 365 security checklist should show whether the business has effective controls, who maintains them and how problems are handled. Enabling a feature is one step. Confirming that it covers the intended people, devices and information is the work that makes it useful.
Use the review below to organise a conversation between the business owner, the administrator and the people responsible for support. Configuration changes should be tested against the organisation's actual environment, especially when they can interrupt access.
Check your licences and current configuration first
Microsoft 365 plans do not all contain the same security capabilities. Microsoft's business security guidance distinguishes baseline protections from additional capabilities available with Business Premium, including Conditional Access and broader device protection. Confirm the licences assigned to the users in scope before designing controls around a feature.
Create a simple review record: control, intended coverage, current evidence, owner and next action. Record exceptions separately. An exception with a reason, compensating measure and review date is easier to manage than an informal promise to fix something later.
1. Verify account protection across the whole workforce
Review active employees, contractors, guest users and accounts used for administration. Confirm how each signs in and whether the intended multifactor authentication requirements are actually enforced. Registration in an authentication app is not the same as a policy being applied consistently.
Consider how new starters enrol, how a lost authentication device is handled and how the support team verifies someone requesting a reset. Otherwise, a well-designed sign-in control can be weakened by an improvised recovery process.
Ask for evidence: a current account inventory, the applicable authentication policy and a documented process for recovery requests. Review unexplained exclusions with the administrator.
2. Treat administrator access as a separate responsibility
Identify who has privileged access and why. Administrative permissions should correspond to a specific responsibility and be reviewed when that responsibility changes. Avoid using a highly privileged account for routine email or everyday browsing.
Plan how authorised administrators regain access if a policy or identity issue causes a lockout. Microsoft's Conditional Access deployment guidance addresses emergency access and recommends testing policy impact before broad enforcement. Where applicable, use report-only evaluation and a controlled pilot rather than applying an untested blocking rule to everyone.
Ask for evidence: a role register, approved emergency access arrangements and a record showing that proposed policy changes have been evaluated.
3. Examine email security as a working process
Email controls need someone to review relevant alerts and handle employee reports. Agree how suspicious messages are reported, who investigates and what staff should do when a request appears urgent but unusual.
Include business scenarios in awareness guidance. A request to change payment details, share a confidential file or approve a new supplier should follow the company's verification process even when the email looks familiar. Staff need a clear route to check the request without relying on contact details supplied inside the suspicious message.
Review the configured protections available under the company's licences, along with authorised mail flows and forwarding arrangements. Record any approved external forwarding and its business owner.
Ask for evidence: an agreed reporting channel, named alert owners and examples of how a reported message is handled.
4. Check the devices that can reach company information
List the device types used to access email and files, including personally owned equipment where permitted. Decide what the business requires before each device can handle company information and how that requirement is checked.
Device ownership affects the support arrangement. A company laptop, a contractor's computer and an employee's personal phone may need different access and management rules. Document who maintains the device, how updates are monitored and how lost or replaced equipment is handled.
Connect this review to proactive IT maintenance. Security policies and everyday support need to operate together rather than become separate lists with different owners.
5. Review sharing through realistic examples
Choose representative Teams, SharePoint sites and shared folders. Ask a business owner to explain who should have access, then compare that expectation with the actual configuration. Include guests and links that have been circulated outside the original group.
A useful test is to follow a completed client project. Who still needs access to its files? Who can invite others? What should happen when the engagement closes? This often reveals ownership questions that a purely technical inspection cannot answer.
Ask for evidence: named owners for collaboration spaces, approved sharing rules and a process for reviewing access when work ends.
6. Connect departures and role changes to system access
The business needs a reliable way to notify IT when someone joins, changes responsibilities or leaves. The support team then needs a checklist covering access, devices, shared work, ongoing responsibilities and the treatment of company information.
Timing and authority matter. Define who requests a change, who confirms it and how completion is recorded. Our employee access guide explains this process in more detail.
7. Prove that recovery and incident handling are usable
List the information and services the business depends on, then establish how they would be recovered after accidental deletion, account compromise or another disruption. Understand the recovery functions and retention arrangements actually configured for the relevant services.
Test a representative recovery and record what was restored, who performed the work and what was missing. Separately, confirm that incident contacts and escalation instructions remain available if normal company email is inaccessible. A recovery plan stored only in the affected system can be difficult to use when it matters.
8. Turn findings into a manageable operating routine
Prioritise findings by business impact, exposure and the effort required to address them. Assign one owner to each action and state the evidence needed to close it. Schedule reviews around meaningful events such as staff changes, new applications, client projects and major configuration changes.
A security dashboard can help direct attention, but a score is not proof that every important risk has been addressed. Keep the review connected to the company's actual information, workflows and responsibilities.
Microsoft 365 support with business context
CREDIUM provides IT services and cybersecurity consulting and solutions, including account management, system maintenance and technology planning. We can help assess the environment, agree priorities and implement the work within a defined service scope. Discuss a Microsoft 365 review with CREDIUM.