“What does a health check actually mean?” It’s a fair question. Here’s exactly what a structured M365 health check covers and what kinds of issues typically turn up.

Licencing Review

Are you paying for the right licences? Are departed staff still licensed? Are users on a cheaper plan missing security features their risk profile warrants?

Security Defaults and MFA Adoption

Is MFA enabled for all users? Are any accounts exempt? Are legacy authentication protocols blocked? Tenants created before 2019 may have legacy settings that don’t enforce modern standards.

Admin Role Review

Common findings: too many Global Admins, admin roles on daily-use accounts, former staff with admin roles still assigned. Global Admin should be limited to 2 to 3 dedicated accounts.

Conditional Access Policies

Are policies covering all users without overly broad exceptions? Are high-risk countries blocked? Are legacy protocols blocked by policy?

Email Security Configuration

Exchange Online Protection settings, Defender for Office 365 configuration, SPF, DKIM, and DMARC status for your domain.

Mailbox and Identity Hygiene

Orphaned accounts, shared mailboxes with no owner, guest accounts with no purpose, distribution lists with departed members, overprivileged service accounts.

Microsoft Secure Score

Your current score, highest-impact recommendations, and which are practical to implement.

What a Health Check Typically Finds

•MFA not enforced for all users
•Too many Global Admin accounts
•DKIM not enabled
•DMARC at p=none or not present
•Orphaned accounts still licensed
•Shared mailboxes with no ownership
•Secure Score well below potential

None of these are unusual: they’re the natural result of M365 environments that have grown organically without regular review.

What Does a Microsoft 365 Health Check Actually Cover?