You do not need to be an IT engineer to find out whether your tenant is in decent shape. This Microsoft 365 security health check takes about 20 minutes, uses only the admin portals you already pay for, and tells you where the real gaps are before an attacker finds them.
Work through it with your IT person or managed provider sitting next to you if you can. The goal is not to fix everything today. The goal is to know what you have, write it down, and decide what gets fixed first.
Before you start: what you need
You need an account with at least the Global Reader role. That role can see almost every setting in Microsoft 365 without being able to change anything, which makes it the right choice for a review. If your only admin account is a Global Administrator, that is your first finding (more on that below).
Open three browser tabs:
Microsoft 365 admin center: admin.microsoft.com
Microsoft Entra admin center: entra.microsoft.com
Microsoft Defender portal: security.microsoft.com
Keep a notepad open. For each check, record one of three results: OK, needs work, or not sure. “Not sure” is a valid answer and usually points to something worth a closer look.
Minutes 1-5: admin accounts and who holds the keys
Most serious Microsoft 365 incidents I review start with an account that had more access than it needed. Start here.
In the Microsoft 365 admin center, go to Roles > Role assignments and select Global Administrator.
Count the members. Two to four is a healthy range for a small or mid-sized business. One is risky (no backup if that person is unavailable). Eight is a problem.
Check whether any of those accounts are also used for daily email. An admin account that reads email is an admin account that receives phishing.
Look for former staff, old vendors, or shared accounts like admin@ that nobody owns.
What good looks like: a small number of named, dedicated admin accounts, each protected with strong multifactor authentication, plus one documented emergency access account stored securely.
Minutes 5-10: sign-in protection and MFA
Multifactor authentication is still the single most effective control you can turn on. The question is not whether you have it, but whether everyone has it and whether old sign-in methods can sneak around it.
In the Entra admin center, go to Entra ID > Overview > Properties and select Manage security defaults. Note whether security defaults are on or off.
If they are off, go to Entra ID > Conditional Access > Policies. You should see policies that require MFA for all users, require MFA for admins, and block legacy authentication. Conditional Access needs Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium.
If security defaults are off and there are no Conditional Access policies, stop and flag this as urgent. It means nothing is forcing MFA.
Go to Entra ID > Authentication methods > User registration details and check how many users have not registered an MFA method.
A common gap: MFA is “on”, but a handful of users were excluded during rollout two years ago and nobody put them back. Exclusions are where attackers live.
Minutes 10-15: email protection
Email is still the front door for most attacks against smaller firms. Three quick checks tell you a lot.
Automatic forwarding set to Off, with documented exceptions only
Preset security policies
Threat policies > Preset security policies
Standard protection applied to all users, Strict for executives and finance
DMARC record
Your DNS provider, record _dmarc.yourdomain.com
A DMARC record exists, ideally moving toward p=quarantine or p=reject
External forwarding deserves special attention. When an attacker takes over a mailbox, one of the first things they often do is set up a quiet rule that copies mail to an outside address. Blocking automatic external forwarding at the tenant level shuts that down for every mailbox at once.
If you have Business Premium, you also have Microsoft Defender for Office 365 Plan 1, which includes Safe Links, Safe Attachments, and impersonation protection. If the preset security policies page shows Standard and Strict as unassigned, you are paying for protection you are not fully using.
Minutes 15-20: Secure Score, devices, and audit logging
Microsoft Secure Score
In the Defender portal, open Exposure management > Secure Score (or go to security.microsoft.com/securescore). Write down the current percentage, then open the Recommended actions tab and sort by points. Do not chase the number. Instead, look at the top five actions and ask whether each one is relevant to your business. Secure Score is a to-do list, not a grade.
Device management
In the Microsoft 365 admin center, check whether your laptops show up as managed devices. If you have Business Premium, you have Microsoft Intune and Microsoft Defender for Business. Devices that are not enrolled cannot receive encryption, update, or antivirus policies from those tools. A tenant with 60 users and 12 enrolled devices has a coverage problem.
Audit logging
In the Microsoft Purview portal, open Audit and confirm that audit log search is turned on. If you ever need to investigate a compromised account, the audit log is your evidence. If it is off, there is nothing to investigate.
Turning your notes into a plan
After 20 minutes you should have a short list. Sort it into three buckets:
Fix this week: anything involving admin accounts without MFA, no MFA enforcement at all, external forwarding allowed, or audit logging off.
Fix this month: preset security policies not applied, devices not enrolled, users who never registered MFA, a DMARC record still at p=none.
Plan for the quarter: moving from security defaults to Conditional Access, data loss prevention, sensitivity labels, and staff phishing training.
Repeat this check every quarter. Settings drift. New admins get added for a project and never removed. A vendor gets an exception that becomes permanent. A recurring 20-minute review catches drift before it becomes an incident.
If you want to go further than a quick review, our Microsoft 365 security assessment covers identity, email, devices, and data in depth. You can also run a quick public check of your domain’s email and identity setup with our free tenant checker. For the sign-in side specifically, Microsoft’s own guidance on security defaults in Microsoft Entra ID explains exactly what the baseline enforces.
Frequently asked questions
How often should I run a Microsoft 365 security health check?
Quarterly is a good rhythm for most businesses of 20 to 500 people. Also run it after any major change, such as a merger, a new IT provider, a big licensing change, or a security incident.
Can I run this check without a Global Administrator account?
