A well-run managed IT engagement includes a monthly review of your Microsoft 365 environment — not just hardware support. Here's exactly what Optimyze checks and what we do when something's wrong.
One of the most common questions from businesses evaluating managed IT providers is: "What do you actually do each month?" For Microsoft 365 environments, the answer is specific and substantial. Here's exactly what Optimyze reviews in every managed client's M365 tenant each month — and what action we take when something isn't right.
Microsoft Secure Score
We record the current score, compare to the previous month, and identify any score decreases. A Secure Score decrease means a previously-enabled security control has been disabled or a new risk has been identified. We investigate the cause and restore the control if it's been inadvertently changed.
Defender for Business alerts
We review all active alerts from the previous 30 days, confirm that automated remediation actions have resolved them correctly, and escalate any that required (or should have required) manual intervention. We review the investigation queue to ensure no incidents were missed.
Entra ID sign-in and risky users
We review the Risky Users report, action any users flagged as High risk (credential reset, session revocation), and review the sign-in log for unusual patterns. We also check that all Conditional Access policies are still active and that no emergency exemptions created during the month have been left in place.
Intune device compliance
We review device compliance status, identify non-compliant devices and their reason for non-compliance, and contact users whose devices need remediation. We also review the device check-in report to confirm all enrolled devices are still active.
Licence utilisation
We review assigned licences vs active users, identify unassigned licences (potential cost saving) or users without required licences, and flag any licence changes needed in the coming month.
Admin account audit
We verify that no new admin role assignments have been made that weren't authorised, and review the list of Global Administrators to confirm it matches the agreed list. Unexpected admin accounts are the strongest indicator of a compromised tenant.
The client report
Everything above is summarised in a plain-language monthly report. Not raw log data — a narrative that tells the client what happened, what we found, what we did about it, and what they should know. Clients receive this on the first Monday of each month, and it forms the basis of the monthly check-in call for clients on the Business and Premium plans.
