How secure is your Microsoft 365 setup?

Ten plain-English questions covering the security basics every UK SME should have in place. No technical knowledge needed. If you are not sure of an answer, that is an answer in itself.

Ten questions, about 3 minutes

Instant score with a practical action plan

Results emailed to you to share with your team

0 of 10 answeredAbout 3 minutes

1
Multi-factor authentication
Is multi-factor authentication (MFA) enforced for every user account, including administrators?
2
Conditional access
Do you restrict sign-ins based on location, device, or risk using conditional access policies?
3
Admin accounts
Are day-to-day accounts kept separate from admin accounts, with admin access limited to those who need it?
4
Device encryption
Are all laptops and desktops encrypted, for example with BitLocker?
5
Patching
Are operating systems and applications patched automatically within a defined timescale?
6
Endpoint protection
Do all devices run managed endpoint protection that someone actually monitors?
7
Backups
Is your Microsoft 365 data (email, SharePoint, OneDrive) backed up outside Microsoft, and are restores tested?
8
Leaver process
When someone leaves the business, is their access removed the same day through a documented process?
9
Phishing protection
Do you have anti-phishing protections in place, and have staff had any security awareness training?
10
Monitoring & alerts
Would you know within hours if one of your accounts was compromised?

Get your score and action plan

Once you have answered all the questions above, tell us where to send your results.