Free tool · No signup

Who is watching your business cloud accounts?

Your office firewall does not describe every Microsoft 365 sign-in. Use this eight-question checklist to identify what your IT provider has confirmed and what still needs an answer.

About three minutes. Choose “not sure” whenever you do not have evidence. No business names, account details or logs are needed; answers remain in this browser tab.

Start with what you know

1. Require MFA for people and administratorsHas your IT provider confirmed MFA coverage for all interactive user and administrator accounts?

2. Separate and limit administrator accessAre administrator accounts separate from everyday email accounts, with only the privileges they need?

3. Review sign-in methods and exceptionsHave legacy authentication and device-code sign-in needs been reviewed, with unnecessary flows restricted?

4. Give cloud alerts a named ownerDoes someone review cloud sign-in and audit alerts and know how long useful evidence is retained?

5. Track new device registrationsAre device registration permissions controlled and unexpected registrations reviewed?

6. Control application consentAre third-party application access and user consent reviewed by an accountable owner?

7. Watch mailbox forwarding and rulesAre unexpected external forwarding, mailbox rules and delegated access reviewed?

8. Practice account recovery and containmentIs there a tested process for reporting a suspicious sign-in and containing unauthorized access?

Use your answers to build a local planning checklist.

Optional next step

Need someone to review the actual settings?

Wolex offers a separately scoped Microsoft 365 security review covering agreed identity, email and logging controls. Start by email; scope and price are agreed before work begins.

See the Microsoft 365 review

If you believe an account is being used without permission right now, contact your IT or security responder promptly. This checklist is not an emergency response service.

Who is watching your business cloud accounts?

Start with what you know

Questions to take to your IT provider

Known gaps

Items to confirm

Reported controls

Need someone to review the actual settings?