Key takeaways
- •Inventory privileged roles and protect administrator identities.
- •Check MFA and account recovery arrangements.
- •Review external sharing and application permissions.
- •Connect endpoint, email and identity alerts to an owner.
- •Plan independent backup and recovery where required.
Start with identity and privileged access
Review administrator roles, emergency accounts, authentication methods and conditional access decisions. Confirm that privileged accounts are used only when needed and that access is removed when responsibilities change.
Review mail and collaboration settings
Look at anti-phishing protections, external forwarding, mailbox rules, shared mailboxes, guest access and file-sharing defaults. Confirm that configuration supports real collaboration without granting broader access than necessary.
Understand devices and application access
Identify how unmanaged or personal devices can reach organisational data. Review enterprise application consent and access to sensitive information. Device management and conditional access capabilities depend on the licences and configuration in place.
Plan for monitoring and recovery
Decide which alerts matter, who will review them and how suspicious sign-ins or mailbox changes are escalated. Separately define retention and recovery needs for business data; service availability and backup are not the same question.
Record what was checked
A review should capture scope, date, assumptions, observations and priorities. It is not a certification or guarantee that every tenant setting or threat has been assessed.
Sources and further guidance
Official guidance may change. Check the source directly for current requirements. This article is general information, not legal advice.
Put your next step into context.
A free 30-minute cybersecurity review provides a Red, Amber or Green score and prioritised fixes.
Book a review