Yes, and you should. The Global Reader role can view nearly every setting covered here without the ability to change anything. That makes it safer for a review and easier to hand to an outside auditor.
What is the most common problem this check finds?
In the tenants I review, the most common gap is incomplete MFA coverage: a few users or service accounts excluded from policies, or legacy authentication still allowed. The second most common is automatic external email forwarding left on.
Want a second set of eyes on your results? Book a free Microsoft 365 security assessment and we will walk through your tenant with you, explain each finding in plain English, and give you a prioritized fix list.
You do not need to be an IT engineer to find out whether your tenant is in decent shape. This Microsoft 365 security health check takes about 20 minutes, uses only the admin portals you already pay for, and tells you where the real gaps are before an attacker finds them.
Work through it with your IT person or managed provider sitting next to you if you can. The goal is not to fix everything today. The goal is to know what you have, write it down, and decide what gets fixed first.
Before you start: what you need
You need an account with at least the Global Reader role. That role can see almost every setting in Microsoft 365 without being able to change anything, which makes it the right choice for a review. If your only admin account is a Global Administrator, that is your first finding (more on that below).
Open three browser tabs:
admin.microsoft.comentra.microsoft.comsecurity.microsoft.comKeep a notepad open. For each check, record one of three results: OK, needs work, or not sure. “Not sure” is a valid answer and usually points to something worth a closer look.
Minutes 1-5: admin accounts and who holds the keys
Most serious Microsoft 365 incidents I review start with an account that had more access than it needed. Start here.
Roles > Role assignmentsand select Global Administrator.admin@that nobody owns.What good looks like: a small number of named, dedicated admin accounts, each protected with strong multifactor authentication, plus one documented emergency access account stored securely.
Minutes 5-10: sign-in protection and MFA
Multifactor authentication is still the single most effective control you can turn on. The question is not whether you have it, but whether everyone has it and whether old sign-in methods can sneak around it.
Entra ID > Overview > Propertiesand select Manage security defaults. Note whether security defaults are on or off.Entra ID > Conditional Access > Policies. You should see policies that require MFA for all users, require MFA for admins, and block legacy authentication. Conditional Access needs Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium.Entra ID > Authentication methods > User registration detailsand check how many users have not registered an MFA method.A common gap: MFA is “on”, but a handful of users were excluded during rollout two years ago and nobody put them back. Exclusions are where attackers live.
Minutes 10-15: email protection
Email is still the front door for most attacks against smaller firms. Three quick checks tell you a lot.
Email & collaboration > Policies & rules > Threat policies > Anti-spam, outbound policyThreat policies > Preset security policies_dmarc.yourdomain.comp=quarantineorp=rejectExternal forwarding deserves special attention. When an attacker takes over a mailbox, one of the first things they often do is set up a quiet rule that copies mail to an outside address. Blocking automatic external forwarding at the tenant level shuts that down for every mailbox at once.
If you have Business Premium, you also have Microsoft Defender for Office 365 Plan 1, which includes Safe Links, Safe Attachments, and impersonation protection. If the preset security policies page shows Standard and Strict as unassigned, you are paying for protection you are not fully using.
Minutes 15-20: Secure Score, devices, and audit logging
Microsoft Secure Score
In the Defender portal, open
Exposure management > Secure Score(or go tosecurity.microsoft.com/securescore). Write down the current percentage, then open the Recommended actions tab and sort by points. Do not chase the number. Instead, look at the top five actions and ask whether each one is relevant to your business. Secure Score is a to-do list, not a grade.Device management
In the Microsoft 365 admin center, check whether your laptops show up as managed devices. If you have Business Premium, you have Microsoft Intune and Microsoft Defender for Business. Devices that are not enrolled cannot receive encryption, update, or antivirus policies from those tools. A tenant with 60 users and 12 enrolled devices has a coverage problem.
Audit logging
In the Microsoft Purview portal, open Audit and confirm that audit log search is turned on. If you ever need to investigate a compromised account, the audit log is your evidence. If it is off, there is nothing to investigate.
Turning your notes into a plan
After 20 minutes you should have a short list. Sort it into three buckets:
p=none.Repeat this check every quarter. Settings drift. New admins get added for a project and never removed. A vendor gets an exception that becomes permanent. A recurring 20-minute review catches drift before it becomes an incident.
If you want to go further than a quick review, our Microsoft 365 security assessment covers identity, email, devices, and data in depth. You can also run a quick public check of your domain’s email and identity setup with our free tenant checker. For the sign-in side specifically, Microsoft’s own guidance on security defaults in Microsoft Entra ID explains exactly what the baseline enforces.
Frequently asked questions
How often should I run a Microsoft 365 security health check?
Quarterly is a good rhythm for most businesses of 20 to 500 people. Also run it after any major change, such as a merger, a new IT provider, a big licensing change, or a security incident.
Can I run this check without a Global Administrator account?
Yes, and you should. The Global Reader role can view nearly every setting covered here without the ability to change anything. That makes it safer for a review and easier to hand to an outside auditor.
What is the most common problem this check finds?
In the tenants I review, the most common gap is incomplete MFA coverage: a few users or service accounts excluded from policies, or legacy authentication still allowed. The second most common is automatic external email forwarding left on.
Want a second set of eyes on your results? Book a free Microsoft 365 security assessment and we will walk through your tenant with you, explain each finding in plain English, and give you a prioritized fix list.