Microsoft 365 Security Review for UK SMEs: The First 10 Checks

Most smaller Microsoft 365 tenants do not need a month of discovery before useful work starts. They need a sharp first pass over the controls that usually fail in the same places: admin sprawl, weak authentication, unmanaged devices, messy sharing and thin evidence.

The useful first review is not a giant slide deck. It is a control map. Who can get in, from where, using what device, to access which data, and how would you prove the current state a month from now?

That is enough to turn vague concern into a practical backlog.

The first 10 checks

1. List every privileged role, starting with Global Administrator and Privileged Role Administrator.
2. Confirm every privileged account is protected by MFA through Security Defaults or Conditional Access.
3. Check whether legacy authentication is blocked.
4. Review Conditional Access exclusions, especially the "temporary" ones that never went away.
5. Check device enrollment and confirm compliance policies are actually being used to gate access where intended.
6. Review mailbox forwarding and high-risk mail flow changes.
7. Check anti-phishing, Safe Links and Safe Attachments posture where licensed.
8. Review SharePoint and OneDrive external sharing defaults.
9. Verify auditing and mailbox auditing status, especially on SMB licensing.
10. Build a dated evidence pack with owners, screenshots and exports.

What I usually find

The main issue is rarely one catastrophic setting. It is usually a stack of weak edges: an old admin account, a mailbox still forwarding externally, unmanaged laptops, a VIP excluded from MFA, or a Teams site that still has old contractors inside it.

That is why the first review should stay close to evidence. You are trying to remove ambiguity, not produce theatre.

Simple review output

Use this layout for a fast review:

Area	Question	Output
Identity	Can every admin prove strong MFA?	Admin list and MFA evidence
Access	Are risky sign-ins blocked or challenged?	Conditional Access policy map
Endpoint	Are devices enrolled and compliant?	Intune coverage table
Mail	Are phishing controls active?	Defender policy summary
Data	Is external sharing controlled?	SharePoint sharing report
Evidence	Can you prove it later?	Dated evidence pack

The win is not scoring full marks. The win is knowing what is weak, what matters, and what gets fixed first.

One quiet advantage of this approach is that it works just as well before insurance renewals, customer due diligence, or a Cyber Essentials Plus push. Same controls, just less panic.

The useful habit is to keep turning broad security ambitions into small checks that can be repeated. That is how posture becomes durable instead of performative.

References

• Microsoft Secure Score
• Microsoft Entra Conditional Access overview
• Configure Security Defaults for Microsoft Entra ID
• Block legacy authentication with Conditional Access
• Microsoft Intune endpoint security policies
• Turn auditing on or off