Jack Davies, co-founder of Klariq · Published 23 July 2026 · 10 min read
Almost every tenant I audit is secure in the places the last engineer looked and wide open in the places nobody thought to check. MFA is on for the office staff but not the service account. Defender is licensed but the anti-phishing policy is still at default. The backup exists but has never been restored.
A health check is not a scan. It is a structured pass over the whole tenant against a known baseline, producing a list of findings a business owner can act on and price. This is what I cover, in the order I cover it, and the free tooling that does most of the heavy lifting.
Why this is worth doing right now
Three things have changed in the last twelve months that make an old tenant configuration a genuine liability rather than just untidy.
First, the government's Cyber Security Breaches Survey 2025/2026, published on 30 April 2026 by DSIT and the Home Office, found 43 per cent of UK businesses identified a breach or attack in the previous twelve months, around 612,000 organisations. Phishing was reported by 38 per cent of businesses and named the most disruptive attack type by 69 per cent of those affected. Among businesses that were breached, 51 per cent experienced phishing and nothing else, up from 45 per cent the year before. The threat is concentrated in one place, and that place is email and identity.
Second, Cyber Essentials tightened. Version 3.3 of the Requirements for IT Infrastructure and the new Danzell question set went live in late April 2026. Two automatic failure conditions now exist: no MFA on a cloud service that offers it, and high-risk security updates not applied within 14 days. Cloud services also got a formal definition and can no longer be excluded from scope. If Microsoft 365 is in your business, it is in your assessment.
Third, Microsoft removed the option to defer. Mandatory MFA for the Microsoft 365 admin centre took full effect on 9 February 2026, with sign-in blocked without it. The Azure portal has required MFA since March 2025.
The point of a health check
Not to produce a 60-page document nobody reads. To produce a ranked list of what is wrong, what it would take to fix, and what happens if it is not fixed. Everything below feeds that list.
The nine areas
1. Identity and authentication
This is where most real risk sits, so it goes first.
- Is MFA enforced for every user, including service accounts, shared mailbox owners and external consultants
- Is legacy authentication blocked. POP, IMAP and SMTP AUTH bypass MFA completely, so any policy above them is decorative while they are open
- What authentication methods are registered. SMS is still accepted under Cyber Essentials but it is the weakest option available. Authenticator app with number matching or FIDO2 keys are meaningfully better
- Is self-service password reset enabled, and does it require two methods
- Are there dormant accounts with active licences and no sign-in for 90 days
2. Administrative access
- How many global administrators exist. More than two in a small business is a finding, not a preference
- Do admins have separate accounts, or are they doing daily email from a global admin account
- Do two break-glass accounts exist, are they cloud-only, excluded from conditional access, and is their sign-in activity alerted on
- Are any former staff or a previous IT provider still holding privileged roles. This one turns up more often than it should
3. Conditional access
Only available with Entra ID P1, which comes with Business Premium. If the tenant has the licence and no policies, that is unused spend as well as unused protection.
- Are there policies requiring MFA for all users, blocking legacy auth, and requiring compliant devices for administrative roles
- Are there report-only policies that were never switched on
- Are there exclusions that made sense once and were never removed
- Is there a sign-in frequency and persistent browser session policy for unmanaged devices
4. Email protection
Given phishing is the dominant attack route, default settings here are not good enough.
