Seven Security Checks Your MSP Should Already Have Done

Published: 12 June 2026 · Updated: 6 October 2026

A managed IT provider should do more than answer tickets and renew licences. If they are responsible for your systems, they should be able to show what they have done to reduce obvious risk.

The list below is not everything. It is the sort of baseline that should already be in motion for any SME with ten or more staff, and every item on it is something a competent provider can evidence in an afternoon.

1. MFA and Conditional Access are actually enforced

There is a difference between “MFA is available” and “MFA is enforced sensibly across the organisation”. Conditional Access should reduce risky sign-ins, protect admin roles and avoid lazy blanket exceptions that quietly become permanent.

Know which tool you’re entitled to. Security defaults are free and switch on sensible protection for everyone, but they’re all-or-nothing. Conditional Access lets you tailor the rules, and needs Entra ID P1, which is included in Business Premium. You can’t run both at once, so a tenant with neither switched on has no excuse.

2. External mailbox forwarding is blocked

Mailbox forwarding is a favourite route for data theft and invoice fraud: an attacker gets into one mailbox and quietly sets a rule sending everything to an outside address. Microsoft has blocked automatic external forwarding by default in newer tenants, but older tenants, and settings nobody ever set explicitly, can still allow it (Microsoft Learn). Set it to off deliberately. Exceptions should be rare, approved and reviewed.

3. App consent has been reviewed

Malicious or over-permissioned apps can sit inside Microsoft 365 with access users never really understood they were granting. By default, users can consent to apps that ask for permissions not requiring an admin (Microsoft Learn). Your provider should know which apps have access to your tenant, should have tightened who can approve new ones, and should know how to spot an illicit consent grant.

4. Local admin and passwords are controlled

Shared local admin passwords, unmanaged privileged accounts and old service credentials are exactly the kind of problems that make incidents spread. Windows LAPS gives every device its own rotating local admin password, and admin rights should not be handed out as a convenience. Admins should also use a separate account for admin work, which is now a Cyber Essentials requirement too.

5. Backups have been tested

A backup dashboard is not proof that the business can recover. Your MSP should know what can be restored, how long it takes, who has access, whether backups are protected from deletion and when the last meaningful test happened. The NCSC’s ransomware-resistant backup principles are a good yardstick.

6. Patching and endpoint protection are visible

It is not enough to have tools installed. Your provider should be able to report on patch status, endpoint health, devices falling behind and the exceptions that need attention. Critical and high-risk updates should land within 14 days; since April 2026, missing that is an automatic Cyber Essentials fail (NCSC).

7. Ownership is documented

You should know who owns the domain, DNS, Microsoft tenant, backup platform, licences and core admin accounts. If the answer is vague, you do not have proper governance. You have dependency dressed up as support.

The legacy sign-in deadline worth diarising

Older sign-in methods that send a plain username and password, without MFA, are one of the easiest ways into Microsoft 365. Most were switched off in Exchange Online back in 2022. The one that lingers is SMTP basic authentication, used by scan-to-email copiers and older business applications to send mail. Microsoft plans to disable it by default at the end of December 2026 (Exchange Team blog).

A good provider already knows which of your devices depend on it, and has a plan to move them to a supported method (Microsoft’s options) before the copier stops emailing on the first working day of January. We’ve written a full guide: your scanner is about to stop emailing.

Evidence to ask your provider for

You don’t need to be technical to check. Ask for these, and judge the answer by how quickly it arrives:

• An export or summary of your Conditional Access policies, and the exceptions in them.
• A list of sign-ins still using legacy authentication.
• The external forwarding setting, and any approved exceptions.
• The apps with access to mail or files in your tenant.
• LAPS coverage across your devices.
• Patch compliance against the 14-day target, with the exceptions named.
• The date and result of the last restore test.

The NCSC recommends exactly this kind of regular health reporting from a managed service provider (NCSC). A provider that can’t produce it isn’t necessarily doing a bad job, but you can’t tell, and neither could your insurer after an incident.

NorthMSP includes security baseline work as part of how we onboard and support clients. Start with our free security and IT health check or read about our cybersecurity service.