Microsoft 365 Admin Health Check

A Microsoft 365 tenant is not something you set up once and forget. Users join and leave. Licences accumulate. Administrators change. Sharing settings drift. This health check gives you a structured way to review all 15 areas on a recurring basis and track who owns each one.

1 Users

• □ All user accounts have a named business owner
• □ Departed staff accounts disabled or removed promptly
• □ Shared and role accounts reviewed and documented
• □ Guest accounts reviewed and limited to active use
• □ User list compared to HR records this quarter

2 Licences

• □ Licence count matches active user count
• □ Unused licences identified and removed
• □ Licence assignments align with user roles
• □ Licence renewal date known by a named owner
• □ Licences purchased via a route you directly control

3 Administrators

• □ Global Administrators minimised — each one named and justified
• □ Daily work uses standard accounts, not administrator accounts
• □ Former supplier delegated access removed
• □ Break-glass account documented and secured
• □ Admin role changes reviewed this quarter

4 Authentication

• □ MFA enforced for all users
• □ Legacy authentication blocked where feasible
• □ Authentication methods reviewed and documented
• □ Self-service password reset configured and tested
• □ Authentication policy owner named

5 Mailboxes

• □ All mailboxes have a named business owner
• □ Shared mailboxes reviewed — no direct personal logins
• □ Departed-staff mailboxes handled appropriately
• □ Forwarding rules reviewed — no unexpected external routes
• □ Mailbox sizes and archive status reviewed

6 Mail Flow

• □ SPF, DKIM and DMARC confirmed working for all sending domains
• □ Connectors and transport rules reviewed
• □ Anti-spam and anti-phishing policies reviewed
• □ Safe Links and Safe Attachments confirmed active
• □ Message trace used to validate recent delivery

7 SharePoint

• □ Site inventory reviewed — no orphaned or forgotten sites
• □ Site owners named and notified
• □ Permissions reviewed — no over-broad access
• □ Guest access limited to active, named guests
• □ Storage capacity reviewed against allocation

8 OneDrive

• □ Departed-staff OneDrive content reviewed and actioned
• □ Sync issues on managed devices identified
• □ Storage per user reviewed against quota
• □ Sharing links reviewed — no stale open links
• □ Known Folder Move (Desktop, Documents) confirmed across managed devices

9 External Sharing

• □ SharePoint tenant-level sharing setting reviewed
• □ OneDrive tenant-level sharing setting reviewed
• □ Anonymous (Anyone) links limited or disabled
• □ External sharing restricted to approved domains where applicable
• □ External sharing activity reviewed in the audit log

10 Teams & Groups

• □ All Teams have at least one named, active owner
• □ Inactive Teams archived or removed
• □ Guest members reviewed and limited to active participants
• □ External access policy reviewed
• □ Group and Teams creation restricted to approved users

11 Data Protection

• □ Sensitivity labels created and in use for key content types
• □ DLP policies reviewed for key data types
• □ Retention policies cover business-critical content
• □ Microsoft Purview compliance posture reviewed
• □ Data protection policy owner named

12 Secure Score

• □ Secure Score reviewed at security.microsoft.com/securescore
• □ Improvement actions reviewed and highest-priority ones assigned
• □ Accepted risks documented with business justification
• □ Deferred actions reviewed each quarter
• □ Score used as a prioritisation tool — not chased as an absolute target

13 Auditing

• □ Microsoft Purview Audit confirmed active
• □ Admin activity log reviewed this quarter
• □ Mail forwarding and bulk deletion events checked
• □ Privilege escalation events reviewed
• □ Named owner for audit review confirmed

14 Service Health

• □ Microsoft 365 admin centre health alerts reviewed
• □ Service health dashboard has a named owner
• □ Message Centre communications reviewed and actioned
• □ Planned maintenance windows communicated to affected users
• □ Recent incident and advisory history reviewed

15 Recovery

• □ Deletion recovery from recycle bin tested or confirmed
• □ OneDrive and SharePoint restore process understood
• □ Mailbox recovery procedure documented
• □ Third-party backup status reviewed if applicable
• □ Business continuity responsibility named