The security configuration of your cloud system does not „break down” suddenly. It just loses consistency over time and begins to organically unravel.
Microsoft 365 can be secure, but this requires its correct configuration and subsequent supervision. Even if the system takes off in good shape. Later come new applications, new security mechanisms, changes in teams, „momentary” accesses, integrations, file migrations, exceptions in policies, new licenses and tools implemented by different departments. After a few quarters, the environment begins to take on a life of its own. First in the details: overly broad permissions, guests left behind after a project, „for anyone with a link” accesses, access exceptions that no one remembers anymore, or licenses assigned to users who don't use them.
Microsoft 365 Health Check is an audit of the configuration, security and usage of the M365 environment. It shows the actual state of the tenant, not just whether specific features are enabled. We look at where there are risks today, which settings need to be adjusted, and where the organization can reduce costs or make better use of its licenses.
The goal is not a report „for the drawer.” The goal is to answer a practical question: What needs to be improved first to increase security, clean up the configuration and not burn through the budget on unused resources.
Why „default settings” do not guarantee security
At the start, many organizations use default settings, such as Security Defaults. This is a good starting point, especially in smaller environments. The problem starts when the organization grows: additional roles, exceptions, working from different locations, private devices, vendors and guest accounts appear.
In larger environments, it is safer to base access on the Conditional Access and policies tailored to the actual work: who, from where, on what device, to what resources and under what conditions. After disabling Security Defaults, Microsoft recommends implementing Conditional Access policies, at least from the secure foundations category.
Without such a model, the environment may function correctly operationally, but at the same time be exposed to risks that are not apparent in day-to-day operations.
What exactly do we verify in Microsoft 365 Health Checkup
The Secure Score may be the starting point, but we don't stop with the report. The Secure Score is a useful indicator of security status and recommended actions, but Microsoft stresses that it is not an absolute measure of the likelihood of a system or data breach (it is more of a sales tool for new licenses).
That's why at Health Check we check the security configuration in the tenant and compare it with best practice recommendations tailored to the organization. We look at how users are using functionality, what licenses the organization has, and which areas need security improvements or can lead to cost savings.
1) Identity and administrative roles in Entra ID
This is usually where the biggest risks are, because identity is the gateway to all of Microsoft 365.
In practice, we verify:
- privileged roles: who has what roles and whether it makes sense operationally,
- Conditional Access: rules, exceptions and where gaps most often arise,
- Guest accounts: how are they invited, how long do they have access, and does anyone periodically monitor this,
- logging: suspicious locations, unusual attempts, repetitive risk patterns.
2) Mail and domain in Exchange Online
Here, the goal is to reduce the risks associated with phishing, mailbox takeovers, the configuration of uncontrolled redirects and domain impersonation.
Among other things, we check:
- domain authentication: SPF, DKIM, DMARC and configuration consistency,
- Mail flow rules and automatic redirection to external addresses,
- Settings to increase resistance to phishing - the scope depends on your licenses.
3) Devices and data access in Intune
We don't assume a „perfect world” where every device is up-to-date and secure. We verify that policies actually support access control, not just look good in the admin panel.
We verify:
- device compliance policies and whether they have a real impact on access to resources,
- Mobile application protection and copy-and-paste scenarios between corporate and private applications,
- encryption and minimum standards for devices that access corporate data.
4) File sharing and collaboration in SharePoint, OneDrive and Teams
This is an area where it often appears oversharing, i.e., file shares, sites and teams that have been maintained too widely or for too long. Usually this is not due to malice. More often it's due to a lack of simple rules, time controls and access reviews.
Check:
- Levels and principles of external sharing: organization, sites, links,
- Guest access and time to maintain access,
- Settings to limit accidental sharing of sensitive data.
SharePoint and OneDrive enable collaboration with people outside the organization, such as partners, vendors, customers or suppliers. This is why external sharing policies should be consciously set and regularly reviewed.
5) Microsoft 365 licensing, costs and usage
Our Health Check doesn't stop at security. In many environments, the question is just as important: Whether the organization actually uses what it pays for.
