MICROSOFT
What a Microsoft 365 tenant assessment actually looks at
5 min read
A Microsoft 365 tenant assessment is worth doing before any migration or security project because it replaces assumptions about identity, licensing, devices and sharing with a written record of what the tenant is actually configured to do today.
Most Microsoft 365 work starts with a proposal. Someone wants to move email, tighten security, roll out Intune or cut licence spend, and the proposal describes the destination in detail and the starting point barely at all.
That is usually where the surprises come from. Not the migration itself, but the licence that turned out to be the wrong tier, the fifteen-year-old distribution list nobody could delete, the global admin account belonging to a contractor who left in 2024.
An assessment is the unglamorous step that removes those. Here is what we look at, and why each one earns its place.
Identity, first and in detail
Everything else in the tenant depends on identity, so it goes first. We map how accounts are created, who can create them, whether the directory is cloud-only or synchronised from on-premises Active Directory, and what happens to an account when someone leaves.
The question that finds the most problems is a simple one: how many accounts can sign in today that should not be able to?
- Account inventory, including guests, shared mailboxes and service accounts
- Directory synchronisation health and which attributes are authoritative where
- Multifactor authentication coverage, including the accounts that are exempt and why
- Privileged roles, how many global administrators exist and whether any are permanent
Licensing, as assigned rather than as bought
Licence counts in the billing portal and licence assignments in the tenant drift apart quietly. Accounts for people who left keep their licences. Pilots end and the licences stay. Someone buys a higher tier for one feature and never rolls it out.
We reconcile what is bought against what is assigned against what is used, because the third column is the one that tells you whether a tier change is safe. A licence downgrade that looks free on paper can remove a feature three departments depend on.
Devices and the gap between policy and reality
Device management is where written policy and configured reality diverge most often. A tenant can have a well-drafted compliance policy that applies to a fraction of the devices actually connecting to it.
So the number that matters is not how many policies exist but how many devices are enrolled, compliant, and in scope — and what the unenrolled remainder is doing.
- Enrolment counts by platform, against the headcount they are meant to cover
- Compliance policies, what they check and what happens when a device fails
- Which devices reach company data without being managed at all
- Update rings and whether anything is pinned to an old build
Sharing, mail flow and the things that leak
External sharing defaults in SharePoint and OneDrive are set once, usually during the first week of the tenant's life, and then inherited by every site created afterwards. It is worth knowing what that default is before assuming anything about where files can travel.
Mail flow deserves the same treatment. Forwarding rules, connectors, and the state of SPF, DKIM and DMARC describe what your domain can be used for by someone who is not you.
What comes out of it
The deliverable is not a score. A number out of a hundred tells you nothing you can act on, and the tools that generate them are measuring against a generic baseline rather than your business.
What is useful is a written record of the current configuration, a list of findings ranked by what they would cost you if exploited or ignored, and a short list of changes that are safe to make immediately. That last list is usually shorter than people expect and more valuable than the rest combined.
From there a migration plan, a security project or a licence change can be scoped against something real.
Questions we get asked
How long does a Microsoft 365 tenant assessment take?
For a tenant under a few hundred users, the read-only data collection is usually a few days, with the review and written findings following within a week or two. Larger or hybrid environments take longer, mostly because directory synchronisation and mail flow need tracing rather than listing.
What access does an assessment need?
Read-only is enough for the findings. A reader role across the tenant, with security reader and reports reader, covers identity, licensing, device and sharing data. We ask for change access only when you have agreed to a specific remediation.
Is an assessment worth it if we already know our environment well?
It depends on whether the knowledge is written down and current. Teams who know their environment well usually still find two or three things in the identity and licensing sections, because those drift without anyone making a decision to change them.