The 5 Things I Check First When I Take On a New M365 Tenant

After 25 years in IT and the last decade focused on Microsoft 365, I’ve reviewed a lot of tenants. These five checks take me less than 30 minutes and are almost always a reliable indicator of overall health.

1. How Many Global Admins Are There?

Global Admin is the highest privilege role in M365. A compromised Global Admin account means an attacker owns your entire environment. Best practice: 2 to 4 dedicated admin accounts, not your daily-use account.

What I typically find: anywhere from 2 to 12, with at least some being the business owner’s personal M365 account.

2. What Is the MFA Adoption Rate?

I check the Entra ID Authentication Methods report for gaps: users who haven’t registered, accounts excluded from policies, or legacy auth still permitted.

Typical finding: most tenants have MFA nominally enabled but with gaps.

3. What Is the DMARC Status?

A 30-second DNS check that tells me immediately whether anyone has been thinking about email authentication. About half of tenants I review have no DMARC record at all.

4. Are There Obvious Orphaned Accounts?

I filter users by last sign-in date. Accounts with no activity in 90+ days get my attention. Typical finding: at least a few accounts belonging to departed staff, sometimes still on Business Premium licences.

5. What Does the Secure Score Look Like?

The absolute number matters less than the top recommended actions. Most SMB tenants I review have Secure Scores well below 50% of what their licences would support.

What These Five Checks Tell Me

Fewer than one in ten SMB M365 tenants pass all five checks without at least one significant finding. That’s not a criticism. It reflects the reality that M365 is complex and requires ongoing attention most small businesses don’t have bandwidth to give.