IT Support
What a Microsoft 365 tenant review actually finds in a Portsmouth SME
Shared admin passwords, mailboxes for people who left, and MFA with a hole in it. The unglamorous list we walk before anyone talks about “the cloud”.
Most Portsmouth SMEs already pay for Microsoft 365. Very few have anyone who can say, without guessing, who still has a mailbox, who is a Global Admin, and whether MFA is actually on. That gap is where phishing, invoice fraud and “we cannot get into email because Dave left” all start.
A tenant review is not a licence upsell. It is a morning looking at the directory, Exchange, SharePoint, Teams and Entra ID, then a written list. If you already know you want that owned month-to-month, that is managed IT support — this article is what we look at before anyone signs.
1. Shared passwords and a Global Admin called “Office”
We still find a single admin account whose password lives in a notebook, a WhatsApp chat, or the office manager’s browser. Everyone who ever set up a PC used it. When that password leaks, it is not one mailbox — it is the tenant. The fix is named admins, MFA on every privileged account, and no shared “Office” login. It is unglamorous. It closes the hole that ransomware crews actually use.
2. Leavers who still get the client email
Exchange keeps a mailbox until someone deletes or converts it. In a 25-person firm that has turned over quietly for three years, that can mean a dozen live mailboxes for people who no longer work there — some still in distribution lists, some still with SharePoint access. A tenant review lists them. Disabling the account is the same afternoon. Keeping the mail in a shared mailbox, if you still need the history, is a choice you make on purpose rather than by neglect.
3. MFA that is “on”, except where it is not
Microsoft 365 security defaults and Conditional Access are easy to believe you finished. Then you find SMTP AUTH still on, a legacy IMAP client, or a VIP who was excluded “just for the week”. Those exclusions last years. For anyone bidding on public-sector or NHS supply-chain work, this is also the Microsoft 365 half of Cyber Essentials. We turn on MFA for everyone who can read mail or open a file — including the owner who hated the authenticator app.
4. Sharing links that never expire
SharePoint and OneDrive “anyone with the link” is how a Portsmouth accountant sends a pack to a client once, and how that pack is still on the open internet eighteen months later. A review shows anonymous links, external guests, and Teams that include personal Gmail accounts. You do not have to lock the business into a fortress. You do have to know what is shared, and stop the ones that should have died with the project.
5. Licences you pay for and licences you needed
Unused E3 seats, Business Basic on a machine that should have Intune, no backup product at all. Microsoft 365 is not a backup. Recycle Bin is not a backup. If a mailbox is emptied or ransomware encrypts SharePoint, you need a copy that is not in the same tenant. A review says which licences you can drop, which you should upgrade, and whether email and OneDrive are actually being copied off-tenant.
6. Devices that are in the tenant, and devices that are not
Home laptops, a director’s personal Mac, a forgotten Surface in a drawer — all may have synced mail. None may be in Intune. That is how a lost device keeps a live Outlook session. Portsmouth firms that think “we only have office PCs” are usually wrong by three or four endpoints. This is the same conversation as choosing IT support in Portsmouth: who owns the estate when something walks out of the building.
What you get at the end of the review
A short document: findings, what we already fixed, and what should wait for a proper project (SharePoint information architecture, a full backup product, Cyber Essentials). No forty-page slide deck. For a typical Hampshire SME the first pass is hours. Living with the tenant afterwards — patching, leavers, licence hygiene — is the managed contract, if you want one.
If you only do three things this month
Turn on MFA for every account that can read email. Disable every leaver. Take Global Admin away from the shared office login. Those three steps kill most of the incidents we still see in Portsmouth. If you want the rest checked — sharing, backup, Intune, Cyber Essentials — call 02394 331 999 or use the form. We will tell you what is actually wrong in your tenant, including if the answer is “you are in better shape than you think”.