What IT documentation should a mid-size business keep for Microsoft 365?

Key facts

• Documentation is for recovery, handover and audits, not just reference.
• Every Conditional Access exclusion needs a written reason and owner.
• Runbooks for onboarding, offboarding and incidents are the most used documents.
• Keep a copy outside the tenant so it is available during an outage or compromise.
• Configuration exports can be automated, but the why still has to be written down.

Why documentation matters

In many mid-size businesses, Microsoft 365 was set up over years by different people, and the knowledge lives in one or two heads. When that person leaves, a security incident happens, or an auditor asks how access is controlled, the gaps show quickly.

Good documentation answers three questions: what is configured, why it is configured that way, and how to do routine and emergency tasks. Automated exports can answer the first. Only people can answer the second and third.

The core documents

This list covers what most organizations of 100 to 1,000 users need. Keep each one short and current rather than long and stale.

Runbooks for routine and emergency tasks

Runbooks are the documents people actually use. Write them as numbered steps someone can follow under pressure.

• User onboarding and offboarding, including licences, groups, devices and mailbox handling.
• Lost device, lost MFA method and password reset with identity verification.
• Compromised account response.
• Microsoft 365 outage response, including alternate communications.
• Emergency access account use and the steps after.
• Certificate, secret and domain renewals, with dates in a shared calendar.

Keep it current with less effort

Automate what you can. Tools such as Microsoft365DSC can export tenant configuration as code, and PowerShell scripts using Microsoft Graph can export Conditional Access, Intune profiles and role assignments on a schedule. Storing exports in a version-controlled repository shows exactly what changed and when.

Pair automation with a lightweight change log: date, who, what changed, why and how to roll back. Review the core documents quarterly and after any major project, such as a migration or a new security control. A short quarterly review with the IT lead, checking each document against the live tenant, catches most drift before it becomes a problem.

Where to store it

Store working documentation where IT can edit it easily, such as a SharePoint site with restricted access or a documentation platform. Keep an offline or out-of-tenant copy of anything needed during an outage or compromise: emergency access procedures, vendor contacts, DNS registrar details and the outage runbook. Protect it, since it describes how your environment works and would help an attacker. Limit edit rights to IT, keep read access narrow, and avoid storing passwords or secrets in the documents themselves; reference the password manager or vault where they live instead.

How Accred Consulting approaches it

Accred Consulting treats documentation as a deliverable, not an afterthought. Every project ends with a Handover that includes documentation and knowledge transfer. For organizations with gaps, discovery reviews what exists, and the proposal sets a clear scope, fixed price and timeline to document the tenant. US-based specialists export configuration, interview your admins to capture the reasons behind settings, write runbooks and set up a change log. Optional support retainers keep documentation current as the tenant changes.

Track record: 475+ client projects, 2,000+ migration workstreams and 210,000+ users migrated by a US-based team. Company facts · Case studies

Related questions