Skip to Content
Free Microsoft 365 check

How well is your Microsoft 365 set up and protected?

Answer twelve quick questions about sign-in, admin access, email protection, sharing and backup. You get a status and a ranked list of what to fix first as soon as you send it, and we follow up with a written summary.

Start the check+1 (778) 779-7127
What the check covers

Twelve settings that matter most

Sign-in

Multi-factor sign-in for every account and blocking older sign-in methods that skip it.

Admin access

How many people hold the keys, and whether admin accounts are kept apart from everyday ones.

Staff changes

What happens to accounts, mailboxes and files when someone joins or leaves.

Email protection

SPF, DKIM and DMARC, link and attachment checks, and forwarding rules attackers like to hide.

Sharing

What SharePoint, OneDrive and Teams let people share outside the business.

Backup and alerts

A separate backup of your Microsoft 365 data, a tested restore, and alerts someone acts on.

The check

Twelve questions, about five minutes

Step 1 / 3 · Sign-in and access33%
  1. Sign-in and access
  2. Email, sharing and backup
  3. Your details
Sign-in · Q1
Does every account have to use multi-factor authentication (MFA) to sign in?

Every person, every time, including the owner and any shared mailboxes people sign in to. An authenticator app is stronger than text-message codes.

Sign-in · Q2
Are old sign-in methods blocked, and are sign-ins limited by rules such as location or device?

Older mail apps and protocols can skip MFA entirely. Security defaults or Conditional Access close that gap; Conditional Access needs Business Premium or a similar plan.

Admin accounts · Q3
Do only two to four people hold global admin rights, using separate admin accounts they never use for everyday email?

An admin account that also reads email and browses the web is the most valuable thing an attacker can phish.

Staff changes · Q4
When someone leaves, is there a written checklist to block their sign-in, keep their files and handle their mailbox?

Includes signing them out everywhere, resetting MFA, converting or forwarding the mailbox and moving OneDrive files.

Devices · Q5
Can only company-managed or up-to-date devices open company email and files?

Personal phones and home computers should at least have a screen lock, encryption and current updates.

Subscriptions · Q6
Do you know who every Microsoft 365 subscription you pay for is assigned to, and that none are going unused?

Unused subscriptions, or a more expensive plan than someone needs, are a common and easy saving.

Please answer every question on this step to continue.

Email · Q7
Are SPF, DKIM and DMARC set up for your email domain?

These records tell other mail servers which messages really come from you. They cut spoofing and help your mail avoid spam folders.

Email · Q8
Are links and attachments checked before they reach inboxes, and are emails from outside clearly tagged?

Defender for Office 365, included in Business Premium, scans links and attachments. Tagging outside senders works on every plan.

Email · Q9
Is automatic forwarding of email to outside addresses blocked, or at least flagged to someone?

After an account is broken into, a hidden rule that copies every message to an outside address is one of the first things attackers set up.

Sharing · Q10
Have external sharing settings for SharePoint, OneDrive and Teams been set on purpose, with “anyone with the link” sharing limited?

The default settings allow more outside sharing than most small businesses need.

Backup · Q11
Are your email, OneDrive, SharePoint and Teams backed up by a separate service, and has anyone tested a restore?

Microsoft keeps the service running, but deleted or encrypted data is only recoverable for a limited time. A separate backup covers you after that.

Alerts · Q12
Is audit logging on, and does someone get alerts for risky sign-ins, new admins or new forwarding rules?

Without logs it is hard to tell what happened after a break-in, or whether one happened at all.

Please answer every question on this step to continue.

Last step. Tell us where to send your written summary and your results appear straight away.

Show my results
Your results
Needs attentionScore: 0%

Here is where we would start, most important first:

    You answered yes to every question, which puts you ahead of most small businesses. A short call can confirm the settings match the answers.

    What happens next

    We have your answers. Within one business day we will email you a short written summary of these results and offer a free call to walk through them. Nothing changes in your Microsoft 365 unless you ask us to, and any work is quoted in writing first.

    Book the full free IT assessmentCall +1 (778) 779-7127

    We use these details to send your summary and follow up. Our privacy page explains how we handle them.

    How it works

    Five minutes now, a clear plan after

    1

    Answer twelve questions

    Yes, partly, no or not sure. If you are not sure, that is a useful answer too.

    2

    See your results

    A status and a ranked list of fixes appear as soon as you send your details.

    3

    Get a written summary

    Within one business day we email a short summary and offer a free call. We quote any work in writing first, and Microsoft 365 backup with Cove is included in our Managed IT plan.

    Common questions

    More answers on our FAQ page.

    Questions before you start?

    Call us and we will go through it together, no form needed.

    +1 (778) 779-7127

    Yes. There is no cost and no obligation, and the results and written summary are yours to keep whether or not you work with us.

    No. The check is based only on your answers. If you would like us to confirm the settings, we can look together over a screen share with read-only access, and we never change anything without your go-ahead.

    This check is written for Microsoft 365. For Google Workspace or a mix of tools, the free IT assessment covers your email and accounts whichever platform you use.

    Microsoft keeps the service running, but if mail or files are deleted, overwritten or encrypted, you can only get them back for a limited time. A separate backup, such as the Cove backup in our Managed IT plan, covers you beyond that.

    They go into our own business system and are used only to prepare your summary and follow up with you. We never sell or share them. Our privacy page has the details.
    More free checks

    Looking at something specific?

    Free IT assessment

    A full review of email, accounts, devices, backups, network, software and privacy, with a written report.

    Start the free IT assessment

    Network check

    Twelve questions on your firewall, Wi-Fi, segmentation, updates, power and monitoring, with results straight away.

    Start the network check