Microsoft 365 security evidence for recruitment agencies

Map a candidate's route through your systems

Follow one typical recruitment workflow from application to client submission and later retention or deletion. Use the map to avoid answering a question about the whole service using evidence from only the email tenant.

• Identify the applicant-tracking system, job boards, CV-parsing tools and shared document locations used by the agency.
• Record where candidate information is copied or exported into email, Teams, SharePoint or OneDrive.
• Identify which party administers each system and who can provide access and recovery records.
• Keep candidate-data retention and deletion decisions with the responsible team; a Microsoft 365 assessment does not set or validate those decisions.

Review consultant access and candidate sharing

An agency's access can change when consultants move desks, contractors leave or client relationships end. Review the permissions and sharing routes that support those changes, rather than relying only on an account count.

• Request MFA policy scope and exclusions for consultants, administrators and external support identities.
• Check the access-removal process across both Microsoft 365 and the applicant-tracking system.
• Ask for evidence of how candidate documents are shared with clients and how expired access is handled.
• Review connected applications and their permissions where supported; ask each supplier about controls outside the tenant assessment.

Answer a client's assurance questions within the evidence scope

A client may ask how the agency protects candidate information, manages supplier access or recovers its placement service. Keep the answer tied to the systems and records actually reviewed.

• Distinguish automated Microsoft 365 observations from provider documents and applicant-tracking supplier statements.
• Ask whether recovery records include the data and exports the agency needs to continue operating.
• Leave questions about unreviewed integrations or platforms open until the relevant supplier supplies evidence.
• Have the agency's responsible reviewer approve the response before it is sent to procurement.

Where to check this in Microsoft 365

Ask your authorised administrator to inspect these areas for the accounts, services and devices in scope. These are review locations, not instructions to change settings without a plan.

What CyberProva can check automatically

Read-only observations depend on the selected plan, Microsoft licensing, consent and available data. Missing access is a gap, not a pass. Review the documented permissions and deployment limitations.

• MFA: Conditional Access or Security Defaults: Core: selected Conditional Access policy observations. Business and above advanced assessments: supported MFA registration, policy-coverage and Security Defaults observations. These are not proof that every sign-in is protected.
• External file access: SharePoint and OneDrive: Business and above advanced assessments can read selected tenant-wide sharing and link settings when permitted. They do not perform a file-by-file or matter-by-matter access audit.
• Connected applications: Entra enterprise applications: Core: selected application counts. Business and above advanced assessments: supported application inventory and Microsoft Graph app-only grants. Delegated consent, other APIs and a supplier's internal security are outside that inventory.

What you should request from your IT provider

Keep the source, date, scope, exceptions and reviewer with each record. Submission and acceptance are separate; your organisation decides whether the evidence supports the claim.

• MFA: Conditional Access or Security Defaults: Dated policy state, targeted users/apps, exclusions, authentication strengths and registration records; representative sign-in evidence reviewed by an administrator. Report-only policies and registration alone do not establish enforcement.
• External file access: SharePoint and OneDrive: Tenant and relevant site sharing settings, approved guest/link exceptions and sample access-review outcomes. Record who approved external access and what was removed after the review.
• Connected applications: Entra enterprise applications: An approved supplier/application register, owner and review dates, permission justifications and assurance records for services outside Microsoft 365. An enabled application is not proof it is in use or approved.

How CyberProva helps

CyberProva combines selected read-only Microsoft 365 checks with requests for provider evidence. It can help your agency keep the basis of a security answer visible and identify gaps for a supplier to address. Free includes 3 lifetime core assessments, evidence requests and an on-screen summary. Business and above add questionnaire drafting from mapped controls, report exports and remediation management. Questions about your applicant-tracking platform or wider recruitment process still need appropriate evidence and review.

See what a Microsoft 365 security assessment should cover →

See exactly what CyberProva checks · Learn how CyberProva assesses security · Review Microsoft permissions

What this cannot establish

• CyberProva does not certify UK GDPR compliance or establish the lawfulness, retention or deletion of every candidate record. Those questions require review of the agency's full processing activities and current guidance.
• A tenant observation does not establish the security of an applicant-tracking platform, a supplier's internal systems or every downstream copy of a CV. Provider evidence remains subject to your organisation's review.

Common questions