Seven Microsoft 365 checks worth making
Microsoft 365 does a lot of the heavy lifting for modern businesses, but it is easy for licensing, security settings, backup and access controls to drift over time.
These seven straightforward checks are a useful starting point. You do not need to be an IT expert to ask the questions, and finding something that needs attention does not necessarily mean there is a major problem.
1. Are old user accounts still active?
Leavers, temporary staff and old shared accounts can remain enabled long after they are needed. Check that inactive accounts are removed or blocked and that access has been reviewed.
2. Is multi-factor authentication being used properly?
MFA is one of the most important protections for Microsoft 365, but coverage and authentication methods matter. Make sure it applies to the right users and that older, weaker methods are not being relied on unnecessarily.
3. Do you know what Microsoft 365 licences you are paying for?
Licensing often grows organically. Review who has which licence, whether former users are still consuming licences, and whether the licences in use actually match what people need.
4. Is Microsoft 365 data backed up independently?
Microsoft provides resilience and retention features, but that is not the same as having an independent backup under your control. Check what happens if files or mail are deleted, encrypted or need to be recovered later.
5. Who can share files outside the business?
SharePoint, OneDrive and Teams make collaboration easy. It is worth checking external sharing rules, guest access and whether old links or guests still have access to information they no longer need.
6. Are devices accessing Microsoft 365 properly protected?
Email and files may be protected in the cloud while the laptop accessing them is not. Check that business devices are patched, encrypted and protected with appropriate endpoint security.
7. Would you know if an account was compromised?
Successful sign-ins do not always mean legitimate sign-ins. Businesses should have a way to spot unusual account activity, suspicious forwarding rules and other signs that an identity may have been compromised.
Nothing alarming? Good.
The point of these checks is not to create another IT project. If everything is in order, that is useful reassurance. If one or two questions are difficult to answer, they are simply sensible places to look next.
Want to sense-check anything?
KES is based in Aylesford and supports businesses across Kent with Microsoft 365, cyber security and day-to-day IT management.
If one of the checks above raises a question about your own setup, call us on 01622 721000 or get in touch. An initial conversation is just that - a conversation.