Updated 8 October 2026: Microsoft is retiring Restricted SharePoint Search, so this post now points to Restricted Content Discovery and SharePoint Advanced Management instead.
Why a 60-minute health check is worth your time
A full Microsoft 365 tenant audit is a two-to-three-week engagement. A 60-minute self-directed health check, however, is enough to surface the top five remediation actions and decide whether Microsoft 365 Copilot is safe to roll out. The ACSC Cyber Security Guidance for Microsoft 365 (Australian Cyber Security Centre — system hardening and administration guidance, accessed 16 June 2026, current May 2026) directs Australian organisations to review tenant configuration at least quarterly — this walkthrough is the minimum credible answer to that direction.
You will need: Security Reader access (minimum) across Microsoft Entra admin centre, Microsoft Defender portal, Microsoft Purview, SharePoint admin centre, and Microsoft Intune admin centre. Allow a Global Administrator on standby for any actions you decide to take immediately.
1. Minutes 0 to 5 — set the baseline
Open the Microsoft Defender portal → Exposure management → Secure Score. Capture three numbers and screenshot the page for your evidence pack:
- Current Secure Score percentage
- 30-day trend
- Top five recommended actions by point value
A low Secure Score indicates foundational identity and data controls are missing. Microsoft does not publish a specific Secure Score cut-off for Microsoft 365 Copilot readiness, so treat the score as one signal among the identity, data, and tenant checks below rather than a single go/no-go number.
2. Minutes 5 to 25 — Identity Hygiene pillar
This is where most Australian SMB tenants leak points. Walk these five checks in order.
Check 1: MFA coverage
Microsoft Entra admin centre → Identity → Authentication methods → Activity → Registration. Confirm:
- Percentage of licenced users with MFA registered (target 99 percent or above)
- Any service accounts without MFA — flag for Conditional Access exclusion review
# Quick MFA gap analysis
Connect-MgGraph -Scopes "Reports.Read.All"
Get-MgReportAuthenticationMethodUserRegistrationDetail -All |
Where-Object { $_.IsMfaRegistered -eq $false -and $_.UserType -eq 'Member' } |
Select-Object UserPrincipalName
Check 2: Legacy authentication blocked
Microsoft Entra admin centre → Identity → Monitoring → Sign-in logs → filter Client app = Other clients (legacy authentication clients). Any sign-ins in the last 30 days are a finding. Credential abuse against legacy authentication — which cannot enforce MFA — remains a commonly reported initial-access pattern against Australian organisations.
Check 3: Conditional Access baseline policies
Microsoft Entra admin centre → Protection → Conditional Access. Confirm at minimum:
- Require MFA for all users (enforced, not report-only)
- Require MFA for administrators
- Block legacy authentication
- Documented break-glass exclusion register
If Security Defaults is still enabled instead of named Conditional Access policies, that is a finding — Security Defaults are appropriate for very small tenants only, and not for SMBs preparing for Copilot.
Check 4: Privileged role count
Microsoft Entra admin centre → Roles & admins → All roles → Global Administrator. Confirm:
- Fewer than 5 permanently-assigned Global Administrators (ACSC Restrict Administrative Privileges baseline)
- Privileged Identity Management (PIM) eligible-only assignments where possible
The ASD Information Security Manual Guidelines for Personnel Security (Australian Signals Directorate — Information Security Manual, accessed 16 June 2026, November 2025 update) require privileged accounts to be just-in-time activated and reviewed.
Check 5: Sign-in risk policy
Microsoft Entra admin centre → Protection → Identity Protection → Sign-in risk policy. Confirm a policy exists that requires MFA for medium risk and blocks high risk for at least all administrators. Requires Entra ID P2 — note as a finding if licensing is not present.
3. Minutes 25 to 45 — Data Classification pillar
Check 6: Sensitivity label coverage
Microsoft Purview → Information Protection → Labels. Confirm:
- At least three labels published (e.g. Public, Internal, Confidential)
- Default label applied
- Auto-labelling configured for sensitive information types (Australian TFN, Medicare, credit card)
Microsoft Purview Content Explorer cannot show you what data lives where until labels are applied. The OAIC's APP 11 guidance (Office of the Australian Information Commissioner — Australian Privacy Principles, accessed 16 June 2026) requires Australian organisations to know what personal information they hold.
Check 7: DLP for Australian PII
Microsoft Purview → Data loss prevention → Policies. Confirm at least one policy covers:
- Australian Tax File Number (predefined sensitive information type)
- Australian Medicare card number
- Credit card
Confirm policies are in Enforce mode (not just Test mode) for at least Exchange and SharePoint.
Check 8: Retention policies
Microsoft Purview → Data lifecycle management → Retention policies. Confirm Exchange and SharePoint retention is configured. According to Microsoft Learn (retention policies documentation), retention is the foundation Copilot relies on to avoid surfacing time-expired content.
