How to run a health check on your Microsoft environment

You feel healthy, you sleep fine and you get to work. You haven't had your blood pressure checked in years, and why would you? High blood pressure can't be felt. You only notice it the day it turns serious, and by then it takes much longer to recover. Your Microsoft environment, or tenant as it's called in technical terms, works the same way. You fix what is most urgent, like a new hire who needs to get started, an application that isn't working or access someone needs today, so the wheels keep turning. That's the right priority. The aches you suspect are there are left alone, because they never become urgent on their own.

That's why it pays to get checked before something hurts. What you find early is a small adjustment. What you find late can turn into a long cleanup, and in the worst case the auditor finds it first, or even worse, someone who shouldn't have been there. A health check of your environment follows the same recipe as at the doctor, just without the waiting room and the magazines from 2019: first a review of the history and where things stand today, then measurements, test results and finally a plan.

Medical history: how you got here and where you are today

The doctor starts with your history. For your environment, that means how long it has existed and who lives there: employees, guests, apps and now AI agents, each of which came in its own way. An environment that has existed for eight years has collected eight years of changes. Most of it came in because someone needed it there and then, and ownership usually came last. The result is a gap between what you think is in the environment and what is actually there. Bsure has been checking customers' environments for three and a half years, and we have yet to meet one without such a gap, not even the ones who exercise and eat well. On average, around 40 percent of identities are inactive. The question is how big the gap is in yours.

Why now? The doctor always asks about major changes, because that's when the body is exposed to something new. Your environment is in the middle of one right now: AI agents. They can be built without code, act on their own, have their own keys and often show up without an owner. They also inherit everything that is already there, so every standing admin right and every app without an owner becomes part of the ground the agents stand on. New diseases call for new tests, and this one is unlikely to be the last. On top of that, smaller changes that require action keep coming, like SMS codes, a vaccine many rely on, expiring in February 2027.

The measurements: why you should measure several things

The doctor takes a blood test with many values at once, because one value on its own rarely tells you enough. It's when several are off at the same time that the picture becomes clear. Your environment is the same, and you don't need to be a doctor to read the results. The measurements belong in three areas, and each area hurts in its own way.

Security is about who can make big changes in the environment, and how well they are protected. This is where you find the number of global administrators, administrators whose rights are standing all the time, and external guests, such as consultants, who have been given admin rights in your organization.

Compliance is about ownership and about what should have been gone long ago: old guest access, guests without a sponsor, and applications and agents without an owner.

Cost is about licenses you pay for without using: unassigned seats, licenses on people who haven't signed in for 90 days, and licenses on disabled accounts. It's also the part that pays for the rest of the treatment.

Often the same finding hits all three. An account nobody uses can be a way in, something nobody is responsible for and a license that costs money every month.

The test results: where you should start

At the doctor, you get your test results with some values flagged as too high or too low, and you deal with the most important first. Here is how to do it with your environment:

1. Start with who can make big changes. Count the global administrators, where good practice is two to four, and see who has their admin rights standing all the time.

2. Make sure everyone is vaccinated. All employees should have MFA, meaning an extra confirmation when they sign in. One account without it is enough to let the infection in, and SMS codes are a vaccine that expires in February 2027.

3. Find what nobody owns or uses. Apps and AI agents without an owner, guests nobody is responsible for, and licenses on accounts that aren't in use.

If you want to go deeper, we have written about the five most important things to check in the article "5 things the best IT leaders know about their Microsoft tenant".

Remember that the danger often lies where several small findings sit on the same account. An account that hasn't been used for six months is nothing. An account that hasn't been used for six months, belongs to someone who has left, still has admin rights and is only protected by a phone number, is an open door.

How do you do it in practice?

The list above is easy to read, but harder to answer. You can click through the portal or put together reports from several places. Or you can run our health check, completely free. It goes through everything on the list in under five minutes and needs one consent from an administrator. It only reads, and your data never leaves your browser.

Take the health check at healthcheck.bsure.io

Maybe you won't find anything dramatic. Then you'll know, instead of just believing it.

The treatment plan

The health check shows the symptoms. Which findings are connected, what you should tackle first and who should own it is the diagnosis and the treatment plan, and that is what Bsure does. If you want it, we're happy to go through the test results with you in 30 minutes, in your own environment.