Microsoft 365 security guide
What security evidence should you ask your IT provider for?
Your outsourced IT provider says security is covered. To understand what is actually being delivered, ask for evidence of specific controls in your environment. A useful response shows what was checked, when, for which accounts or services and what remains unresolved.
Published · Last reviewed · By CyberProva
Run your free Microsoft 365 security assessmentNo card required · Optional read-only Microsoft 365 connection
Start with responsibilities and service scope
Compare the controls your business relies on with the services your provider has agreed to deliver. Gaps can sit between the provider, your staff and other suppliers.
- Confirm which tenant, accounts, devices and data the provider manages.
- Ask who owns access reviews, updates, backups and incident escalation.
- Record excluded services and tasks that require a separate agreement.
Ask for evidence that answers a specific question
Avoid a broad request to prove everything is secure. Start with account protection, privileged access and recovery, then expand according to the business risks and agreed scope.
- MFA: dated coverage evidence, policy scope and exceptions.
- Administrator access: current role assignments, provider identities and review outcomes.
- Recovery: backup coverage and a completed restore-test record with scope and result.
- Email and devices: relevant configuration exports, protection coverage and update records supplied by the provider.
Review the response and agree what happens next
A provider uploading a document does not establish that it supports the control. Your organisation should check the scope, date and outcome before accepting it.
- Keep the evidence request and response linked to the control being reviewed.
- Ask follow-up questions where the evidence is stale, incomplete or for another environment.
- Record who reviewed the evidence and whether it was accepted or rejected.
- Agree owners and next steps for gaps, then refresh evidence after relevant changes.
Where to check this in Microsoft 365
Ask your authorised administrator to inspect these areas for the accounts, services and devices in scope. These are review locations, not instructions to change settings without a plan.
MFA: Conditional Access or Security Defaults
Microsoft Entra admin centre: Entra ID > Conditional Access > Policies; Entra ID > Overview > Properties > Security defaults; Authentication methods > Activity for registration reports.
Conditional Access needs Entra ID P1 or P2; Business Premium includes P1. Security Defaults is available with Entra Free and is an alternative baseline, not an additional layer to enable alongside Conditional Access.
External email forwarding: Exchange Online
Exchange admin centre: Recipients > Mailboxes > mailbox forwarding, plus Mail flow > Rules and remote-domain settings. Review inbox rules separately. In Microsoft Defender, inspect outbound anti-spam policies and their external-forwarding settings.
Recovery: Exchange/SharePoint retention and backup
Microsoft Purview: Data Lifecycle Management > Retention policies and relevant retention labels; review Exchange deleted-item and SharePoint/OneDrive recycle-bin/restore settings with the administrator. Inspect the separate backup service and its recovery records.
Retention, version history and recycle bins offer different recovery functions. Do not assume they are equivalent to an independently managed backup or satisfy the insurer's definition. Confirm the licensed recovery features and actual restore requirements.
What CyberProva can check automatically
Read-only observations depend on the selected plan, Microsoft licensing, consent and available data. Missing access is a gap, not a pass. Review the documented permissions and deployment limitations.
- MFA: Conditional Access or Security Defaults: Core: selected Conditional Access policy observations. Business and above advanced assessments: supported MFA registration, policy-coverage and Security Defaults observations. These are not proof that every sign-in is protected.
- External email forwarding: Exchange Online: CyberProva's basic Graph connection does not enumerate Exchange inbox rules, mailbox forwarding or transport rules. These are evidence-based controls, not automatic mailbox-content checks.
- Recovery: Exchange/SharePoint retention and backup: CyberProva does not automatically validate retention coverage, backup isolation or restore success. Recovery controls require supplied records and organisation review.
What you should request from your IT provider
Keep the source, date, scope, exceptions and reviewer with each record. Submission and acceptance are separate; your organisation decides whether the evidence supports the claim.
- MFA: Conditional Access or Security Defaults: Dated policy state, targeted users/apps, exclusions, authentication strengths and registration records; representative sign-in evidence reviewed by an administrator. Report-only policies and registration alone do not establish enforcement.
- External email forwarding: Exchange Online: A dated forwarding/rule inventory with destinations and exceptions, applicable outbound spam and mail-flow policies, and an administrator's review of suspicious or unexpected changes.
- Recovery: Exchange/SharePoint retention and backup: Retention/deletion scope, backup workload coverage and retention, administrative separation or isolation/immutability where claimed, and a dated restore test with restored data, result, failures and reviewer.
Make the answer provable
Evidence pack for this guide
- The service scope and a control-by-control responsibility list.
- Dated access, MFA, configuration and recovery evidence for your organisation.
- A record of evidence reviews, unanswered requests and agreed follow-up actions.
How CyberProva helps
CyberProva lets you request supporting evidence from an in-house team, MSP or outsourced provider through an upload link. The provider does not need a CyberProva account. Your organisation reviews and accepts or rejects the response. Optional read-only Microsoft 365 checks provide selected settings observations alongside that evidence. Free includes 3 lifetime core assessments; report exports and remediation management require Business or above.
See what a Microsoft 365 security assessment should cover →
See exactly what CyberProva checks · Learn how CyberProva assesses security · Review Microsoft permissions
Practical example
Example request to your outsourced IT provider
Adapt this request to your service agreement and review deadline. Ask for enough context to assess the control without collecting unnecessary sensitive information.
- Please confirm which accounts, devices and services you manage for us, and which security tasks remain our responsibility.
- For our Microsoft 365 tenant, supply dated MFA coverage and policy evidence, including exclusions, and the current administrator-access review.
- For the data we rely on, supply backup coverage and the latest completed restore-test record with its scope, date and outcome.
- Explain any gaps, excluded services or planned fixes, and suggest the next action and person responsible.
What this cannot establish
- Selected settings checks and submitted documents cannot establish every service your provider delivers. Review the service agreement and commission specialist work where needed.
- CyberProva does not change Microsoft 365 settings or perform restore tests. Your authorised IT team implements changes and supplies operational evidence.
Common questions
Does our provider need to buy CyberProva?
No. A provider can submit evidence through the request link without a CyberProva account. Your organisation manages the request and reviews the response.
Is this an independent audit of our provider?
No. It helps you review evidence of selected controls in your own environment. Evidence accepted by your organisation is not an independent audit opinion about the provider.
What if our provider cannot supply evidence?
Keep the gap visible. Clarify whether the control is outside the service agreement, has not been tested or needs remediation, then agree who will follow up.
Should we send passwords or recovery codes as evidence?
No. Request reports or records that answer the question, redact unnecessary personal information and avoid passwords, recovery codes, API keys and other secrets.
Official guidance
Use these sources with your IT provider when reviewing the controls described above.
From assumptions to evidence
See what needs attention in your organisation
Start with a free CyberProva assessment. Review the findings, identify evidence gaps and agree priorities with your IT team.
Free includes 3 lifetime core assessments. Report exports and advanced features require a paid plan.