RemoteMicrosoft 365 health check
Can you answer these about your Microsoft 365, in writing?
Who holds admin. Whether MFA has gaps. Whether a backup has ever been restored. What you pay for that nobody uses. Most leaders can't say for sure, and most tenants drift without anyone noticing. A health check gives you the answers with evidence.
Read-only. Written for leadership. Yours to keep.
- Twelve questions, with evidence
- Ranked fixes
- Vendor-neutral
Reviewed by Blake Bath, General Manager, on 31 October 2026.
What we look at
Six areas, each with evidence.
The same questions whoever manages your tenant.
Identity
Who can sign in, from where, and as whom.
- Admins
- MFA
- Break-glass
Conditional Access
The real security boundary, and where it's drifted.
- Policies
- Devices
- Locations
Backup
An independent, tested copy outside the tenant.
- Coverage
- Restores
- Retention
Licences
Paying for what you use, and using what you pay for.
- Leavers
- Features
- Overlap
Data location
Where it lives and which privacy rules apply.
- Region
- Labels
- APPs
Governance
A review rhythm that outlives any provider.
- Quarterly
- Secure Score
- Runbook
Tenant self-check
Twelve questions, and the evidence behind each.
Tick only what you could prove today. The evidence you'd need is listed under each one.
Tick only what you could prove today with the evidence listed. If you'd have to ask someone, leave it unticked.
Where you stand
0of 12 answers in place
12 gaps to close.
- We know who holds Global AdministratorEvidence: privileged role report.
- MFA is enforced for every user, admins includedEvidence: authentication methods report.
- Break-glass accounts are documented and testedEvidence: break-glass procedure and last test date.
- Conditional Access policies are written downEvidence: policy export, reviewed quarterly.
- Unmanaged devices can't reach sensitive dataEvidence: device compliance policies.
- Microsoft 365 data is backed up outside the tenantEvidence: backup vendor and retention policy.
- A restore has been tested and datedEvidence: last restore log.
- No licences sit on people who've leftEvidence: licence assignment report.
- Paid security features are switched onEvidence: Secure Score and licence use.
- Sensitive content is labelledEvidence: sensitivity label policy and use.
- There's a quarterly governance reviewEvidence: the last four sets of minutes.
- There's an incident plan for the tenantEvidence: Microsoft 365 incident runbook.
Identity and access
Identity is the front door.
- Global AdministratorsNamed people, separate admin accounts, and no vendor with standing rights you didn't agree to.
- Legacy authentication blockedOld sign-in methods that skip MFA turned off unless something genuinely needs them.
- Overseas sign-ins challengedBlocked, or stepped up, depending on how your people work.
- Device rulesSensitive data only on compliant devices.
Backup
Recovery is your job, not Microsoft's.
Microsoft keeps the service running. Getting data back after a mistake, an attack or a departed staff member is on you. Deleted user accounts only stay recoverable for about 30 days, so anything you need to keep longer needs its own backup.
- Independent copyOutside the tenant, with retention that matches your record-keeping.
- Tested restoreDated and signed off.
- Leaver retentionPlanned before the account is deleted.
Licences
Most tenants carry licences they don't need.
- The right mixBusiness Basic, Standard, Premium or E-plans, matched to what people actually do.
- Features switched onDefender, Intune and Conditional Access used, not just paid for.
- No double-payingThird-party tools that duplicate what you already license.
Data and privacy
Where your data lives is a leadership question.
Privacy Act obligations attach to the data, not the platform. The check confirms your tenant's region, what Microsoft's Australian data residency commitments cover (including Copilot), and whether sensitive content is labelled.
- Tenant regionConfirmed from the tenant itself.
- Copilot and AIWhat's covered by Microsoft's data residency commitments.
- Sensitivity labelsOn financial, HR and client records.
Microsoft Learn, data residency for Microsoft 365 Copilot, checked 30 October 2026.
How it runs
Read-only, start to finish.
- Step 1Read-only access
No changes made.
- Step 2Evidence pulled
From the tenant, not a questionnaire.
- Step 3Written report
Each question answered, ranked fixes.
- Step 4Walk-through
With leadership and whoever runs IT.
Related
The check finds it. These keep it right.
Where most health checks lead.
Get help your way
Six ways to reach us. Pick whichever suits you.
Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.
- Call 07 3114 2808
An engineer answers Monday to Friday, 8am to 5pm AEST. After hours, weekends and public holidays, Chip, our AI agent, answers on the same number or on 07 3180 0965, logs it and escalates urgent incidents to the on-call engineer.
Call now - Email the helpdesk
Send it to helpdesk@realbytes.com.au and a ticket is logged straight away, with a reference number you can quote.
Email us - Client portal
Log and follow your tickets, see what we are working on and who has it.
Open the portal - Remote support
When an engineer asks to see your screen, start a secure session here. You start it, so nobody sees your screen until you do.
Start a session - Chat in Microsoft Teams
Clients can message Chip, our AI assistant, in Teams to log a request without leaving their desk.
How clients reach us - Service status
Check whether Microsoft 365 or another cloud service is down before you lose an hour troubleshooting.
See live status
Questions
What leaders ask about a tenant health check.
Who is this for?
Directors and managers who need to know their Microsoft 365 is in order without reading admin consoles. Every question here should have a written answer and a piece of evidence.
Doesn't Microsoft back up our data?
Microsoft runs the platform and keeps it available. Getting your data back after a deletion, a ransomware attack or a leaver whose account has gone is your job. Deleted user accounts only stay recoverable for about 30 days.
Where is our data stored?
Most Australian tenants are in Microsoft's Australian data centres. Australian tenants are also covered by Microsoft's data residency commitments for Copilot in its Product Terms. We confirm your tenant's location and what's covered during the check.
How long does the health check take?
It's narrower than a full cyber security audit, so it's quicker. We give you a timeline with the quote, based on your tenant's size.
What do we get?
A written answer to each question, the evidence behind it, and a ranked list of what to fix first. It's yours to keep, whoever fixes it.
Next step
Want written answers?
Book a health check. Read-only, and the report is yours.
Keep reading
- Managed Microsoft 365 Service.
- Cyber security audit Service.
- Copilot deployment Service.
- Contact Talk to us.
Reviewed by Blake Bath, General Manager, on 31 October 2026. Checked 30 and 31 October 2026. Microsoft Learn, data residency for Microsoft 365 Copilot