- Anti-phishing policy with impersonation protection for the directors and the finance mailbox, plus mailbox intelligence
- Safe Links and Safe Attachments enabled, including for Teams and SharePoint, not just Outlook
- External sender tagging turned on so staff can see at a glance that a message came from outside
- Automatic external forwarding blocked. Attackers set forwarding rules to keep reading mail after the password is reset
- SPF, DKIM and DMARC all present and correct. DKIM signing is off by default for custom domains, so it is frequently missing
- Transport rules audited. Old rules quietly bypass filtering for a domain nobody remembers adding
5. Device management
- Are company devices enrolled in Intune, or is the fleet unmanaged
- Is BitLocker enforced with keys escrowed to Entra ID
- Is Defender for Business deployed and reporting, with real-time and cloud-delivered protection on
- Are update rings configured. Under the current Cyber Essentials rules, high-risk updates outside 14 days is now an automatic fail
- Is Windows LAPS deployed, or does every machine share one local admin password
6. Data protection and sharing
- What is the default SharePoint and OneDrive external sharing setting. "Anyone with the link" tenant-wide is common and rarely intended
- Do any anonymous links exist with no expiry
- Are guest accounts still active for projects that finished two years ago
- Are retention policies configured, and does anyone know what they do
- Is there any sensitivity labelling, and if not, is that a conscious decision
7. Logging and visibility
- Is unified audit logging enabled and confirmed to be recording
- What is the retention period, and is it long enough to investigate an incident found two months late
- Are there alert policies for impossible travel, mass file download, forwarding rule creation and privileged role assignment
- Does anyone actually receive those alerts, at an address they read
8. Backup and recovery
- Is there a third-party backup for Exchange, SharePoint, OneDrive and Teams, or is retention being mistaken for backup
- What is the retention period and where does the data physically sit
- Has a restore ever been tested. An untested backup is a hypothesis
9. Licensing and spend
Not strictly security, but it belongs in the same report because it usually pays for the remediation.
- Licences assigned to leavers
- Users on Premium who need Basic, and users on Basic who need Premium
- Premium features paid for and never enabled, which is the most common finding of all
Tools that do most of the work
| Tool | What it gives you | Cost |
|---|
| Microsoft Secure Score | Directional baseline and a prioritised improvement list inside the tenant | Free |
| ScubaGear (CISA) | Automated assessment against a published secure configuration baseline, with an HTML report | Free |
| Maester | Pester-based test framework for Entra ID and M365 config, good for repeat checks | Free |
| Microsoft Graph PowerShell SDK | Everything the portals will not export cleanly, especially dormant accounts and role assignments | Free |
| MXToolbox | External view of MX, SPF, DKIM, DMARC and blacklist status | Free tier |
| Have I Been Pwned | Domain search for staff addresses in known breaches | Free for domain owners |
Do not hand a client a raw ScubaGear output and call it a report. The tools find the facts. The value is in deciding which findings matter for that business and what the fix costs.
On Secure Score
It is worth watching, but it is a Microsoft-weighted model, not a risk assessment for your business. It will happily reward you for enabling something with low practical value while ignoring that your only backup has never been restored. Use it as one input.
Reporting the findings
A traffic-light report per area works better than a score, because a business owner can look at a page of red, amber and green and immediately know where the conversation needs to go.
| Status | Meaning | Expected action |
|---|
| Red | Control missing or ineffective, with a realistic route to compromise | Fix within days |
| Amber | Control present but partial, misconfigured or unmonitored | Fix within the next month |
| Green | Control in place and verified working | Review at next audit |
For each red and amber finding, state three things: what is wrong, what an attacker could do with it, and what fixing it requires in terms of licence, effort and disruption. That last part is what turns a report into a decision.
How often to run one
Annually as a floor. Also run one after any of these:
- A change of IT provider, in both directions
- A departure of anyone who held administrative access
- A Cyber Essentials application or renewal, ideally six weeks before submission so there is time to remediate
- A cyber insurance application or renewal, where the questions are getting more specific every year
- Any suspected account compromise, because the tenant configuration is how it happened
Related reading: how to audit your Microsoft 365 tenant security, Cyber Essentials vs Cyber Essentials Plus, and auditing sign-in logs in Entra ID.
Would rather have this done for you?
We run this audit as a fixed price piece of work and hand you a written plain English report.
See the Security Health CheckTags: Microsoft 365 · Security Audit · Cyber Essentials · UK SME · Entra ID
More in this series: all Klariq guides.
