Microsoft 365 Tenant Health Check: Identifying Security Risks, Inactive Licenses, and Governance Gaps

Why Regular Microsoft 365 Tenant Audits are Crucial for Australian Organisations

Over months and years of continuous operation, Microsoft 365 tenants organically accumulate technical debt, security configuration drift, and license sprawl. Former employee accounts retain costly active licenses, dormant guest user invites maintain perpetual access to sensitive internal Teams channels, legacy authentication protocols remain unblocked, and default cloud settings leave organizations exposed to session hijacking, business email compromise (BEC), and credential harvesting.

For Australian enterprises, government agencies, and regulated financial entities, an unmonitored tenant poses direct regulatory and financial risks under the Australian Cyber Security Centre (ACSC) Essential Eight guidelines, APRA CPS 234, and the Privacy Act 1988. A structured Microsoft 365 Tenant Health Check systematically eliminates security vulnerabilities while unlocking 15% to 25% in recurring annual license cost savings.

The Four Core Pillars of an Enterprise M365 Health Check

1. License Rationalization & SaaS Waste Reduction

Enterprise license costs escalate quickly when subscription allocations are left unmanaged. Our health check audits tenant subscription consumption using automated Microsoft Graph PowerShell commands to identify immediate cost recovery opportunities:

• Dormant Account Reclaim: Identifying active licenses assigned to disabled, offboarded, or inactive user accounts that have not authenticated within 90 days.
• Redundant License Stacking: Discovering users assigned standalone add-on licenses (e.g. standalone Power BI Pro, Microsoft Defender for Endpoint P2, or Exchange Online Archiving) while already holding an all-inclusive Microsoft 365 E5 or Business Premium suite.
• Right-Sizing SKU Distribution: Evaluating actual feature utilization across knowledge workers to safely transition non-technical staff from top-tier E5 subscriptions to right-sized E3 or Business Premium tiers without sacrificing endpoint security.
• Copilot for M365 Readiness: Auditing user data access boundaries before assigning costly $45 AUD/user/month Microsoft 365 Copilot licenses to prevent accidental oversharing of confidential payroll or executive data. Learn more in our Copilot security audit guide.

2. Identity & Access Hardening (Essential Eight Alignment)

Identity is the primary security perimeter in modern cloud architectures. We evaluate your Microsoft Entra ID (Azure AD) configuration against the ACSC Essential Eight Maturity Model:

• Phishing-Resistant MFA Enforcement: Mandating FIDO2 security keys, Windows Hello for Business, or Microsoft Authenticator with number matching across 100% of internal and guest identities.
• Blocking Legacy Authentication: Completely disabling basic authentication protocols (POP3, IMAP4, SMTP Auth, and ActiveSync) that bypass multi-factor authentication policies.
• Zero Permanent Global Admins: Deploying Microsoft Entra Privileged Identity Management (PIM) to enforce Just-In-Time (JIT) role elevation, mandatory justification logging, and secondary approval gates for high-privilege roles.
• Risk-Based Conditional Access: Enforcing strict conditional access baselines, including compliant device requirements (via Microsoft Intune), trusted corporate IP named locations, and risk-based step-up authentication. Learn how this maps to compliance in our guide on governing M365 under Essential Eight.

3. Data Governance, External Sharing & Oversharing Defense

As organizations collaborate in SharePoint Online, OneDrive, and Teams, data sprawl creates severe compliance exposure:

• External Guest Lifecycle Automation: Configuring automated Microsoft Entra Access Reviews that require team owners to formally recertify external guest access every 60 or 90 days, automatically revoking dormant third-party permissions.
• Anonymous Link Elimination: Disabling "Anyone with the link" anonymous file sharing across sensitive SharePoint sites and replacing them with authenticated specific-people links.
• Microsoft Purview Sensitivity Labels: Deploying automated classification labels (e.g. Public, Internal, Confidential, Highly Confidential) that enforce encryption and prevent forwarding of board papers or customer PII.

4. Email Security & Anti-Phishing Posture

Email remains the primary initial access vector for ransomware and financial fraud in Australia. We inspect your mail routing and anti-spoofing defenses:

• Strict DMARC Policy Enforcement: Transitioning your corporate domains from monitoring (p=none) to active quarantine or rejection (p=reject), paired with cryptographically valid SPF and 2048-bit DKIM records.
• Defender for Office 365 Hardening: Configuring Preset Security Policies (Strict Protection) for anti-phishing, real-time Safe Links URL detours, and Safe Attachments sandbox scanning.
• Automated Mailbox Forwarding Blocks: Blocking external auto-forwarding rules at the tenant transport layer to prevent covert data exfiltration by compromised accounts.

PowerShell Diagnostic Runbook: Uncovering Hidden Tenant Waste

During a technical audit, our cloud engineers execute automated diagnostic scripts across the Microsoft Graph API. Below is a sample PowerShell routine used to isolate inactive licensed users consuming monthly budget without logging in:

Microsoft 365 Security & Optimization Maturity Matrix

Australian Case Study: National Legal Practice Audit

A national commercial law firm with 420 staff across Sydney, Melbourne, and Brisbane engaged Ultron Developments for a comprehensive Microsoft 365 Tenant Health Check. The firm was preparing for an Essential Eight Maturity Level 2 compliance audit required by major institutional banking clients.

Our non-invasive diagnostic audit delivered immediate security and financial outcomes:

• SaaS Waste Recovery: Identified 58 active Microsoft 365 E5 licenses assigned to offboarded contractors and former staff, and eliminated 34 redundant standalone Visio and Power BI subscriptions, saving $44,800 AUD in recurring annual licensing fees.
• Admin Credential Hardening: Reduced permanent Global Administrators from 9 to 0, provisioning Entra PIM with mandatory hardware-token MFA and 4-hour elevation windows.
• Oversharing Containment: Discovered 12 internal legal committee SharePoint sites configured with anonymous sharing links, replacing them with authenticated specific-people permissions and automated sensitivity watermarking.
• Audit Outcome: The firm passed their independent Essential Eight audit with zero non-conformances, enabling them to secure preferred panel status on three tier-1 financial institutions.

Explore our specialized Microsoft 365 consulting services, learn how we govern SharePoint intranets and document repositories, or book an audit directly with our senior cloud engineers.