Microsoft 365 Security Review for UK SMEs: The First 10 Checks

Most smaller Microsoft 365 tenants do not need a month of discovery before useful work starts. They need a sharp first pass over the controls that usually fail in the same places: admin sprawl, weak authentication, unmanaged devices, messy sharing, risky mail routes and thin evidence.

The useful first review is not a giant slide deck. It is a control map: who can get in, from where, using what device, to access which data, and how would you prove the current state a month from now?

Quick answer

Start with ten checks: privileged roles, admin MFA, legacy authentication, Conditional Access exclusions, device compliance, Defender coverage, mail forwarding, phishing controls, external sharing and audit evidence. Rank fixes by attack path, not by dashboard score.

Who this affects

This affects UK SMEs that run Microsoft 365 without a recent tenant review, especially where IT ownership has changed, suppliers have had access, remote work grew quickly or customer security questions are becoming harder to answer.

What usually goes wrong

Area	Common failure	Risk signal
Admin access	Too many Global Admins or shared admin use	One account can change the tenant
MFA	Registered users but weak enforcement	Policy does not match reality
Conditional Access	Old exclusions and report-only policies	Controls never reach enforcement
Endpoint	Device trust used before management is reliable	Unmanaged devices can still access data
Mail	Forwarding and inbox rules not reviewed	Quiet exfiltration path
Sharing	Stale guests and open links	Sensitive files leave the business boundary
Evidence	Screenshots exist but no owner/date	Review cannot be repeated

What to check first

Use this as the first-pass review list.

1. List every privileged role, starting with Global Administrator and Privileged Role Administrator.
2. Confirm every privileged account is protected by MFA through Security Defaults or Conditional Access.
3. Check whether legacy authentication is blocked.
4. Review Conditional Access exclusions, especially the temporary ones that never went away.
5. Check device enrolment and confirm compliance policies are actually used to gate access where intended.
6. Review Defender for Endpoint coverage where licensed.
7. Review mailbox forwarding and high-risk mail flow changes.
8. Check anti-phishing, Safe Links and Safe Attachments posture where licensed.
9. Review SharePoint and OneDrive external sharing defaults.
10. Verify auditing and mailbox auditing status, especially on SMB licensing.

Evidence to collect

Area	Question	Output
Identity	Can every admin prove strong MFA?	Admin list and MFA evidence
Access	Are risky sign-ins blocked or challenged?	Conditional Access policy map
Endpoint	Are devices enrolled and compliant?	Intune coverage table
Mail	Are phishing controls active?	Defender policy summary
Data	Is external sharing controlled?	SharePoint sharing report
Audit	Can you prove it later?	Dated evidence pack

The win is not scoring full marks. The win is knowing what is weak, what matters, and what gets fixed first.

Fix path

1. Export current state before changing settings.
2. Remove unexplained privileged access first.
3. Close MFA and Conditional Access enforcement gaps.
4. Put unmanaged or risky devices on a remediation list.
5. Remove unjustified external forwarding and stale sharing.
6. Write a dated backlog with owners, severity and next review date.

Common mistakes

The main mistake is treating the review like a Microsoft Secure Score chase. Secure Score can help find backlog items, but the review should answer control questions the business can understand.

The second mistake is not separating urgent attack paths from tidy-up work. An old Global Admin, a mail forwarding rule and an unmanaged finance laptop do not deserve the same priority as cosmetic dashboard warnings.

Related route

For the matching service path, use Microsoft 365 security review.

References

• Microsoft Secure Score
• Microsoft Entra Conditional Access overview
• Configure Security Defaults for Microsoft Entra ID
• Block legacy authentication with Conditional Access
• Microsoft Intune endpoint security policies
• Turn auditing on or off