Your free checklists.

Microsoft 365 Security Assessment Checklist

A practical review of the Microsoft 365 settings that matter most, for MSPs assessing a client tenant.

How to use it: work through each check in the client's admin centres, mark Pass, Gap or N/A, and note the evidence. Every Gap is a remediation task, and usually a project to quote.

Identity and access

• Every user has MFA registeredEntra admin centre: authentication methods activity.
• MFA is enforced by policy, not just registeredConditional Access policies, or Security Defaults if the tenant has no Entra ID P1.
• Legacy authentication is blockedOlder protocols such as basic-auth POP, IMAP and SMTP skip MFA entirely.
• Admin roles are held by separate admin accountsDay-to-day accounts should not hold Global Administrator.
• Global Administrators are kept to a small numberMicrosoft recommends fewer than five.
• Admins use stronger MFA than SMSAuthenticator app, passkeys or security keys.
• Emergency access accounts exist and are documentedMonitored, excluded carefully from policies, credentials stored securely.
• Inactive accounts are disabledNo sign-in for 90 days or more, including leavers.
• Guest accounts are reviewedRemove guests who no longer need access.

Email security

• SPF is published for every sending domain
• DKIM signing is enabled for every domain
• DMARC is published, ideally at quarantine or rejectA p=none policy only monitors.
• Automatic forwarding to external addresses is blockedA common route for data loss after a compromise.
• Mailbox and unified audit logging are onNeeded for any incident investigation.

Data and sharing

• SharePoint and OneDrive external sharing is no wider than needed
• "Anyone" links expire, or are turned off
• Teams external access and guest access match the client's policy

Devices

• All Windows devices run a supported versionUnsupported versions no longer receive security updates.
• Devices are managed and compliantIntune or your RMM.

Licensing and cost

• No paid licences sit unassigned
• Licences are not assigned to disabled or former users
• Licence tiers match what users actually need

Monitoring

• Microsoft Secure Score is reviewed and trending up
• Alert policies notify someone who will act on them

This checklist is a general guide, not a complete security audit. Settings and recommendations change; confirm against current Microsoft documentation.

Cyber Insurance Readiness Checklist

The controls insurers most often ask about, so you can gather evidence before your client fills in the application.

How to use it: for each control, record whether it is in place and where the evidence lives. Answer the insurer's questions only from evidence, never from memory.

Identity

• MFA on all email accountsEvidence: Microsoft 365 MFA registration and enforcement reports.
• MFA on all remote accessVPN, remote desktop and remote support tools.
• MFA on all admin and privileged accounts
• Separate accounts for admin tasks
• Leavers removed promptlyEvidence: offboarding records and inactive-account report.

Email

• Email filtering for phishing and malware
• SPF, DKIM and DMARC on every domain
• External emails are tagged

Endpoints

• Endpoint detection and response (EDR) on all devicesEvidence: EDR console device count versus RMM device count.
• Operating systems are supported and patchedMany forms ask how quickly critical patches are applied.
• Local admin rights are restricted

Backup and recovery

• Backups cover all critical systems and Microsoft 365 data
• At least one backup copy is offline, immutable or segregatedInsurers increasingly ask this.
• Restores are tested and the result is recordedDate of last successful test restore.

People and process

• Security awareness training for all staffEvidence: completion records.
• A written incident response plan, with contacts
• Payment and bank-change requests are verified by phone
• Third-party and vendor remote access is controlled

Insurers' questions and requirements differ and change over time. This checklist helps gather evidence; it is not insurance advice and does not guarantee coverage or acceptance.

Client QBR Template

A one-hour quarterly business review that shows your value and agrees the next projects.

How to use it: fill this in before the meeting from your PSA, RMM and Microsoft 365 data, send it to the client a day ahead, and keep the meeting to decisions.

1. Wins since last review (5 min)

• Projects completed and what they changed
• Problems solved before the client noticed

2. Service summary (10 min)

• Tickets this quarter versus last, and the top three causes
• Response and resolution times against the agreement

3. Security posture (10 min)

• Secure Score and MFA coverage, and the trend
• Open security findings, ranked by risk

4. Devices and lifecycle (5 min)

• Devices out of support or due for refresh in the next 12 months
• Devices not covered by the contract

5. Backup and continuity (5 min)

• Backup coverage and failed jobs
• Date and result of the last test restore

6. Licensing and cost (5 min)

• Unused or mismatched licences
• Upcoming renewals

7. Recommended projects (10 min)

• For each project: what it is, why it matters, estimate, priority and timing

8. Business plans and decisions (10 min)

• Hiring, office moves or new systems planned in the next 12 months
• Decisions made today, owners and dates

Template provided as a starting point. Adapt the agenda to each client and your service agreement.

Microsoft 365 Offboarding Checklist

A step-by-step list for removing a leaver safely, without losing data or paying for licences you no longer need.

How to use it: agree the leaving date, data owner and mailbox plan with the client before the last day, then work through each step and record who did it and when.

Before the last day

• Confirm the leaving date and time with the client
• Agree who takes over email, files and shared responsibilities
• List devices, accounts and third-party apps the user hasInclude admin roles and app ownership.

On the last day

• Block sign-inEntra admin centre or Microsoft 365 admin centre.
• Reset the password
• Revoke active sessions so existing logins stop working
• Remove MFA methods and registered devices
• Remove admin roles, group memberships and app ownership
• Set an automatic reply if the client wants one

Data and mailbox

• Convert the mailbox to a shared mailbox, or set forwarding, as agreedA shared mailbox under 50 GB does not need a licence.
• Give the new owner access to the user's OneDrive filesDeleted users' OneDrive is kept for 30 days by default.
• Transfer ownership of Teams, groups and shared files
• Review apps the user consented to

Devices and billing

• Recover company devices and wipe or retire them
• Remove licences once data is securedThen reassign or reduce the licence count.
• Update the PSA contract and RMM recordsStop billing seats and devices that are gone.
• Record what was done, by whom and when

General guidance only. Follow the client's own data retention and legal requirements, and confirm steps against current Microsoft documentation.