A quarterly Microsoft 365 checkup for small businesses
Five checks that take about an hour and catch the problems that quietly build up in a Microsoft 365 tenant: extra admins, former employees, unused licenses, and oversharing.
Microsoft 365 rarely breaks all at once. Problems build up quietly: an admin account nobody uses anymore, a former employee who can still sign in, licenses you’re paying for but not using, a file shared with “anyone with the link” two years ago.
None of these are hard to fix. They just need someone to look. Here are five checks I recommend every small business run once a quarter. Together they take about an hour.
1. Review who has admin rights
In the Microsoft 365 admin center, go to Roles and then Role assignments, and look at who holds the Global Administrator role. Microsoft recommends having fewer than five Global Administrators, and at least two so you’re never locked out if one person is unavailable.
- Remove admin rights from anyone who no longer needs them.
- Give people the narrowest role that does the job. Someone who resets passwords needs Helpdesk Administrator, not Global Administrator.
- Ideally, admins use a separate admin account that isn’t used for everyday email and browsing.
2. Close out former employees properly
Look through Users and Active users for anyone who has left. Deleting an account straight away can lose email and files the business still needs, so a typical offboarding looks like this:
- Block sign-in and reset the password.
- Sign the user out of all sessions so existing logins on phones and laptops stop working.
- Convert their mailbox to a shared mailbox and give their manager access. Shared mailboxes up to 50 GB don’t need a license.
- Move the files the business needs out of their OneDrive before the account is deleted.
- Remove their license.
The Reports section of the admin center can show accounts with no recent activity, which is a good way to catch anyone who slipped through.
3. Match licenses to people
Under Billing and then Licenses, compare how many licenses you’re paying for with how many are assigned. Unassigned licenses are money spent on nothing. While you’re there, check that each person has the right plan: some may need more than they have, and some may be on a plan that’s bigger than they need.
4. Check how files are being shared
In the SharePoint admin center, open Policies and then Sharing. This controls how people can share files from SharePoint and OneDrive outside your company.
- If “Anyone” links are allowed, consider turning them off, or set them to expire after a set number of days.
- Set the default link type to Specific people or Only people in your organization, so the safest option is the one people get without thinking.
- Review which guests have access to your sites, and remove the ones that are no longer needed.
5. Pick three items from Secure Score
Microsoft Secure Score, in the Microsoft Defender portal at security.microsoft.com, lists security improvements for your tenant, ranked by impact. It can feel overwhelming, so don’t try to do everything. Each quarter, pick two or three recommendations, fix them, and note what you did. Over a year, that adds up to a much stronger setup.
While you’re in there: check that every account is protected by multifactor authentication, and look for mailbox rules that forward email to outside addresses. Attackers often set those up after breaking into an account. If you’re not sure which MFA approach fits your business, read MFA for small businesses: security defaults or Conditional Access?
Make it a habit
Put a recurring reminder on your calendar for the first week of each quarter, and keep a short log of what you checked and changed. The first checkup takes the longest. After that, it’s mostly confirming things are still where you left them.
If you’d rather hand this off, or want help with the first one, get in touch. Keeping Microsoft 365 tenants tidy and secure is what I do every day.