How to tell if your IT provider runs Microsoft 365 securely
Key takeaways
- Whether Microsoft 365 is run securely can be checked against ten concrete pieces of evidence. Almost all of them come straight from the Microsoft portals and can be compiled within a day.
- This is a matter of your responsibility as management. You need the evidence anyway for auditors, insurers and customers.
- A good answer is specific: a report, a date, a number, a name. A weak answer is “That is all set up”.
- If you would like an independent second opinion, a fixed-price Gap Assessment is an option, without replacing your existing provider.
Many managing directors have an uneasy feeling they cannot quite put into words. Phishing emails still get through, the cyber insurer is asking new questions, and the question “Are we secure?” gets a friendly “Yes”. That does not mean anything is wrong. It only means you cannot verify it. This article gives you a factual list you can use for the conversation with your IT provider or internal IT team.
How can you tell whether Microsoft 365 is run securely?
By evidence. A provider who looks after Microsoft 365 carefully can demonstrate the following ten points within a day, because the data already exists in Microsoft Entra ID, Microsoft Defender and Microsoft Intune. Do not ask for a presentation. Ask for exports and dated screenshots. For a well-run IT team, this is routine.
Which ten pieces of evidence should your IT provider be able to show?
1. MFA coverage for all users
What to ask for: the “User registration details” report from Entra ID, which shows who has registered which sign-in method.
What a good answer looks like: All users have registered MFA, exceptions are known by name and justified. There is a plan to move from SMS to passkeys, because Microsoft is ending SMS delivery. See Conditional Access and passkeys for details.
2. Conditional Access policies that are actually enforced
What to ask for: a list of Conditional Access policies with their status.
What a good answer looks like: There are policies for MFA, against legacy authentication and for administrators, and they are set to “On”. Policies that have been in report-only mode for months do not protect anything. We describe how to introduce them without lockouts in Rolling out Conditional Access without locking out your staff.
3. Few Global Administrators, emergency access accounts and PIM
What to ask for: the number of accounts with the Global Administrator role, a description of the emergency access accounts and evidence of when they were last tested.
What a good answer looks like: The role is assigned to fewer than five people. Administrators work with separate admin accounts, ideally through Privileged Identity Management (PIM), where rights are only activated for a limited time. There are two emergency access accounts that are excluded from policies and trigger an alert at every sign-in.
4. Mailbox auditing and alerts on forwarding rules
What to ask for: confirmation that mailbox auditing is active, and the list of alert policies for new forwarding and inbox rules.
What a good answer looks like: Auditing is on, alerts for new forwarding rules go to a named person, and automatic forwarding to external addresses is disabled in the outbound spam policy. A secretly created forwarding rule is a typical sign of a compromised mailbox.
5. SPF, DKIM and DMARC set to “reject”
What to ask for: the DNS records for SPF, DKIM and DMARC for all domains, including unused ones.
What a good answer looks like: All three are in place, DMARC is set to p=reject after an observation phase, and the DMARC reports are reviewed. We explain the basics in our article on SPF, DKIM and DMARC in Microsoft 365.
6. Microsoft Defender for Office 365 policies
What to ask for: an overview of the active policies for Safe Links, Safe Attachments and anti-phishing.
What a good answer looks like: The “Standard” or “Strict” preset security policies are assigned to all users, and impersonation protection is configured for management, accounting and your own domains. These profiles only take effect once they are assigned to users.
7. Device compliance and update status from Intune
What to ask for: the compliance report from Microsoft Intune and the status of operating system updates.
What a good answer looks like: All devices with access to company data are managed in Intune, non-compliant devices are named and have a date for remediation. For administrators, a Conditional Access policy requires a compliant device.
8. Tested restore
What to ask for: the date and result of the last restore test for mailboxes, OneDrive and SharePoint.
What a good answer looks like: There is a backup, for example with Microsoft 365 Backup, and a documented test shows that a restore works and how long it takes. A backup that has never been restored is an assumption, not evidence.
9. A written incident process with a contact chain
What to ask for: the document that describes what happens when a compromise is suspected.
What a good answer looks like: There is a written procedure with names and phone numbers: who informs whom and when, who may block accounts, and who decides on notifications to authorities, insurers and customers. Management knows its role in it.
10. A monthly report with the Secure Score trend
What to ask for: the last three monthly reports.
What a good answer looks like: The report shows the trend of Microsoft Secure Score, completed and open actions, and consciously accepted risks. The score is not an absolute measure of security. What matters is the trend and the reasoning behind open items.
How do you raise the topic without straining the relationship?
By presenting it as what it is: your duty as management to know your risks and to hold evidence. A good provider will welcome this, because it makes their work visible. If individual points are missing, agree a list with priorities and dates; switching providers is rarely necessary. Often what is missing is time, licences or a clear mandate rather than skill.
Frequently Asked Questions
How long should it take to compile this evidence?
If the environment is well maintained, it is usually possible within one working day, because most of the data can be exported directly from the Microsoft portals. If it takes much longer, that in itself indicates that documentation or monitoring is missing.
Do I need additional licences for all of these points?
Not for all of them. Conditional Access requires Microsoft Entra ID P1, PIM requires Entra ID P2 or Entra ID Governance, and Safe Links and Safe Attachments require Microsoft Defender for Office 365. Many of these features are already included in Microsoft 365 Business Premium or E5. Check first what you are already paying for.
What if phishing keeps arriving regardless?
No filter stops every message. What matters is that a link that gets through does not lead to an account takeover. This is why phishing-resistant sign-in and Conditional Access matter more than any additional filter rule.
The next step
If you would like an independent second opinion, we review these ten points and more in our fixed-price Gap Assessment, without replacing your existing provider. You receive a report with prioritised actions that your provider can implement directly. If you want to hand over ongoing monitoring, see Managed Security.