HomeServicesManaged IT ServicesClaude DeploymentInsightsAnswersAboutContact
Readiness standard

Accred Microsoft 365 Readiness Standard

This is the checklist Accred Consulting uses in free review calls and in project work. It covers ten areas of a Microsoft 365 tenant, from sign-in and admin access to sharing, backup and AI. Each area lists concrete checks you can verify in the Microsoft 365 admin centers. Use it to see where your tenant stands and what to fix first. It is a practical baseline, not a compliance framework. Meeting it does not make you compliant with any law or standard; your compliance program and assessor decide that.

Accred Microsoft 365 Readiness Standard · version 1.0

10 areas, 66 checks. Free to use. Cite as: Accred Microsoft 365 Readiness Standard v1.0, Accred Consulting, https://www.accredconsulting.com/microsoft-365-readiness-standard

How to use it

  • Work through the areas in order. R1 to R4 protect accounts and email and usually come first.
  • Mark each check as met, partly met or not met, and note who owns the fix.
  • Make changes in report-only, simulation or pilot mode first, then enforce.
  • Review the list again after a migration, an acquisition or a major licensing change.

R1. Identity and MFA

Most Microsoft 365 account takeovers start with a stolen or guessed password. Strong sign-in methods for every user close the most common door.

Checks

  1. R1.1 Every interactive user is registered for MFA, confirmed in the Authentication methods activity report in Entra ID
  2. R1.2 MFA is required for all users through Conditional Access or, for small tenants without Entra ID P1, security defaults
  3. R1.3 Microsoft Authenticator push uses number matching, and SMS and voice are not the only methods allowed
  4. R1.4 Methods are managed in the Entra ID Authentication methods policy, not legacy per-user MFA settings
  5. R1.5 Passkeys or other phishing-resistant methods are enabled and being rolled out, starting with admins
  6. R1.6 Self-service password reset is enabled with MFA-level methods

R2. Conditional Access

Conditional Access decides who can sign in, from where and on what device. Without it, a valid password is often enough.

Checks

  1. R2.1 A policy blocks legacy authentication protocols for all users
  2. R2.2 A policy requires MFA for all users and all cloud apps, with documented exclusions only
  3. R2.3 At least one emergency access account is excluded from every policy and monitored for sign-ins
  4. R2.4 Admin roles require phishing-resistant MFA through an authentication strength
  5. R2.5 Access from unmanaged devices is limited, for example by requiring a compliant or Entra joined device or using app protection policies
  6. R2.6 New policies run in report-only mode and are checked in sign-in logs before they are enforced
  7. R2.7 Sign-in risk and user risk policies are in place where Entra ID P2 is licensed

R3. Privileged access and admin hygiene

Admin accounts can change everything in the tenant. Fewer, separate and time-limited admin rights reduce the damage a single compromised account can do.

Checks

  1. R3.1 Fewer than five accounts hold the Global Administrator role
  2. R3.2 Admins use separate cloud-only admin accounts, not their daily mailbox accounts
  3. R3.3 Least-privilege roles such as Exchange Administrator or User Administrator are used instead of Global Administrator where possible
  4. R3.4 Privileged Identity Management provides just-in-time role activation where Entra ID P2 is licensed
  5. R3.5 Two emergency access accounts exist, with long passwords or FIDO2 keys stored securely and sign-in alerts set
  6. R3.6 User consent to third-party apps is restricted and the admin consent workflow is turned on
  7. R3.7 Admin role assignments are reviewed on a set schedule and the review is recorded

R4. Email security and domain authentication

Email is the main path for phishing and business email compromise. Domain authentication also stops others from sending mail that looks like yours.

Checks

  1. R4.1 SPF records list only the services that send mail for each domain
  2. R4.2 DKIM signing is enabled for every custom domain in Microsoft Defender
  3. R4.3 DMARC is published for every domain and is moving toward a quarantine or reject policy based on report review
  4. R4.4 Standard or Strict preset security policies, or equivalent custom policies, are applied in Defender for Office 365
  5. R4.5 Automatic forwarding to external addresses is blocked in the outbound spam policy, with approved exceptions only
  6. R4.6 SMTP AUTH is turned off at the organization level and allowed only for named accounts that need it
  7. R4.7 Mail relay from apps and devices is inventoried and uses a documented connector or method

R5. Devices and Intune

A secure account on an unmanaged, unpatched device is still at risk. Intune lets you set and check a baseline for every device that touches company data.

Checks

  1. R5.1 Company Windows devices are enrolled in Intune, with Windows Autopilot used for new and replacement devices
  2. R5.2 Compliance policies exist for each platform in use, and devices with no compliance policy are marked not compliant
  3. R5.3 BitLocker is enforced and recovery keys are escrowed to Entra ID
  4. R5.4 Windows LAPS manages the local administrator password
  5. R5.5 Update rings or Windows Autopatch keep Windows and Microsoft 365 Apps current
  6. R5.6 Microsoft Defender for Endpoint or another endpoint protection tool is deployed and reporting
  7. R5.7 Personal phones that access company data are covered by app protection policies

R6. Data sharing and oversharing (SharePoint, OneDrive and Teams)

Open sharing links and broad site membership expose files to more people than intended. AI tools make that exposure easier to find.

