Inherited Microsoft 365 tenant review after M&A or handover
An inherited Microsoft 365 tenant review is a configuration review of a tenant you have taken over through a merger, an acquisition, or a change of IT provider or ownership. It answers the questions a new owner faces first: who holds administrative access, which partners and applications can reach your data, and whether activity is recorded.
Microsoft guidance the review checks your tenant against
These points come from Microsoft’s public documentation on Microsoft Learn, starting with who can administer the tenant. The review checks how your inherited tenant compares with each one.
Do the critical first-stage privileged access items right away
What the review checks: Whether Privileged Identity Management is in use, who holds Global Administrator, Privileged Role Administrator, Exchange Administrator, and SharePoint Administrator, whether at least two emergency access accounts exist, and whether multifactor authentication is required for those administrators.
“We recommend that you do these few items right away within the first 24-48 hours to ensure a basic level of secure privileged access.”
Securing privileged access for hybrid and cloud deployments in Microsoft Entra ID, Microsoft Learn Licensing: Privileged Identity Management requires Microsoft Entra ID P2 or Microsoft Entra ID Governance, and Microsoft Entra ID P2 is included in Microsoft 365 E5.
Remove accounts that no longer need highly privileged roles, then categorize the rest
What the review checks: Assignments for Global Administrator, Privileged Role Administrator, Exchange Administrator, and SharePoint Administrator, categorized as Microsoft lists them, such as shared, break-glass, automated script, or external user accounts. Accounts tied to a former provider, former IT owner, or departed staff are flagged.
“Remove any accounts that are no longer needed in those roles.”
Securing privileged access for hybrid and cloud deployments in Microsoft Entra ID, Microsoft Learn Use the Partner relationships page to find partners with delegated admin privileges
What the review checks: Every partner under Settings > Partner relationships in the Microsoft 365 admin center, whether it holds delegated or granular delegated admin roles, and whether former providers still do.
“Instead, they should use the Partner relationships page in the Office 365 Admin Portal to find out whether a delegated administration privilege has been assigned to a partner.”
Get delegated administration privileges from a customer, Microsoft Learn Confirm auditing is on, since it isn’t enabled by default for SMB licenses
What the review checks: Whether auditing is actually turned on, checked in Exchange Online where the agreed access allows, since Microsoft notes that UnifiedAuditLogIngestionEnabled always shows False in Security & Compliance PowerShell. In the Microsoft Purview portal, a ‘Start recording user and admin activity’ banner means auditing is off.
“Auditing isn't enabled by default for Small and Medium Business (SMB) licenses, including Microsoft 365 Business Basic, Business Standard, and Business Premium.”
Turn auditing on or off, Microsoft Learn Licensing: Audit data retention depends on audit log retention policies and the license assigned to users.
Keep two or more cloud-only emergency access accounts on the *.onmicrosoft.com domain
What the review checks: Whether two or more exist with Global Administrator assigned permanent active, use a phishing-resistant method different from normal admin accounts, are excluded from Conditional Access policies that block or restrict sign-in, raise alerts when used, and were validated within 90 days.
“Create two or more emergency access accounts. These accounts should be cloud-only accounts that use the *.onmicrosoft.com domain and that aren't federated or synchronized from an on-premises environment.”
Manage emergency access accounts in Microsoft Entra ID, Microsoft Learn Confirm admin accounts are in use and that shared admin passwords were changed recently
What the review checks: For each admin account, the last sign-in and last password change dates, multifactor authentication registration, and a working email address. Shared admin accounts are identified, and passwords not changed since the handover are flagged as possibly known to a previous provider or former IT staff.
“Ensure all users have signed into their administrative accounts and changed their passwords at least once in the last 90 days. Also, verify that any shared accounts have had their passwords changed recently.”
Securing privileged access for hybrid and cloud deployments in Microsoft Entra ID, Microsoft Learn Prioritize cleaning up unused or over-privileged accounts
What the review checks: Privileged and guest accounts with no recent successful sign-in or none at all, admin roles still held by leavers from an acquired company or former provider, and, where licensed, whether Microsoft Entra ID Governance access reviews are set up.
“How you address inactive users depends on your scenario, but cleaning up unused accounts or over-privileged accounts should be your priority to reduce security risks.”
How to detect and investigate inactive user accounts, Microsoft Learn Licensing: Reading lastSuccessfulSignInDateTime through Microsoft Graph requires Microsoft Entra ID P1 or P2.
Allow user consent only for apps from verified publishers
What the review checks: The current user consent setting and, for applications already in the tenant, the permissions granted through admin consent and user consent, including grants made under previous ownership.
“To reduce the risk of malicious applications attempting to trick users into granting them access to your organization's data, we recommend that you allow user consent only for applications that have been published by a verified publisher.”
Configure how users consent to applications, Microsoft Learn Examine cross-tenant sign-in behavior before changing cross-tenant access settings
What the review checks: Default inbound and outbound settings, each organization under Organizational settings, inbound trust settings, automatic redemption, and inbound cross-tenant sync. The Microsoft Entra audit log is filtered on CrossTenantAccessSettings to see who changed them where retained logs allow, and compared with cross-tenant sign-in activity.
