A production stoppage can begin with something as ordinary as a stolen password. An attacker accesses a Microsoft 365 account, sends convincing messages internally, reaches shared files or disrupts the team trying to recover them. For a manufacturer, that can mean delayed orders, inaccessible drawings, an ERP system nobody can reach and a very long day for operations. A Microsoft security review is a focused way to find and fix the gaps that make that scenario more likely.
It is not simply a check of whether Microsoft 365 is installed, nor a race to achieve the highest possible security score. The right review considers how your people, devices, data and production systems actually work. It identifies sensible improvements, highlights risks that need managing and sets out who is responsible for each action.
What a Microsoft security review should answer
For a business with 10 to 100 staff, the useful question is not, “Are we secure?” No honest adviser can answer that with a simple yes. The useful questions are: who can access our information, from which devices, under what conditions, and what happens if an account or computer is compromised?
A proper review should give directors and IT managers clear answers on whether:
- former staff, suppliers or temporary workers still have access;
- multi-factor authentication protects the accounts that matter;
- sensitive files, including CAD drawings and customer information, are shared appropriately;
- laptops, office PCs and shared warehouse devices are updated and protected;
- suspicious email, ransomware and unsafe downloads are being detected;
- backups and recovery arrangements will support the systems production depends on.
Microsoft 365 contains capable security tools, but many businesses use only a fraction of what their licence allows. Others have enabled settings without checking their impact on shared shop-floor accounts, legacy applications or remote supplier access. Security that prevents the factory from working is not a successful outcome.
Why manufacturers need a different review
Office IT and operational technology are closely connected in many engineering and industrial firms. A planner may need the MRP system to release work. A machine programmer may need access to a network share containing CAM files. Warehouse scanners may depend on Wi-Fi, a domain account or a cloud application. A compromise in the office can become an operational problem very quickly.
The review therefore needs to map dependencies before changing access rules. If a machinery-connected PC runs an older operating system, for example, the answer may not be to install every modern security control and hope for the best. It may be incompatible with the software controlling the machine.
Instead, the practical approach could include separating that device from the main business network, restricting its internet access, limiting who can log on, documenting the approved support route and ensuring its data is backed up. That does not make an unsupported system risk-free or automatically compliant with any certification scheme. It does reduce its exposure while you plan a longer-term replacement or upgrade.
A review should also distinguish between a named employee using Microsoft 365 every day and a shared device used across shifts. Shared accounts make accountability difficult and can undermine multi-factor authentication. Yet replacing them overnight may disrupt production. The review should identify a workable route towards named access, not issue a theoretical instruction that nobody can safely implement.
What should be examined in Microsoft 365
A Microsoft security review normally starts with identity. Microsoft Entra ID, previously known as Azure Active Directory, controls access to Microsoft 365 services and many connected applications. It should be checked for inactive accounts, unnecessary administrator rights, weak sign-in controls and access granted to external organisations.
Multi-factor authentication deserves particular attention. It is one of the most effective ways to reduce the impact of a stolen password, but it must cover all relevant users and administrators. Exceptions should be rare, documented and reviewed. A permanent exclusion made during a rushed rollout has a habit of becoming permanent furniture.
The next area is email and collaboration. Email remains a common route for phishing, invoice fraud and malicious attachments. The review should assess protection against impersonation, harmful links and suspicious attachments, as well as the processes behind the technology. Staff still need a simple route to report a doubtful message without worrying they are wasting someone’s time.
File sharing needs equal care. SharePoint, OneDrive and Teams make it easier to work with customers, subcontractors and suppliers, but external sharing can expose intellectual property if left unmanaged. The goal is not to block all sharing. It is to ensure that designs, quotations and quality documents are shared with the right people for the right period, with ownership that is clear when projects finish.
Device management is another major part of the picture. A managed laptop can be encrypted, patched, protected by endpoint security and remotely removed from company access if it is lost. A personal or unmanaged device should not receive the same level of access by default. The exact policy depends on the role, the sensitivity of the data and whether the device is used in an office, warehouse or on customer sites.
Do not confuse a score with a risk assessment
Microsoft provides security recommendations and scoring tools. They are useful because they expose settings that are missing or need attention. They are not, however, a complete risk assessment or a certificate of security.
A recommendation may be technically sound but need planning. Blocking all legacy authentication, for example, is usually sensible, but an old scanner, ERP integration or third-party application may still rely on it. The right response is to identify the dependency, establish whether it can be updated and put compensating controls in place while it is being addressed.
The same applies to privileged access. Reducing administrator rights is good practice, but the person supporting a critical production application may need controlled elevated access during a fault. A review should define a secure process for this, rather than leaving a broadly privileged account in place because it is convenient at 2 am.
Include recovery, not just prevention
Preventative controls matter, but manufacturing leaders also need confidence that the business can recover. Microsoft 365 has service resilience, yet that is not the same as a complete backup and recovery plan for your business data, configurations and connected systems.
The review should establish what is backed up, how long it is retained, who can restore it and whether restoration has been tested. It should cover more than email. Consider Teams files, SharePoint sites, OneDrive data, ERP exports, CAD libraries, machine programmes and key configuration information.
A backup that has never been restored is an assumption. A restore test gives you evidence, timings and a chance to find missing steps before an incident forces the issue. For systems that affect production, agree realistic recovery priorities with operations. Restoring every file at once is rarely the best first move when the dispatch team, planners and production supervisors need different things at different times.
What you should receive after the review
The outcome should be a prioritised improvement plan, written in language that a director can use to make decisions. It should separate urgent risks from sensible improvements and longer-term projects. It should also show the business impact, likely effort, dependencies and the person responsible for each action.
For example, an urgent action might be enabling multi-factor authentication for administrators and removing a former employee’s access. A planned action might be moving shared warehouse accounts to named user access. A longer-term project could be replacing a legacy PC connected to a production machine after confirming the supplier’s requirements.
If you are preparing for Cyber Essentials or responding to a customer security questionnaire, the review can identify areas that need attention. It should not promise that a particular configuration alone guarantees certification. Formal assessments have defined requirements, and evidence, scope and current guidance all matter.
When to arrange a Microsoft security review
A review is particularly worthwhile after an acquisition, a change in IT support, a Microsoft 365 migration, a phishing incident or the introduction of remote working. It is also sensible when a major customer asks security questions that the business cannot answer confidently.
For manufacturers in Hampshire, Surrey and West Sussex, it can be especially valuable where responsibility is split between an internal IT manager, software providers and a general support company. Clear ownership prevents the familiar situation where every supplier says the issue sits somewhere else.
Start by listing the systems that keep orders, design, production and dispatch moving. Then ask whether your Microsoft settings, user access and recovery arrangements support those systems or quietly put them at risk. Syn-Star can help turn that conversation into a practical Microsoft security review and a realistic improvement plan that respects the demands of production.
