Microsoft 365 security audit for small businesses
Start a Microsoft 365 security audit with read-only checks, provider evidence and remediation priorities. Understand when you need a wider consultancy audit.
Read the guide →Practical answers, supported by evidence
Microsoft 365 security guides
Understand the controls your business relies on, the questions to ask your IT provider and the evidence that supports the answers.
Start with your baseline
Microsoft 365 security assessment
Understand scope, settings checks, provider evidence and practical priorities before deciding what to investigate next.
Read the assessment guide →Free download — no email required
The UK Small Business Microsoft 365 Security Checklist 2026
Work through 40 controls across eight areas with your IT provider, record supporting evidence and agree your next three priorities.
Download the checklist PDFChoose the guide for your question
- Assessment: establish a baseline and understand the product's selected checks.
- Audit: agree criteria, prepare evidence and understand a specialist audit process.
- Review: revisit findings and evidence after changes or on an agreed schedule.
- Checklist: work through a practical DIY control and evidence list.
- Secure Score: interpret Microsoft's recommendations and their limitations.
- MFA: review registration, enforcement and exceptions.
- Administrator security: review privileged accounts and access.
- Cyber Essentials: prepare Microsoft 365 evidence in the context of the UK scheme.
Audit and review options
Microsoft 365 security review: agree priorities with your IT provider
Review Microsoft 365 security after changes, check provider evidence and agree a practical action plan for your small business.
Read the guide →Understand the controls and evidence
Microsoft 365 security checklist for small businesses
A practical Microsoft 365 security checklist covering accounts, MFA, email, sharing, recovery and the evidence your IT provider should supply.
Read the guide →Cyber Essentials and Microsoft 365: what to prepare
Understand how Microsoft 365 fits into Cyber Essentials, what evidence to prepare and why tenant settings alone are not certification.
Read the guide →Microsoft Secure Score: what it means and how to improve it
Understand Microsoft Secure Score, what a good score means, how to prioritise improvements and why it is not complete security assurance.
Read the guide →Microsoft 365 MFA: how to check who is protected
Review Microsoft 365 MFA coverage, enforcement, administrator protection and exceptions, with a clear evidence checklist.
Read the guide →Microsoft 365 admin security: review Global Administrator access
Review Global Administrator accounts, standing access, MFA, provider access and emergency access in Microsoft 365.
Read the guide →Start with your own security position
Use a free assessment to identify selected control gaps and agree priorities.