Microsoft 365 security: a buyer’s checklist

Use the checklist to request evidence, not just yes/no answers

For each area below, record the current state, the person responsible, evidence available and the next action. “Enabled” is incomplete if exceptions, administrator accounts or departing staff are outside the discussion. Use sanitised screenshots and summaries; do not collect passwords, recovery codes or private mailbox contents in the buying process.

Microsoft groups business-security capabilities into account, email/collaboration and device controls. Its documentation distinguishes included protection from additional capabilities in other plans. Confirm your actual subscriptions, add-ons and assigned users before agreeing a design. Microsoft: business-security overview.

MFA and sign-in policy

Ask which identities are covered, how people register and which exceptions exist. Include administrators, guests and accounts used by applications. Agree how lost devices and unavailable authentication methods are handled without normalising insecure shared access.

Microsoft Entra security defaults and Conditional Access are different approaches. Security defaults provide a baseline; Conditional Access offers more granular policies where appropriate licensing exists. They should not be presented as identical toggles or layered blindly without reviewing the current configuration. Microsoft: security defaults.

Ask the supplier to demonstrate intended access and expected denial with an authorised test identity. A checkbox screenshot alone cannot show every dependency or exception. Changes must be planned to avoid locking out the people responsible for recovering access.

Administrator privileges

List which roles exist and why each assignment is necessary. Separate ordinary work from privileged administration where the design supports it. Establish who approves changes, reviews old privileges and can recover access if the primary administrator is unavailable.

Do not accept “IT has access” as the complete record. The customer should know which provider-controlled identities have administrative permissions and how those permissions are removed at handover. Evidence should not expose credentials or access tokens.

Mailbox and account lifecycle

Ask how new starters, role changes and departures are communicated and completed. Include shared-mailbox access, forwarding, delegated permissions, devices and business information that must be retained. The plan should name the business approver for access changes.

For shared resources, clarify whether users access them through their own authorised identities rather than sharing a mailbox password. State how access and ownership are reviewed when responsibilities change. Account removal and data-retention decisions must follow the customer’s agreed requirements.

Phishing and suspicious-message handling

Identify the protections the license supports and the policies actually applied. Ask where users report a suspicious message, who reviews it and what the response may include. Training should explain reporting and verification, not imply that one awareness session eliminates the risk.

Microsoft documents anti-malware, anti-spam and anti-phishing controls and additional protection in Business Premium. Review the exact entitlement before promising capabilities such as advanced link or attachment handling. Microsoft: business security best practices.

An emailed bank-detail change should not become trusted just because a filter allowed the message. Keep business verification and approval procedures distinct from email filtering.

Suspicious sign-ins and investigation visibility

Ask which logs and alerts are available, how long the licensed service retains them and who reviews them. Identify the permitted actions if suspicious activity is observed. Do not assume that a provider continuously monitors a feature simply because the portal contains a dashboard.

Agree what evidence is preserved for review and how private information is restricted. The service description should distinguish an observed sign-in, an alert, a confirmed compromise and a completed response. Exact investigations and sensitive details belong in an approved private channel, not the public enquiry form.

Configuration ownership and testing

Request an agreed change plan, current configuration record and a rollback approach. Who authorises policy changes? Who tests normal access afterward? Which business processes could be affected, such as scanning to email, shared devices or older applications?

Do not require unsafe exceptions merely to keep an undocumented dependency alive. First establish the business need, supported alternatives and an approved migration or exception plan. Record any accepted residual risk and revisit it deliberately.

Recovery and service continuity

Confirm how administrators regain access, how business-critical information is recovered and which dependencies are external to Microsoft 365. Discuss customer-controlled backup or retention requirements in terms of the actual plan and use case rather than assuming every deletion or compromise is reversible.

A recovery plan needs a testable outcome, not only a promise that “the cloud has copies”. The backup-readiness guide explains how to connect a technical recovery test to the business’s required result.

Reporting and support boundaries

Agree the users/accounts covered, human hours, escalation contacts and reporting interval. Distinguish initial hardening from recurring administration, licence supply, incident investigation and other projects. Ask what happens when the provider cannot reproduce an issue or needs customer approval.

Foxbyte does not claim Microsoft partner status, certifications, guaranteed breach prevention or a staffed 24/7 response through this guide. Its Microsoft 365 and Email Security service is scoped against the customer’s supported environment and responsibilities.

Use a compact buying worksheet

Treat this as a planning worksheet, not an audit certificate or a checklist whose completion guarantees security. Describe your subscriptions, user groups and most important concern when requesting a consultation; arrange any deeper evidence exchange privately.

Request a Microsoft 365 security discussion