We check that licenses are assigned according to real usage, that selected Microsoft 365 features are being used, and that there are no areas where the organization is paying for duplicate tools. Microsoft 365 admin center provides usage reports to check user activity, service usage and adoption trends; Microsoft also points out that the reports can help identify users who are using the service in a very limited way and may not need a particular license.
We verify, among other things:
- Assigned but unused or poorly used licenses,
- The differences between the plan you have and the real needs of users,
- security and compliance features available in the current package,
- Third-party tools that partially duplicate the capabilities of Microsoft 365,
- Recommendations that require a licensing or budget decision.
The result doesn't always mean a simple „here and now” cost reduction. Sometimes the better decision is to clean up assignments, make better use of the current plan, or consciously shift some budget from licensing to security, governance or user adoption.
If you want to see where the greatest risks accumulate in your M365 tenant and which fixes are worth implementing first, see Microsoft 365 Health Check.
Three mistakes that are repeated most often
1) Legacy authentication where it shouldn't be
It's an „invisible” problem: old protocols and exceptions that come back after migrations, integrations, or technical device deployments. In day-to-day operations, everything may look normal - until an incident.
We don't turn it off in the dark. Microsoft recommends starting a policy to block legacy authentication with report-only mode so that administrators can check the impact on users and applications, and only then move on to policy enforcement or phased implementation.
In practice, this means: first identifying dependencies, then controlled disabling, testing and only enforcing changes.
2) Overly broad administrative roles assigned permanently (no expiration time)
It's not about making IT's life more difficult. It's about making entitlements reasonable and under control: narrower roles, sensible granting rules, reviews over time, and no „forever” approach.
At Health Check, we verify that administrative roles are assigned according to real need, that they have an owner, and that there is a process for their periodic review.
3) Sharing „on link” without rules and without guest hygiene
SharePoint and OneDrive support collaboration well, but only if the organization clearly establishes rules. Otherwise, after a few months it becomes an uncontrolled distribution of data „by project.”.
It's rarely bad will. More often it's a lack of simple rules: who can share, with whom, for how long and in which locations.
How to get started without stalling the project
To move efficiently, you don't need weeks of preparation. Most often, enough is enough:
- Agreed read-only access - e.g., through appropriate administrative roles or tenant administrator approval to access data necessary for analysis. We do not ask for passwords or change configurations during an audit without agreement.
- Business context: what's hurting you today, e.g., audit, incident, AI/Copilot, data cleanup, preparing for regulations.
- License plan approximately so that recommendations are cost realistic.
Usage reports in Microsoft 365 admin center can be accessed by roles such as Global Administrator, Global Reader, Reports Reader or Usage Summary Reports Reader, among others, which supports an analysis scenario without granting full administrative privileges where they are not needed.
The result is simple: you get a list of risks, priorities and a remediation plan - not a „to the drawer” report.
FAQ - The most common questions about Microsoft HealthCheck
How long does the Microsoft 365 Health Check last?
Most often 1-3 weeks, depending on the scale of the tenant and the number of areas to be verified.
Does the audit affect users?
No. By default, we work in read mode. We do not change passwords, disable services or modify configurations without agreement.
What do we get at the end?
A prioritized list of risks and recommendations: what to do now, what to plan, and which changes require testing or a business decision, as well as a recommended roadmap.
Do you also check costs and license usage?
Yes, this is one of the elements of Health Checku. We check whether the licenses are actually being used, whether the features of the current suite are being used, and whether the organization is paying for tools that can be partially replaced by native Microsoft 365 mechanisms.
Can we implement the recommendations ourselves?
Yes. The report is to be specific enough to be proven by your own team. You can also use our support to implement the changes.
Do you want the intranet to actually work?
Do you want to have a clear picture: where are the risks in Microsoft 365 today, which areas of the configuration need to be adjusted, and where can you make better use of your licenses?
Make an appointment for a 30 min consultation and we will determine the scope of Health Checku under your environment.
Learn about our other services
Business applications
Services for applications and turnkey solutions in the area of process digitization and modern work environment.
Full support and optimization of IT infrastructure, ensuring stable development of your business.
IT infrastructure
Security of deployment and maintenance of Microsoft 365 and Azure services that enable flexible management and cost optimization.