What does a Microsoft 365 tenant health check cover?

Key facts

• A health check is a point-in-time review that produces a prioritized remediation list.
• Admin role sprawl and missing Conditional Access are among the most common findings.
• SPF, DKIM and DMARC should all be in place for every sending domain.
• Third-party apps with broad consented permissions are an often-missed risk.
• Secure Score is a useful input, but not a complete health check on its own.

Identity and access

Identity is where most tenant problems start, so a health check spends the most time here.

• Count of Global Administrators and other privileged roles, and whether they are cloud-only accounts with phishing-resistant MFA.
• Break-glass accounts: present, excluded correctly from Conditional Access and monitored.
• MFA registration coverage and which methods are allowed.
• Conditional Access policies: coverage gaps, exclusions, report-only policies that were never enabled.
• Legacy authentication: whether it is blocked and which sign-ins still try to use it.
• Stale, disabled-but-licensed and guest accounts.
• Entra Connect or Cloud Sync health, version and sync errors.

Email and domains

• SPF, DKIM and DMARC records for every domain that sends mail, and the DMARC policy level.
• Inbound and outbound connectors, especially old ones from past migrations or third-party filtering.
• Mail flow rules that bypass filtering or forward externally.
• Automatic external forwarding settings in outbound spam policy.
• Anti-phishing, Safe Links and Safe Attachments policies where Defender for Office 365 is licensed.
• Mailbox auditing and who has delegate or Full Access permissions on sensitive mailboxes.

Data, sharing and collaboration

Review the organization-level sharing settings in the SharePoint admin center, the default link type and whether Anyone links are allowed. Look at sites with the most external sharing, Teams with no owner, and guest access settings in Entra ID. Check whether sensitivity labels, retention policies and data loss prevention policies exist and are applied, or only created.

This area matters more if you plan to roll out Microsoft 365 Copilot, because Copilot can surface anything a user already has permission to see.

Devices, apps and monitoring

• Intune enrollment coverage, compliance policies and whether noncompliant devices are blocked by Conditional Access.
• Windows update rings and devices that are out of support.
• Enterprise applications with high-privilege permissions granted through user or admin consent.
• User consent settings for third-party apps.
• App registrations with expiring or long-lived secrets and certificates.
• Unified audit log enabled and retention period understood.
• Alert policies and who receives them.

Licensing and operations

A health check should also look at whether you use what you pay for. Common findings include licensed accounts with no activity, shared mailboxes with licenses, add-ons duplicated by suite licenses and security features included in your plan but never configured.

On the operations side, check who reads Message Center, whether service health notifications go to someone who acts on them and whether the tenant configuration is documented anywhere.

What the output should look like

A useful health check report ranks findings by risk and effort.

Secure Score and the Microsoft 365 admin center recommendations are good inputs, but they do not know your business context, such as which exclusions are deliberate or which apps depend on legacy protocols. A reviewer should explain why each finding matters and what could break when it is fixed.

How Accred Consulting approaches it

Accred Consulting runs tenant health checks as a fixed-price discovery engagement. The review covers identity, Conditional Access, mail flow and domain authentication, sharing, devices, app consents, audit settings and licensing, and uses read-only access where possible. You receive a prioritized findings report with the business impact and the change risk of each fix. Accred can then deliver the remediation as a scoped project or hand the report to your team. You work directly with US-based specialists who have completed 475+ client projects, and an optional Support retainer can repeat the check on a schedule.

Track record: 475+ client projects, 2,000+ migration workstreams and 210,000+ users migrated by a US-based team. Company facts · Case studies

Related questions