A focused review is easier to scope when you know which tenant, settings and devices are involved. You do not need to send passwords or a full export with your first enquiry.
1. Describe what you want checked
Start with the business question. Are you unsure who has administrator access? Do you need a clearer record of MFA settings? Is your device compliance information incomplete? A short outline is more useful than a request to “check everything”.
- Number of Microsoft 365 tenants, users and Windows devices
- Relevant licence plans and your current IT provider, if any
- Whether the Windows devices are already enrolled in management
- Selected checks, deadline and an authorised contact
- Any recent change that affects the agreed review
Microsoft features and available reports depend on licensing and configuration. We confirm what can be reviewed rather than assuming every tenant exposes the same controls.
2. Agree how evidence will be reviewed
Depending on the task, agreed exports or a supervised screen-sharing session may be enough. If direct access is needed, agree the minimum permissions, duration and removal process first. Do not share a personal administrator password.
Keep secrets, recovery codes, employee personal information and unrelated records out of your enquiry. Before sending confidential exports, agree a suitable sharing route and the information needed for the review.
3. Prepare administrator and MFA information
Useful evidence may include the assigned administrator roles, the relevant authentication policy and records available for the agreed accounts. Include the evidence date and any known exceptions.
Registration for MFA and enforcement of MFA are different questions. Microsoft provides security defaults and Conditional Access options; the approach available to your organisation depends on its setup and licences. A review should identify what is actually configured rather than assume that a registered method proves every sign-in is protected.
Microsoft's MFA guidance and security defaults documentation explain these options. They are references, not instructions to change your live tenant during preparation.
4. Choose a representative device sample
Record which devices are included and why. Where available and agreed, useful fields include the operating system, management status, last sync, reported compliance state and the date of the export. Redact identifiers that are not needed.
A five-device sample is not an assessment of every device in a larger business. Keep the sample and any tenant-wide checks clearly separated in the scope and report.
5. Agree what happens after the review
The handover should show the checks performed, the evidence used, any limitations and recommended actions in a practical order. Each action needs a responsible owner before implementation.
- Which findings need clarification before action?
- Who can approve configuration changes?
- Which changes need a separate quote or change window?
- How will new evidence or completed actions be recorded?
Firmword's Microsoft 365 starter review includes selected tenant-wide administrator and MFA checks, plus a sample of up to five enrolled Windows devices. It is a review with findings and a handover. Fixes, migrations, new enrolment and ongoing support are separately scoped.
Larger environments can be quoted individually. The right next step is an agreed scope, not an assumption that every user or device needs the same amount of work.