Microsoft 365 consulting: what a tenant review should check

Few small or mid-sized businesses ever designed their Microsoft 365 setup. It grew. Someone bought a handful of licenses when email moved to the cloud, a previous IT vendor turned on Teams, and staff began sharing files from OneDrive because it was there. It usually works well enough that nobody looks closely, until a mailbox is compromised, a renewal looks too high, or a client sends a security questionnaire you cannot answer.

That is often when people start looking for Microsoft 365 consulting. This guide explains when outside help makes sense and what a consultant should actually examine, starting with a tenant review. Your tenant is your organization's own Microsoft 365 environment: its users, mailboxes, files, devices and settings.

When outside help makes sense

• Nobody is sure who holds admin access, or the person who set it up has left.
• A cyber insurance application or client questionnaire asks about controls you cannot confirm.
• You are merging companies, splitting one off, or moving from another email platform.
• You want to roll out Copilot and are not sure who can see what.
• You have had a security incident and want to know what else is exposed.
• You are paying for licenses nobody can explain.

Having an IT person or provider already does not rule this out. A review is a second set of eyes, and most findings come from years of small decisions rather than anyone's mistake.

Who controls the tenant

Start here, because every other fix depends on it.

• Global admins. Microsoft advises keeping these to fewer than five. Admins should use a separate admin account rather than the one they read email with, and you should have two emergency access accounts stored securely in case normal sign-in fails.
• Former vendors. An old IT provider or reseller may still have delegated access. The partner relationships page in the admin center shows who is connected. Remove anyone you no longer work with.
• Your domain. Confirm who holds the login for your domain registrar and DNS. Tenants bought through a web host can also come with limits on what your own admin is able to change.

How people sign in

Multifactor authentication should cover everyone, admins first. A small tenant can use security defaults, which are free. Conditional Access gives finer control, such as requiring a managed device, but it needs Entra ID P1, which is included in Microsoft 365 Business Premium. The two cannot run together, and a tenant should not be left with neither.

The review should then look for the gaps: accounts excluded "temporarily" years ago, shared logins, and scanners or older applications that send mail with a stored password. It should also check whether staff can approve third-party apps that request access to their mailbox, a route attackers use to keep access even after a password change. This is where a tenant review overlaps with wider cybersecurity services.

Email and audit trails

• Forwarding rules. Hidden inbox rules that send mail to outside addresses are a classic sign of a compromised account, especially in invoice fraud. Review what exists and block automatic external forwarding unless there is an approved reason.
• SPF, DKIM and DMARC. Check every domain you send from, including the marketing and invoicing platforms that send on your behalf.
• Audit logs. Confirm logging is on and how far back it goes. You do not want to learn that during an incident.

Where your files can go

Look at the sharing settings in SharePoint and OneDrive: whether "Anyone" links are allowed, what the default link type is, whether links expire, and which guests from finished projects still have access. Teams with no remaining owner deserve attention too.

This matters more if you plan to use Copilot. It respects existing permissions, but it makes overshared files far easier to find. A payroll spreadsheet that sat unnoticed in an open folder can surface in someone's answer, so fix the permissions before you buy the licenses.

Devices

If staff work from home or on the road, ask whether company laptops are enrolled in Intune, encrypted, and have recovery keys stored centrally. For personal phones, app protection policies can keep company data inside managed apps without taking control of the whole phone. The test is simple: if a laptop is stolen from a car tomorrow, can you confirm it was encrypted and remove its access?

Licenses

A review often pays attention to money as well as risk, and these are the usual places to look:

• Licenses still assigned to people who have left.
• Shared mailboxes with a full license. Up to 50 GB, without an archive or litigation hold, they generally do not need one, though Microsoft's current terms should be confirmed.
• Everyone on the same plan when roles differ.
• The opposite problem: paying for Business Premium while its security features sit unconfigured.
• Renewal dates. Annual commitments can limit when you can reduce seats, so plan changes before the term ends.

Backup and retention

Microsoft keeps the service running, but your data remains your responsibility. Recycle bins and retention have time limits. By default, for example, a departed user's OneDrive is kept for only 30 days after the account is deleted. The review should confirm what happens during offboarding and whether you need separate backup and disaster recovery for mail and files. If HIPAA, legal holds or client contracts apply to you, say so at the start, because they change the right answer on retention and sharing.

What you should get at the end

1. Findings in plain English, ranked by risk, not a raw export of settings.
2. A list of fixes split into quick wins and changes that need planning and staff notice.
3. Documentation of admin roles, domains, policies, licenses and connected vendors.
4. A rollout plan. Sign-in policies can lock people out, so changes should be tested on a small group first, with emergency accounts confirmed.

Microsoft Secure Score is a handy checklist, but a higher number is not the goal. Some recommendations will not suit your business, and a good consultant will explain which ones to skip and why.

Questions to ask before you start

• What access do you need, and when will it be removed?
• Will you make the fixes, or only report them?
• How do you test a change before it reaches all staff?
• Who holds the admin accounts and documentation when the work ends?
• What happens after the project, and who keeps the settings current?

That last question matters because a tenant drifts as people join, leave and adopt new tools. Creative IT USA delivers Microsoft 365 work as one-time consulting or as part of ongoing managed IT services, for organizations across Los Angeles County, the Inland Empire and Ventura County.