EOFY is an ideal time for a structured M365 review. Budgets are being set, licence renewals are coming up, and there’s a natural prompt to get things in order.

Licence Audit

•Confirm every assigned licence belongs to an active staff member
•Remove licences from departed staff
•Review whether current licence types still match business needs
•Check licence count vs actual headcount

User and Access Review

•Does every account still belong to a current employee?
•Have role changes during the year led to privilege creep?
•Are all admin role assignments still appropriate?
•Remove guest accounts with no active business purpose

Shared Mailbox and Distribution List Review

•Does every shared mailbox still serve a purpose? Who owns it?
•Remove departed staff from all distribution lists
•Update lists to reflect team changes

Security Configuration Review

•Check Microsoft Secure Score and review top recommendations
•Verify MFA status for all active users
•Review Conditional Access policies
•Run SPF, DKIM, and DMARC lookups: all three should be in place

Data and Backup Review

Microsoft’s responsibility under the shared responsibility model is to keep the service available, not to back up your data. If you don’t have third-party backup for Exchange Online, SharePoint, and Teams, EOFY is the time to evaluate options.

Vendor and Third-Party Access Review

Review which vendors and third-party apps have access. Check enterprise applications in Entra ID. Remove any access that no longer has a legitimate business purpose.

Planning for the New Financial Year

Use review findings to inform IT planning: security investments, licence changes, and configuration projects for the roadmap. Having a clear IT plan at the start of the financial year is one of the most cost-effective investments a small business can make.

End of Financial Year IT Checklist for M365 Admins