“To ensure you don’t remove access that your users and partners need, you should examine current sign-in behavior.”
Overview: Cross-tenant access with Microsoft Entra External ID, Microsoft Learn Licensing: Configuring trust settings, or scoping access to specific users, groups, or applications, requires Microsoft Entra ID P1 on the tenant being configured.
What the review covers in an inherited tenant
The review concentrates on what a new owner needs to know first: who can administer the tenant, what can reach its data, and whether activity is recorded. Other control areas can be added when agreed during scoping.
Part of the audit's identity and access and applications and consent and logging and monitoring areas.
- Administrative role holders
- Who holds Global Administrator and the other highly privileged roles, which of those accounts are shared, external, or used by automated scripts, and which are tied to a former provider, a former IT owner, or departed staff.
- Partner and delegated access
- Partners listed on the Partner relationships page in the Microsoft 365 admin center, the delegated or granular delegated admin roles they hold, and whether a former provider still holds any.
- Emergency access and administrator sign-in
- Whether emergency access accounts exist and can be used, and whether administrators are registered for multifactor authentication and required to use it.
- Conditional Access as inherited
- Conditional Access policies, their exclusions and their gaps as previous administrators left them, and whether security defaults are turned on.
- Inactive privileged and guest accounts, and cross-tenant access
- Privileged and guest accounts with no recent sign-in, admin roles still held by leavers, and the cross-tenant access settings that connect the tenant to other organizations.
- Application consent and permissions
- The user consent setting, permissions granted to enterprise applications under previous ownership, and app registrations whose credentials or owners nobody can account for.
- Audit logging and retention
- Whether auditing is turned on, how long audit data is kept, and whether sign-in and audit logs are available to investigate activity from before the handover.
- Alerts and who receives them
- Alert policies, and whether their notifications still go to a previous provider or a departed administrator.
When teams ask for it
- After an acquisition or merger
- Your organization now owns a tenant that someone else configured, and needs to know who can administer it and how it connects to your own before integration decisions are made.
- When changing IT provider
- An outgoing provider may still hold admin roles, a partner relationship, or shared credentials, and the incoming team needs an independent baseline before taking responsibility.
- When the tenant’s administrator leaves
- The person who built and ran the tenant has gone, and the remaining administrators are not certain which accounts, applications, and settings were left in place.
- Before deciding on tenant consolidation
- An inventory of administrators, applications, and cross-tenant connections helps owners decide whether and how to consolidate. The review provides that inventory.
What you receive
Each finding is reported with the configuration evidence behind it, its business context, and a recommended action. Findings are sequenced into a remediation roadmap, so your team knows what to change first.
Questions
We have just taken over a Microsoft 365 tenant. What should we check on day one?
Start with who can administer it. Microsoft’s privileged access roadmap lists a few critical items to do right away: start using Privileged Identity Management, identify and categorize accounts in highly privileged roles, define at least two emergency access accounts, and require multifactor authentication for administrators. Microsoft notes that this guidance assumes Microsoft Entra ID P2 licenses, and that some of it might not apply without them.
The review checks the tenant against each of these, alongside partner access, application consent, and audit logging.
How do we find out who has Global Administrator in our Microsoft 365 tenant?
In the Microsoft Entra admin center, browse to Entra ID > Roles & admins, open the Global Administrator role and select Assignments to list who holds it. Microsoft recommends assigning the role to fewer than five people.
Partners can also hold delegated administration privileges. Microsoft directs customers to the Partner relationships page in the Microsoft 365 admin center to see which partners have them, so the review checks that page as well and flags any role holder tied to a former provider, a former IT owner, or departed staff.
What access does the review need to an inherited tenant?
Access is agreed during scoping, before the engagement starts: which roles are involved, who grants them, and how long access lasts.
Access follows least privilege and is time-bound, and read-oriented roles are preferred wherever the assessment method allows. For an inherited tenant, scoping also confirms who is currently able to grant that access.
Will the review remove former administrators or change our settings?
Not without your agreement. The review examines and reports on configuration, including accounts, partners, and applications that may need removing.
Whether the engagement includes any remediation, and who carries it out, is agreed during scoping before work begins.
Do we need particular Microsoft licenses for this review?
No particular license is needed to request the review. Licensing does determine which controls exist in the tenant, so some are reviewed only where licensed.
For example, Microsoft states that Privileged Identity Management requires Microsoft Entra ID P2 or Microsoft Entra ID Governance, and that configuring cross-tenant trust settings requires Microsoft Entra ID P1. Findings state where a recommendation depends on a license the tenant may not have.
How long does the review take, and what does it cost?
Both follow from scope. Timing and pricing depend on the size and complexity of the tenant, the control areas included, and the deliverables you need.
Scope, timing, and pricing are all confirmed in writing before the engagement starts.
Get a clear view of your tenant’s configuration.
Tell us about your environment and the questions you need answered. We’ll help define an appropriate assessment scope.
Discuss your audit