Checks

  1. R6.1 The organization-level external sharing setting in the SharePoint admin center matches business need, and sensitive sites are set more strictly
  2. R6.2 The default sharing link type is Specific people or People in your organization, not Anyone
  3. R6.3 Anyone links, if allowed, have an expiration set
  4. R6.4 Sites and teams with Everyone except external users or very large membership are identified and reviewed
  5. R6.5 Every SharePoint site and team has at least two named owners
  6. R6.6 Guest access in Teams and Microsoft 365 Groups is reviewed, with access reviews or a manual schedule for inactive guests
  7. R6.7 Data access governance reports in SharePoint Advanced Management are used to find oversharing where licensed

R7. Data protection (labels, DLP and retention)

Labels, DLP and retention control what happens to sensitive data and how long it is kept. They are the main Microsoft 365 tools that support a compliance program.

Checks

  1. R7.1 Auditing in Microsoft Purview is turned on and someone knows how to search the audit log
  2. R7.2 Sensitivity labels are defined in a short, clear taxonomy and published to users
  3. R7.3 A default label or labeling guidance is in place for new documents and email where the plan supports it
  4. R7.4 DLP policies for key sensitive information types start in simulation mode and are reviewed before enforcement
  5. R7.5 Retention policies or labels cover Exchange, SharePoint, OneDrive and Teams based on written business rules
  6. R7.6 Owners for labels, DLP alerts and retention decisions are named

R8. Backup and recovery

Microsoft runs the service, but restoring data after deletion, ransomware or a bad change is the customer's job. Retention settings are not the same as a tested backup.

Checks

  1. R8.1 A decision is recorded on backup for Exchange, SharePoint, OneDrive and Teams, using Microsoft 365 Backup or a third-party tool
  2. R8.2 Backup scope covers the mailboxes and sites the business cannot lose
  3. R8.3 A restore of a mailbox item, a file and a full site has been tested and the result recorded
  4. R8.4 Recycle bin and deleted item retention periods are known to the IT team
  5. R8.5 A written recovery runbook names who does what during an outage or data loss event
  6. R8.6 Alternate ways to communicate are planned in case Microsoft 365 itself is unavailable

R9. Licensing and tenant hygiene

Unused licenses cost money and stale accounts are an easy target. A clean tenant is also easier to secure and to migrate.

Checks

  1. R9.1 Licenses on disabled or departed user accounts are removed after a set period
  2. R9.2 Shared mailboxes are not licensed unless they need features that require a license
  3. R9.3 Group-based licensing is used so access follows role or department
  4. R9.4 Users with no sign-in for a set period are reviewed and disabled or removed
  5. R9.5 A documented offboarding process covers sign-in block, session revoke, mailbox handling and license removal
  6. R9.6 Unused add-ons and features already covered by the current plan are identified before renewal

R10. AI readiness (Microsoft 365 Copilot and Claude governance)

AI assistants work with the data and access people already have. Clear rules and clean permissions should come before wide rollout.

Checks

  1. R10.1 A written AI acceptable use policy tells staff which AI tools are approved and what data they may use
  2. R10.2 Oversharing from area R6 is reviewed for the sites a pilot group can reach before Copilot is enabled
  3. R10.3 Restricted Content Discovery or Restricted SharePoint Search is considered for sites that should not appear in Copilot results
  4. R10.4 Copilot licenses or Claude seats are assigned to a defined pilot group first, using groups
  5. R10.5 Claude is connected to Entra ID single sign-on where the plan supports it, and connectors to Microsoft 365 data are approved by an admin
  6. R10.6 Copilot and AI activity is captured in Purview audit logging
  7. R10.7 Pilot use cases and success measures are written down before the wider rollout

Common questions

No. This is a practical baseline for a well-run Microsoft 365 tenant. It is not a compliance framework, and Accred Consulting does not certify or attest to compliance. Many of these controls support a compliance program, but your organization and its assessor decide what a given law or standard requires and whether you meet it.
Some checks need specific plans. Conditional Access needs Entra ID P1, which is in Microsoft 365 Business Premium and E3. Risk-based policies and Privileged Identity Management need Entra ID P2. Where a check depends on a license, it says so. You can still meet most of the standard with Business Premium or E3.
We use it as the checklist for free review calls and as the starting point for project discovery. In a free call, we walk through the areas that match your topic based on what you share. In a project, the checks help set scope, so the proposal states which areas are in and what will change.

Not sure where to start?

Book a free consultation with a US-based specialist. If a project makes sense, you get a written plan with scope, a fixed price and a timeline.

Book a free consultation