The 5 Things Hamilton365 Checks First When Taking On a New M365 Tenant

After 25 years in IT and a decade focused on Microsoft 365, Hamilton365's principal specialist Jamie Hamilton has reviewed hundreds of M365 tenants. These five checks, taking under 30 minutes, are a reliable indicator of overall tenant health and where the highest risks lie.

1. How Many Global Admins Are There?

Global Admin is the highest privilege role in M365. Best practice: 2–4 dedicated admin accounts, not the daily-use account. What Hamilton365 typically finds: anywhere from 2 to 12, with at least some being the business owner's personal M365 account used for everything.

2. What Is the MFA Adoption Rate?

The Entra ID Authentication Methods report shows gaps, users who haven't registered, accounts excluded from policies, or legacy auth still permitted. Most tenants have MFA nominally enabled but with meaningful gaps.

3. What Is the DMARC Status?

A 30-second DNS check that indicates whether anyone has been thinking about email authentication. Approximately half of the tenants Hamilton365 reviews have no DMARC record at all.

4. Are There Orphaned Accounts?

Filtering users by last sign-in date reveals accounts belonging to departed staff, sometimes still on Business Premium licences. Almost every tenant has at least a few.

5. What Does the Secure Score Look Like?

The top recommended actions are more informative than the absolute score. Most SMB tenants Hamilton365 reviews have Secure Scores well below 50% of what their licences would support. Fewer than one in ten pass all five checks without at least one significant finding.