Account populations
Separate employees, guests, shared identities, service accounts and emergency access because the same authentication rule may not fit each population.
Independent Microsoft 365 review
Trace every important sign-in path before changing policy.
For teams that need to understand whether identity controls cover the people, applications and exceptions that matter—without reducing the answer to a score.
- Before any access
- Written question and scope
- Agreed evidence method
- No automatic tenant changes
Start with the sign-in paths people actually use.
Identity review is not a hunt for one ideal setting. It maps who signs in, from which devices and applications, under which policies, and where an exception changes the expected control.
Authentication methods
Review available and registered methods, recovery paths and known legacy dependencies without treating enrolment alone as proof of effective coverage.
Application paths
Identify browsers, mobile clients, desktop applications, automation and older protocols that may reach Microsoft 365 differently.
Read Conditional Access as a policy system.
A policy can be enabled and still leave an unintended path. The review considers assignments, exclusions, grant controls, session controls and policy interaction together.
Coverage
Compare intended users, roles, applications and conditions with the identities and workloads that must be protected.
Exclusions
Record why an exclusion exists, who owns it, what compensating control applies and when it should be revisited.
Policy interaction
Look for overlapping requirements, gaps between policies and dependencies on device, risk or location signals available to the tenant.
Decide what evidence is enough.
The evidence plan should answer the review question without requesting broad access by habit. Existing exports, policy records and guided read access may each support a different scope.
Configuration evidence
Policy definitions, authentication settings and role assignments establish what the tenant is configured to require.
Operating context
Licence availability, device management, emergency procedures and application constraints explain why a setting exists and what can change safely.
Decision record
The output identifies the observation, affected path, practical options, owner and next decision rather than declaring a generic pass or fail.
Know when identity review is the wrong first move.
A configuration review does not replace incident response, user support or a full identity redesign. The trigger should match the work required.
Active compromise
Containment and incident procedures take priority when suspicious activity is current; a planned review can follow once the immediate response is controlled.
Known implementation project
If the target design is already approved, the need may be implementation and change management rather than independent review.
Everyday access tickets
Password resets and routine user access belong with an operational support desk, not an assurance engagement.
Next step
Define the review before sharing evidence.
Start with the trigger, decision, and known boundaries. Do not send passwords, recovery codes, or tenant exports.