Tenancy, identity and licensing
We take Microsoft 365 past the settings most providers leave alone.
We change the Microsoft defaults that do not suit your business, and match every licence to someone who uses it.
Most Microsoft 365 work starts with one of these.
- You are still paying for licences for people who left months ago.
- A mailbox was compromised, and a forwarding rule was copying mail out.
- Nobody is sure who holds the global administrator account.
If one of these is yours, talk to us before the next renewal.
Contact usWhat we take on.
What we report back
We check the licences you pay for against the people using them, leavers included.
- We review every tenant setting and change the defaults that do not suit you.
- We write access policies that name what they block, with a documented emergency account.
- We match each licence to what the person uses, and take it back when they leave.
- We lock down mail flow and remove rules that forward your mail outside the business.
- We agree the sharing rules, and name an owner for every team and site before they multiply.
- We back up your data separately, and test the restore.
- The tenant and its admin credentials stay registered to you.
Six things a tenancy review usually finds.
Most of the six are defaults Microsoft sets for millions of tenants at once, and they are often wrong for yours.
How multi-factor authentication is enforced
Left as shipped
The defaults apply one sign-in rule to everybody, whatever their job.
Once it is agreed
Staff get the sign-in rule their role needs, and the emergency account can still get in.
How mailboxes are allowed to send
Left as shipped
An older way of sending that needs only a password is often still switched on when we first look.
Once it is agreed
Mailboxes send only in the ways you agreed, with a name and a date against every exception.
Who may grant applications access to your data
Left as shipped
Anyone can give an app standing access to their mail, and it survives a password change.
Once it is agreed
A named person decides which apps get access to your data, and staff have a way to ask for one.
How files are shared outside the business
Left as shipped
A link to a file works for anyone who has it and never expires, and nothing records who opened it.
Once it is agreed
Sharing outside the business follows rules you agreed in writing, which come back for review on a set date.
Whether mail can be copied out automatically
Left as shipped
The block on forwarding mail outside is often lifted for one person and never put back, and the business does not notice.
Once it is agreed
Mail is forwarded outside automatically only for the people named on an agreed list.
Who can create a team, a site or a group
Left as shipped
Anyone can, and each one brings a group, a site and a mailbox with nobody accountable for them.
Once it is agreed
Everything created has an accountable owner and a review date.
All six can be read from the tenant's own admin settings in an afternoon.
Switching on the security defaults.
Microsoft's security defaults are switched on, and the tenant is signed off as done.
They are all or nothing, so the first exception you need means breaking something or switching them all off.
Before you need that first exception, we replace them with settings that fit your tenant and write those into your configuration baseline.
Get in touch and we will take you through a real one.
Contact usQuestions we get asked.
Microsoft keeps the service running and holds a limited recycle bin. Getting back a mailbox deleted eight months ago needs a separate backup.
It can be wrong both ways, and both cost money. We compare each tier with the features people open, then show you what a move would change.
You do, and the tenant is registered to you. We hold a separate named account you can see and remove at any time.
Some will annoy someone, so we stage the changes and tell people first, and anything likely to interrupt work is agreed with you beforehand.
Where this page sits.
Our work sits in three layers, and each one depends on the one beneath it. The page you are reading is marked.
You are hereMicrosoft 365 & Devices
Foundations
Start with the tenant you already have.
The Fortnight looks at each of these settings in your tenant and gives you a written list of what it found. You keep the list whether or not you hire us.
You get a written scope before anybody commits to anything.