A practical checklist for Microsoft 365 tenant hygiene

When a tenant changes hands, the useful first week is not a rebrand of the admin center. It is a pass through the things that quietly become incidents: who is an admin, how mail leaves the organization, what a guest can touch, and whether a device is known.

Identity

Privileged access is the shortest path to a bad week. Start there.

• The Global Administrator count should be small. Those accounts should not be the mailbox someone uses all day.
• Multi-factor authentication belongs on every privileged role. Prefer phishing-resistant methods where the business can actually support them.
• Emergency access accounts are secrets, stored like secrets. They are not a password in a shared inbox.
• Guest users need an owner. If nobody can say why the guest is still invited, the invitation is leftover.
• Legacy authentication is worth finding before it finds you. A sign-in log is more honest than a policy someone thinks they turned on.

Microsoft publishes its own guidance on privileged roles. Read it beside the tenant, not instead of looking: best practices for Microsoft Entra roles.

A read-only look at directory roles, with Microsoft Graph PowerShell, is a reasonable start. It changes nothing.

# Confirm privileged roles before changing anything.
Connect-MgGraph -Scopes "RoleManagement.Read.Directory"
Get-MgDirectoryRole | Select-Object DisplayName, Id

Mail and files

Mail and sharing are where a tidy identity story still leaks.

• Inbox rules that forward outside the organization. Look for them on purpose. They are rarely documented.
• Sharing defaults in SharePoint and OneDrive. "Anyone with the link" is a decision. It should not be an inheritance nobody chose.
• A retention idea, even a plain one, before a mailbox disappears because someone left on a Friday.

Devices

Intune is useful when the list of devices matches the laptops people carry. A compliance policy pointed at an empty enrollment is a diagram.

Talk to the people who own the machines before you write the policy. A device standard that the business will not follow is not a standard.

What to write down

Hygiene that lives only in someone's head does not survive the next vacation.

• The admin list, the emergency-access procedure, and the two or three things that are known-broken and accepted for now.
• Any PowerShell you expect to run again. Put it where the customer can read it, with a comment that says why it exists.

What this is not

This checklist is the baseline a managed service keeps from sliding. A hardening project is what you open when the baseline is not there yet. Those are different pieces of work, and Zesyo scopes them separately.

If you want someone to walk a tenant with this list, write to the practice. Bring what you know. A finished audit is not required to start the conversation.