What Does a Microsoft 365 Health Check Actually Cover?
By Jamie Hamilton · Published
It is a fair question, and it is worth asking before buying one, because the phrase gets used for three quite different things. Some health checks are an automated scan with the output pasted into a template. Some are a Secure Score screenshot with the recommendations copied out. This describes the third kind, which is somebody reading your tenant and telling you what is true about it.
Seven areas, in the order they are worked through, and what each one reliably turns up.
Licensing
Whether you are paying for the right things, and whether anybody is paying for nothing at all. Departed staff still holding licences, users on a plan that lacks the security features their access warrants, and add-ons bought separately that the existing plan already includes.
Licensing is first because it is the area most likely to pay for the review itself, and because the licence list is also the cleanest available answer to who the tenant thinks works here.
Multi-factor authentication, and where it is not enforced
Not whether MFA is on, which almost everyone says yes to, but whether it is actually enforced for every account. The gaps are consistent: a service account somebody excluded to fix a problem in 2022, a shared login for a piece of software, an executive who found it inconvenient, and legacy authentication protocols still permitted, which bypass MFA entirely rather than prompting for it.
Tenants created before around 2019 are the ones to watch. They predate the modern defaults and were never migrated onto them, so the settings look enabled while permitting the older path underneath.
Administrative roles
Who holds Global Administrator, how many of them there are, and whether those accounts are also used for daily email. The common findings are too many Global Admins, administrative rights sitting on the account somebody uses all day for ordinary work, and roles still assigned to people who have left.
The number to aim for is small and the accounts should be dedicated rather than somebody's everyday login. A compromised Global Administrator is not an incident affecting one mailbox, it is the whole tenant.
Conditional Access
Whether policies exist, whether they cover everybody, and what the exceptions are. Exceptions are where the interest is: almost every tenant with Conditional Access has a policy with an exclusion group in it, and almost nobody can say who is in that group or why.
Also whether legacy protocols are blocked by policy rather than merely discouraged, and whether sign-ins from places the business has no presence are treated any differently from sign-ins from the office.
Email authentication and mail flow
SPF, DKIM and DMARC for every domain the tenant sends from, not just the main one. Exchange Online Protection settings, and whether Defender for Office 365 is configured or simply licensed, which are different things.
This area produces the most consistent findings of any on the list. DKIM not enabled, DMARC absent or sitting at p=none with no reporting address, and SPF records that have quietly grown past the ten DNS lookup limit and are failing for everything the business sends.
Identity and mailbox hygiene
Orphaned accounts belonging to people who left, shared mailboxes nobody owns, guest accounts from finished engagements, distribution lists still containing former staff, and service accounts with more privilege than the service needs.
Separately, and this is the one people are most surprised by, whether previous IT providers still hold administrative access to the tenant through a delegated relationship. That does not appear in the user list and survives changing providers.
Secure Score, read properly
The number is the least interesting part. What matters is which recommended actions are open, which of those are realistic for a business your size, and which are noise for your licence type. A score can be raised by doing things that do not make the business safer, and a health check that optimises the number rather than the posture is doing the wrong job.
What it reliably finds
Across small business tenants, the same findings come up again and again:
- •MFA enforced for most users but not all, with the exceptions undocumented
- •More Global Administrators than the business can name
- •DKIM not enabled, and DMARC absent or parked at p=none
- •Licences still assigned to people who have left
- •Shared mailboxes with no owner and broad permissions
- •Guest accounts and vendor access from engagements that ended years ago
- •A Secure Score well below what the existing licences already permit
None of that is unusual and none of it means anybody was careless. It is what a Microsoft 365 environment looks like after a few years of growing to meet whatever was urgent that week, with nobody whose job it is to look at the whole thing.
What you get at the end
A written report ordered by risk rather than by portal screen, with each finding stated in terms of what it allows rather than which setting is wrong, and a remediation list separated into what you can do yourself, what needs a change window, and what needs a decision from the business.
The Hamilton365 Microsoft 365 Health Check is $599, GST inclusive, and remediation is quoted separately after it because the scope is not knowable in advance. You are free to take the report to your existing IT provider or work through it yourself, and it is written to be useful in both cases.
Frequently asked questions
What is a Microsoft 365 health check?
A structured review of how your tenant is configured, covering licensing, multi-factor authentication, administrative roles, Conditional Access, email authentication, identity hygiene and Secure Score. The useful version is somebody reading your environment and telling you what is true about it, which is different from an automated scan pasted into a template or a Secure Score screenshot with the recommendations copied out.
How much does a Microsoft 365 health check cost?
The Hamilton365 health check is $599, GST inclusive, for the review and the written report. Remediation is quoted separately after it rather than bundled in, because the scope genuinely cannot be known beforehand: two businesses of the same size can be a day apart or a fortnight apart depending on what has accumulated.
How long does it take?
The review itself is usually done within a few days of getting access, and most of the work is reading rather than running tools. What extends it is not the tenant size but how many questions the findings raise, since some of them need an answer from the business rather than from the portal, such as who a particular shared mailbox belongs to or why an account is excluded from a policy.
Will a health check disrupt our email or systems?
No. It is a read-only review. Nothing is changed during the assessment, which is deliberate: the point is to establish what is true before anything moves. Remediation happens afterwards, as a separate piece of work with its own change window, and by then you know what is going to be touched and why.
What is the difference between a health check and Secure Score?
Secure Score is one input to a health check rather than a substitute for it. It measures how many of Microsoft’s recommended controls you have configured, which is useful, but it cannot see whether your exclusions make sense, whether a previous IT provider still has access, whether your SPF record has exceeded its lookup limit, or whether the shared mailbox with broad permissions has an owner. A score can also be raised by actions that do not make the business safer.
Do we need one if we already have an IT provider?
Plenty of the reviews done here are for businesses that already have a provider, and it is a normal thing to want. It is a second reading rather than a criticism, and the report is written so it can be handed straight to whoever manages your environment. The findings that come up most often are the ones that sit outside day-to-day support: email authentication, Conditional Access exclusions, and access granted years ago that nobody revisits.