Dash Curve IT Solutions Enquire
Menu
Start an enquiry Free Microsoft 365 security check
Aerial view of waves breaking along the Surf Coast

Free Microsoft 365 security self-check How exposed is your Microsoft 365?

Ten plain-English questions, about two minutes. You’ll get a score and a short list of what to fix first.

Start the check

Private by design. Your answers stay in this browser. Nothing is sent or tracked, and there’s no sign-up.

Answer for the business as it is today. If you’re not sure, say so: that counts as something worth checking.

01Sign-in · Critical Does every account need a second step to sign in (multi-factor authentication), including the owner’s, admins’ and any old or shared accounts?
Why it matters and how to fix it

Stolen passwords are the most common way into a small business’s email. A second step stops most of those attempts, but one forgotten account without it is enough.

How to fix it: Require MFA for every sign-in with Security defaults or Conditional Access, using the Microsoft Authenticator app or passkeys rather than text messages. Block sign-in on shared mailboxes and remove accounts nobody uses.

02Admin access · Critical Are admin rights limited to a few named people, using separate admin accounts that aren’t used for everyday email and browsing?
Why it matters and how to fix it

An admin account that reads email can be phished like any other, and it holds the keys to everything. Fewer admins means fewer ways in.

How to fix it: Keep Global Administrators to two to four people (Microsoft recommends fewer than five). Give everyone else narrower roles, and use a separate admin-only account for admin work.

03Sign-in · Important Are older sign-in methods (legacy authentication, such as basic sign-in from old mail apps, printers or scanners) blocked?
Why it matters and how to fix it

Legacy authentication can’t ask for a second step, so it lets attackers try passwords while skipping MFA entirely.

How to fix it: Block legacy authentication with Security defaults or a Conditional Access policy. Check first for scanners, old apps or scripts that still send email with a username and password, and move them to a supported method.

04Email · Important Is your domain set up with SPF, DKIM and DMARC, so others can’t easily send email that looks like it came from you?
Why it matters and how to fix it

Without these records, scammers can send invoices and payment requests that appear to come from your own address, to your customers and your staff.

How to fix it: Publish an SPF record listing only the services that send your mail, turn on DKIM signing in Microsoft 365, then add DMARC: start by monitoring reports and move to quarantine or reject once legitimate mail passes.

05Recovery · Important Are your Microsoft 365 email, OneDrive, SharePoint and Teams files backed up to a separate service you could restore from?
Why it matters and how to fix it

Microsoft keeps the service running, but recovering your data is your responsibility. Recycle bins and retention are time-limited and aren’t designed for a ransomware clean-up, a bad sync or a mass deletion.

How to fix it: Add a dedicated Microsoft 365 backup (Microsoft 365 Backup or a reputable third-party service), check it covers every mailbox and site, and test a restore at least once a year.

06Devices · Important Are company laptops and phones managed centrally (for example with Intune), with disk encryption, a screen lock and the ability to wipe them if they’re lost?
Why it matters and how to fix it

A lost or stolen laptop without encryption is a data breach. Unmanaged devices also drift out of date without anyone noticing.

How to fix it: Enrol devices in Intune (included with Microsoft 365 Business Premium), turn on BitLocker or FileVault, set a screen-lock policy, and only let compliant devices reach company data.

07Devices · Important Do Windows, Office, browsers and other apps update automatically, and would you know if a computer stopped updating?
Why it matters and how to fix it

Most attacks use weaknesses that already have a fix. Patching quickly is one of the Essential Eight, and one of the cheapest protections you can have.

How to fix it: Manage Windows and Microsoft 365 Apps updates centrally (for example with Intune update rings), keep browsers on automatic updates, and review a report of devices that have fallen behind each month.

08People · Important When someone leaves, is all their access removed on their last day, following a written checklist?
Why it matters and how to fix it

Former staff accounts are easy to forget and hard to notice when they’re misused. They often still have email, files and shared passwords.

How to fix it: Write a short leaver checklist: block sign-in, sign them out everywhere, remove MFA methods, hand their mailbox and OneDrive to a manager, recover devices and change any shared passwords they knew.

09Files · Good practice Do you know what’s shared outside the business from SharePoint and OneDrive, and are “anyone with the link” links limited or switched off?
Why it matters and how to fix it

Anyone links work for whoever has them, with no sign-in. Over time they quietly accumulate on contracts, staff records and pricing.

How to fix it: Make “people in your organisation” the default link type, give anyone links an expiry or turn them off, and review sharing reports for sensitive sites every few months.

10People · Good practice Do staff know how to report a suspicious email, and would they tell someone straight away if they’d clicked a link they shouldn’t have?
Why it matters and how to fix it

People will occasionally click. What matters is how quickly you hear about it, so a stolen sign-in can be shut down in minutes, not weeks.

How to fix it: Turn on the Report button in Outlook, run a short session on what current scams look like, and make it clear that reporting a mistake quickly is the right thing to do.

Your result

0 of 10 answered

–/100

Answer all ten to see your score.

Your score updates as you go.

Scored in your browser. Nothing is sent unless you add your results to an enquiry and send it.

A quick self-check, not an audit.

The questions cover the Microsoft 365 controls that most often decide whether a small business has a bad week or a bad year: sign-in, admin access, email, backup, devices and people. They draw on Microsoft’s own security guidance and the Australian Cyber Security Centre’s Essential Eight.

Your answers are only as good as what you know about your setup. A Microsoft 365 security review checks the actual settings, records the evidence and ranks every finding, so you know exactly what to fix and in what order.

General information only, not professional advice for your situation. Microsoft features and licence names change over time.

Want the settings checked, not just the answers?

Tell us your team size and what prompted the check. Never send passwords.

Request a Microsoft 365 review
  1. You write a sentence or twoNo need to diagnose it. It comes straight to Shanan.
  2. We reply by emailWith any questions, whether we’re the right fit, and when we could start.
  3. You get a clear next stepPlanned work is quoted before anything starts.