AI-generated illustrative scene.
A Microsoft 365 security review should leave you with clear answers: who can access company information, which protections are active, and who responds when something looks wrong. For a San Diego small business, that review needs to cover the office, home workspaces, contractors and any devices used on the road.
Use this checklist to organize a conversation with your administrator or IT provider. Start with an inventory and a test plan. Changing several security settings at once can interrupt normal work and make troubleshooting harder.
1. Identify the accounts and applications that matter most
Write down the business processes that depend on Microsoft 365. Include email, customer proposals, payroll documents, project folders and shared calendars. Then list the people and outside collaborators who use them.
Choose an owner for each important workspace. A project manager can explain who should see a project folder; IT can verify whether its permissions match that decision. Neither person should have to guess what the other intended.
Which accounts belong to current employees, contractors and guests?
Which accounts administer the environment?
Which applications send email or connect to company data?
Who approves exceptions, and when are those exceptions reviewed?
2. Check sign-in protection and account recovery
Ask your administrator to demonstrate how multifactor authentication is enforced, rather than only confirming that employees registered an authentication method. Review new starters, older accounts and administrator accounts separately. Also establish a documented recovery process for a lost phone or unavailable administrator.
Microsoft describes security defaults and Conditional Access as different approaches to enforcing sign-in protections. Conditional Access requires appropriate licensing. Do not disable an existing protection simply to clear a setup warning; plan and test any replacement first. See Microsoft's MFA administration guidance.
3. Match the review to your actual licenses
A checklist that assumes every business owns the same subscription can create false confidence. Have IT record the licenses assigned to users and the security capabilities available under those licenses. Separate a missing feature from an available feature that has not been configured.
Microsoft's business security guidance distinguishes baseline email protections from additional capabilities included in other plans. Review administrator protection, email filtering and device management against your actual environment. Use Microsoft's plan-aware security overview as a reference, not a substitute for checking your tenant.
4. Follow one sensitive file from owner to recipient
Choose a representative document, such as a customer proposal. Confirm where it is stored, who can edit it, how an outside recipient receives it, and how access ends when the work is finished. This small exercise often reveals more than a general question about whether file sharing is secure.
Review SharePoint and OneDrive sharing at both the organization and individual site levels. Microsoft explains that these settings interact, and that sites containing information that must remain internal can have external sharing disabled. See the external sharing overview. Apply restrictions deliberately so legitimate collaboration has an approved alternative.
5. Make suspicious-message reporting easy
Employees need a simple route for reporting an unexpected payment request, login prompt or attachment. Give them a named support channel and explain what information to include. Avoid a process that requires forwarding a suspicious attachment to several colleagues.
CISA recommends recognizing and reporting phishing, using MFA, maintaining strong passwords and keeping software updated. Its online safety guidance provides a useful foundation. Reinforce it with examples from your own workflows, such as independently confirming a supplier's changed payment instructions using a known contact number.
6. Turn findings into a short work list
For each gap, record the affected process, the person responsible, the next action and the evidence needed to close it. “Review contractor access to the estimating folder by Friday” is easier to complete than “improve cloud security.” Keep screenshots and exports containing sensitive configuration information in a restricted location.
Question: Are the right people accessing project files?
Useful evidence: Owner-reviewed membership list
Question: Can employees report suspicious messages?
Useful evidence: A completed reporting exercise
Question: Who handles an urgent account issue?
Useful evidence: Current escalation contacts and a tested handoff
A practical example
Consider a hypothetical 18-person San Diego consulting firm that regularly shares proposals with outside specialists. Its first review might focus on three items: confirming sign-in protection, removing access for completed projects, and making the support contact easy to find. The firm can then schedule a device and email-policy review after documenting those initial changes. This is an example of prioritization, not a claim about a customer or a guaranteed security outcome.
How often should you review Microsoft 365 security?
Set a recurring review that fits your staffing and risk, and revisit access when people join, leave or change roles. Significant application changes and security incidents also deserve attention. Record the date and scope so the next review starts with useful evidence instead of assumptions.
For the human side of protection, read our employee cybersecurity training guide. To discuss Microsoft 365 and IT support needs for your business, contact SD Network Pro.