A Microsoft 365 health check should help you answer three questions: what is in place, where the important gaps are and what to do next. For a smaller business, the useful result is a written set of priorities that someone can act on.
The name alone tells you little about the work included. Before booking a review, ask which parts of your setup will be examined, what access is needed and what you will receive afterwards. This checklist explains the questions to raise.
Start with the business concern
You may be preparing to change IT providers, reviewing who controls your accounts, questioning licence use or checking who is responsible for devices and recovery. Tell the reviewer what prompted the conversation and which services your staff rely on.
Agree the systems, review areas, exclusions, access method, fee and delivery timing before work begins. Clarify whether the engagement is a review or includes changes. A configuration and readiness review does not replace penetration testing, compliance certification or an incident-response service.
Five areas to include in the discussion
1. Identity and access
Establish who has administrative access, who approves permissions and how access changes when people join, move roles or leave. Include existing provider access and confirm that the business knows who can authorise changes.
Ask how sign-in protection is configured and what evidence supports the finding. Microsoft's multifactor authentication overview explains how an additional authentication factor protects sign-in. For the review, distinguish the controls actually applied to the agreed accounts from assumptions based on a policy document.
The output should identify uncertain ownership or access that needs investigation. Do not remove an account simply because nobody recognises its name; first confirm its owner, purpose and dependencies.
2. Security configuration
Agree which settings and services will be examined, such as the relevant sign-in, email and sharing controls. Ask the reviewer to explain a finding in terms of the business concern, the available evidence and the next decision.
A setting that needs attention may require more investigation before a change is safe. The report should make that uncertainty visible, including areas the reviewer could not assess. It should not present the review as a guarantee that incidents cannot occur.
3. Licensing and service use
Compare assigned licences with the features people need and the services the business uses. Include who buys the subscriptions and when commercial decisions need to be made.
An apparently unused licence is a question to investigate, not an automatic cancellation. Check dependencies, required features and supplier terms before proposing a change. Our Microsoft 365 licensing checks cover questions to discuss before changing a subscription.
4. Devices and responsibilities
Agree which devices and management tools are in scope. Establish who manages supported devices, how they join and leave the business and what evidence is available for the agreed policies.
Record the limits. A review of the available management configuration is different from checking every physical device. The written output should make clear what was examined and who owns any follow-up work.
5. Backup and recovery readiness
Start with the information the business needs to recover: email, shared documents or another agreed service. Establish what is covered, who operates the recovery arrangements and what evidence exists that the required information can be restored.
The NCSC's backup guidance for small organisations recommends knowing how to restore a backup and checking that it contains important data. Ask what recovery evidence is available for your own setup.
A readiness review can identify missing evidence. Any restore exercise, new backup service or change to a live system needs its own agreed scope and approval.
Prepare for the review without a documentation project
You do not need every answer before the first conversation. A useful starting pack includes:
- The business concern and the Microsoft 365 services staff depend on.
- Approximate user and device numbers, including any known exceptions.
- The person who can authorise access and your current support/provider contacts.
- Available subscription, device-management and backup documentation.
- Known issues, relevant recent changes and any deadlines affecting the work.
- Who will receive the findings and decide what happens next.
Identify who can arrange access rather than putting passwords or recovery codes in the pack. Use an agreed secure access method once the review and permissions have been authorised.
Ask for findings you can use
A useful report records the finding, evidence, priority, recommended next step and the person or team responsible for the decision. It separates confirmed issues from assumptions and explains any access or evidence limitations.
For example, an illustrative report entry could say:
- Finding: the available records do not identify the owner of an administrator account.
- Evidence: the reviewed account list and ownership documentation do not agree.
- Priority: agree after confirming the account's permissions, purpose and business dependency.
- Next step: ask the authorised business contact and current provider to confirm ownership before proposing a change.
- Decision owner: a named business approver, agreed during the review.
This is an example of the report format, not a client finding. It avoids treating uncertainty as proof that an account should be deleted.
Discuss which actions need prompt attention, which need further investigation and which can enter a planned improvement list. If implementation is proposed, ask for its scope, dependencies, acceptance checks and fee. A recommendation does not automatically authorise the work.
Choose the next step
You should be able to use the written priorities with your existing team, another provider or LM Cloud. Some findings may lead to a small change; others may need a project, a recovery exercise or an ongoing support arrangement.
Discuss a Microsoft 365 health check to agree the right review scope, or explore ongoing Microsoft 365 support. If the review is part of a provider change, use our IT handover checklist to prepare the wider transition.