Administrative roles
Assignments, eligibility and intent behind privileged access.
Include in the scope discussionIndependent IT security review
Choose the areas that need an answer.
Start with the question your organization needs resolved. Evidence requests are then tailored to your tenant, licences and agreed boundary.
- Before any access
- Written question and scope
- Agreed evidence method
- No automatic tenant changes
Scope reference
Every area starts with a question-not a universal checklist.
Authentication
MFA coverage and available authentication methods by role.
Include in the scope discussionEmergency access
Whether recovery arrangements match how the organization actually runs.
Include in the scope discussionCoverage
Users, roles, apps, conditions and intentionally excluded paths.
Include in the scope discussionDependencies
Licences, devices, service accounts and legacy workflows.
Include in the scope discussionDeployment safety
Report-only evaluation, pilot groups and recovery planning.
Include in the scope discussionExchange Online
Protection and authentication settings within scope.
Include in the scope discussionSharing and guests
SharePoint, OneDrive and Teams collaboration boundaries.
Include in the scope discussionApplication consent
Approval paths and administrative consent posture.
Include in the scope discussionNext step
Define the review before sharing evidence.
Start with the trigger, decision, and known boundaries. Do not send passwords, recovery codes, or tenant exports.