Check 9: External sharing defaults
SharePoint admin centre → Policies → Sharing. Confirm:
- Tenant-level sharing is set to "Existing guests" or tighter, not "Anyone"
- "Anyone" links (if used at all) have an expiry of 30 days or fewer
- Guest expiration is configured
4. Minutes 45 to 60 — Tenant Configuration pillar
Check 10: SharePoint oversharing and Restricted Content Discovery status
In the SharePoint admin centre, run the SharePoint Advanced Management data access governance reports. Confirm whether the tenant has completed a SharePoint permissions remediation programme and, for high-risk sites that have not been fixed yet, whether Restricted Content Discovery (Microsoft Learn — Restricted Content Discovery, accessed 8 October 2026) is applied. Restricted Content Discovery is a temporary control that keeps a site's content out of organisation-wide search and Copilot responses without changing permissions; it should be removed once access is fixed.
Restricted SharePoint Search is retiring, with new enablement blocked from 31 July 2026, so tenants that already use it should plan to disable it after validating permissions. A walkthrough specifically for Australian tenants is in Restricted SharePoint Search is retiring: what Australian tenants should do.
Check 11: Microsoft Office macro hardening
Microsoft Intune admin centre → Devices → Configuration → Settings catalogue → Microsoft Office macro policies. Confirm macros are blocked by default and only signed-by-trusted-publisher macros are permitted (ASD ISM Guidelines for System Hardening, November 2025).
Check 12: Defender for Office 365 preset policies
Microsoft Defender portal → Email & collaboration → Policies & rules → Preset security policies. Confirm:
- Standard preset enabled tenant-wide (Anti-phishing, Safe Links, Safe Attachments)
- Strict preset enabled for executives and high-value targets
Microsoft Learn (preset security policies, current 2026) describes Standard and Strict presets as the recommended starting point for SMBs.
Check 13: Annual baseline review
Confirm the date of the last documented tenant baseline review. The ACSC Cyber Security Guidance for Microsoft 365 directs an annual review at minimum.
5. Output — the one-page tenant health summary
The 60-minute walkthrough should produce a single page (literally one page) for your CISO or IT manager:
- Secure Score: current percentage and trend
- Identity Hygiene status: Green / Amber / Red against the five identity checks
- Data Classification status: Green / Amber / Red against the four data checks
- Tenant Configuration status: Green / Amber / Red against the four tenant checks
- Top 5 remediation actions: ranked by Secure Score points per hour of effort
- Copilot readiness verdict: Ready / Conditional / Not ready, against your documented identity and data baseline
6. Before and after — what changes in one quarter
Before the first 60-minute health check (typical Australian SMB tenant):
- No documented tenant baseline
- Five-plus Global Administrators permanently active
- MFA coverage unknown
- Legacy authentication permitted
- Sensitivity labels never deployed
- SharePoint oversharing reports not run
- Copilot pilot blocked or risky
After one quarter of focused remediation driven by the health check output:
- Documented quarterly baseline review
- Three Global Administrators, all PIM-eligible
- 99 percent MFA coverage
- Legacy auth blocked tenant-wide
- Three sensitivity labels live with default applied
- Oversharing reports run, with Restricted Content Discovery on high-risk sites while access is fixed
- Copilot cleared for pilot to 50 users
Organisations that complete Microsoft-recommended baseline hardening materially reduce their exposure to identity-based compromise, which remains one of the most common initial-access vectors reported against cloud tenants.
7. Common pitfalls during a self-directed health check
- Pitfall: Looking at Secure Score in isolation. Without identity, data, and tenant pillar scans, Secure Score is a number without context.
- Pitfall: Marking findings green based on configuration alone. A policy in report-only mode is not enforced. Verify enforcement, not creation.
- Pitfall: Not capturing screenshots. Quarterly evidence packs are the easiest ACSC Essential Eight ML2 audit win. Capture screenshots as you go.
- Pitfall: Treating "Anyone" links with 90-day expiry as safe. OAIC guidance is clear — external sharing without governance is a notifiable breach risk.
8. Australian compliance alignment
Privacy Act 1988 APP 11 (Security): A documented quarterly tenant health check is direct evidence of reasonable steps to protect personal information.
ASD Essential Eight Maturity Level 2: The identity and tenant configuration checks cover MFA (Control 7), Restrict Administrative Privileges (Control 5), and Microsoft Office macro settings (Control 3) evidence requirements.
ACSC Cyber Security Guidance for Microsoft 365: Quarterly review cadence satisfied.
Call to action
The 60-minute self-directed health check is the cheapest tenant-health investment an Australian SMB can make. Run it quarterly. Capture the evidence. Act on the top five findings before the next quarter.
Next steps:
- Take the free Microsoft 365 Health Check — a 15-question version of this walkthrough that produces an instant RAG scorecard
- Read the pillar Microsoft Secure Score for Australian SMBs
- Read Restricted SharePoint Search is retiring: what Australian tenants should do
- For a practitioner-led review, book the AI-Ready Microsoft 365 Health Check
Sources referenced in this article: ACSC Cyber Security Guidance for Microsoft 365; ASD Information Security Manual; OAIC APP 11 guidance; Microsoft Learn Restricted Content Discovery; Microsoft Learn (Microsoft Secure Score documentation); Microsoft Learn (preset security policies); Microsoft Learn (retention policies documentation).
