The operating principle
The output is a worklist with owners, not a green score
Each finding should identify observable evidence, business impact, proposed action, a customer approver and a retest method. Without those fields, even a long report is difficult to implement.
Inventory the tenant and the people who control it
Identify verified domains, active users and groups, assigned licences, privileged administrators, emergency access arrangements and applications with organisation-wide permissions. Compare each important role against current business responsibility, not the historical reason it was granted. Microsoft Entra offers more narrowly scoped administrative roles for many tasks; permanent Global Administrator access is not a suitable default for an outsourced routine helpdesk.
Capture who controls DNS, subscription billing, user approval, file-sharing policy, retention, security incidents and incident escalation. A technical operator can perform a change but should not independently decide that confidential files may be shared with an external party.
| Health control | Evidence to inspect | Business decision |
|---|---|---|
| Privileged access | Assigned roles, scopes, emergency account | Who should have high privilege today? |
| Mail delivery | Accepted domains, connectors, SPF/DKIM/DMARC | Who owns every outbound sender? |
| Collaboration access | SharePoint sites, owners, external guests | Which sharing is approved? |
| Licences and billing | Assigned SKUs, invoices and renewals | Which paid features are needed? |
| Recovery readiness | Backup scope, retention and restore test | Which data needs recovery first? |
Review authentication and externally exposed access
Check Security Defaults or Conditional Access configuration against current licensing, scope and exceptions. Record external guests, stale administrators and app consent grants with no clear owner. Do not change access based only on a generic score: an application may support payroll or a critical client integration, and disabling it without discovery can interrupt the business.
Where a specific risk is confirmed, propose a narrow action, expected effect and recovery plan. Changes to authentication, administrative roles or external sharing need a customer-approved window and measurable before-and-after validation.
Documented administration controls
- Licence prerequisites checked before recommending controls
- Customer-owned emergency access confirmed
- Privileged roles and app permissions reviewed
- External sharing exceptions linked to data owners
- High-impact changes require approved rollback planning
Inspect email and support operations separately
Run a representative mail-flow review with source and destination domains, third-party senders and the authentication records that apply. Message trace can help explain why a targeted message was deferred, rejected or delivered, but an external round-trip and recipient confirmation show whether a business process works end to end.
Assess how the company receives requests, confirms requester authority, escalates incidents and records changes. A low volume of support tickets might mean the service works, or it might mean staff have stopped reporting problems. The review should include normal user journeys rather than assuming tickets are the only evidence.
Prioritise a credible 30-day improvement register
Rank findings using business impact, affected users, evidence quality and the difficulty of safely changing the environment. Put urgent exposure or broken critical service near the top, but separate those from housekeeping such as documentation drift or cosmetic licensing inefficiency. Note the cost and support window needed to complete each item.
Give the owner a concise register with the finding, current state, proposed state, evidence, approver, engineer, estimated effort and acceptance check. Repeat this only on a cadence supported by real administration capacity. The business retains the right to defer a change if the risk and operational trade-offs have been explained.
Documented administration controls
- Each priority backed by a reproducible observation
- One named business owner per issue
- Correct licence and change prerequisites identified
- Retest evidence required to close a finding
- Monthly review and supplier exit responsibilities clear
A tenant health check is valuable when it helps a business confidently authorise the next ten important changes, rather than generating a hundred unowned recommendations.
Primary technical references
Check current feature and licence requirements before changing a tenant. A service description is not evidence that a customer has purchased or activated an option.
Commercial next step
Request a tenant health and ownership review
Tell us your approximate users, Microsoft 365 products, present IT ownership and most pressing operational issue. We can scope the evidence and review boundaries.
Request an administration assessment