Microsoft 365 brings email, files and collaboration into a connected environment. It also creates several decisions for a small business: who administers accounts, how employees prove their identity, which files external collaborators can access and what happens when someone leaves. A useful security review makes those decisions visible.
Begin with an inventory and a change plan. Features depend on your licences and configuration, and administrative screens change. This guide explains what to review rather than providing commands to apply without assessing the environment.
1. Establish your tenant and licence inventory
Identify the Microsoft 365 tenant your business uses, its verified domains, subscription plans and authorized administrators. Record who owns billing and who can approve security changes. Review active users, shared mailboxes, guest accounts and applications connected to the environment.
Separate an account’s business purpose from the licence assigned to it. An old employee account may still be used by a workflow that nobody documented. Investigate the dependency before deleting or changing anything. Your review worksheet should have a place for unknowns and the person who will resolve them.
Microsoft’s business security guidance distinguishes capabilities across Business Basic, Standard and Premium. Check the licences relevant to your design before promising a control or purchasing a replacement product.
2. Review sign-in protection and recovery
Microsoft provides security defaults for a baseline identity configuration. Organizations with appropriate licensing and more specific requirements can use Conditional Access policies. Review the current configuration and the intended design together; do not assume that owning a licence means a policy is active.
For each user group, confirm how MFA is registered, how sign-ins are protected and how a lost authentication method is handled. Ask your administrator about phishing-resistant authentication options suited to the devices and applications employees use. Document approved recovery procedures before rolling out stricter requirements.
A planning exercise might follow one employee who replaces a phone while travelling. Who verifies their identity? How do they regain access? Who records the recovery action? That scenario helps expose weaknesses that a simple “MFA enabled” checkbox cannot describe.
3. Make administrator access deliberate
List privileged accounts and explain why each is needed. Establish which identity a technician uses for everyday email and which identity performs administration. Decide how an external provider receives authorized access, how that access is reviewed and how it is removed at the end of a contract.
Plan emergency access with your administrator and test the agreed procedure safely. Keep recovery information protected and available to authorized decision-makers. A locked filing cabinet is not a complete process if nobody knows who holds the key; the same reasoning applies to digital recovery information.
- Record the business approver for administrative changes.
- Review access when a staff member or provider changes.
- Identify where administrative activity is reviewed.
- Keep a current contact path outside company email.
4. Review email protection and legitimate senders
List every service that sends email using your domain: Microsoft 365, the website contact form, invoicing tools and marketing platforms. Microsoft’s DMARC configuration guidance explains how SPF and DKIM alignment support domain authentication and why deployment should be verified gradually.
For a fictional company using both Microsoft 365 and a billing platform, that sender inventory should precede a restrictive policy change. Assign someone to test ordinary invoices, website notifications and replies. Record the evidence and unresolved failures so a legitimate business process is not overlooked.
Review the available email protection policies, quarantine responsibilities and employee reporting instructions. Domain authentication is one layer; employees still need a reliable process to question an unusual payment request or unexpected message.
5. Treat shared files and devices as part of the review
Ask business owners where team information belongs and who should approve external collaboration. Examine a sample of active SharePoint sites and shared documents with their owners. Check whether external collaborators still need access and whether a project closure should trigger a review.
Write an illustrative sharing rule before configuring it: a project lead can request a collaborator’s access, the information owner approves it and access is reviewed when the project ends. The final technical settings should follow your actual needs, licensing and data requirements.
Consider the devices used to reach the information. Establish which computers are managed, how lost devices are reported and who verifies any agreed device policies. Keep responsibility for backup and recovery explicit instead of assuming collaboration settings answer every recovery question.
6. Document joining, moving roles and leaving
Create an employee-change checklist that starts with an authorized business request. For a new hire, document the required applications and access. For a role change, review existing permissions as well as new ones. For a departure, agree on timing, session and account handling, device return and responsibility for business information.
Test your checklist against a fictional departure involving a shared customer folder and an upcoming renewal. Ask who takes ownership of the work, who confirms the access changes and where the record is kept. Separate retention decisions from the immediate need to stop unauthorized access.
End the review with a short action register: issue, business impact, owner, proposed change, test and rollback plan. A staged change with a verified outcome is easier to understand than several settings changed at once without a record.
Common Microsoft 365 security questions
Does Business Premium secure everything automatically?
Licensing makes capabilities available. Their usefulness still depends on deployment, configuration, employee registration and operational follow-up. Ask for evidence of the controls agreed for your environment.
Can we switch off MFA for convenience?
Investigate the actual sign-in difficulty with an authorized administrator. Address device, registration or recovery issues through a planned process instead of broadly weakening protection to avoid a support problem.
Can DITC help review the environment?
Discuss your user count, current plans, domains and main concerns through DITC’s contact page. Administration, licences, migrations and substantial changes need a clearly agreed scope.
Take the next step
DITC works with businesses in Quebec and across Canada in French and English. Tell us about your environment and priorities so we can agree on a clear scope.
Explore our services