# Microsoft 365 security checklist for property management companies

Microsoft 365 is often the front door to email, files, Teams, and employee access. This checklist helps property management teams review the controls that matter in daily operations.

Updated: August 18, 2026

## Lock down identity and admin access

Most Microsoft 365 incidents start with an account, not a server. Named users, MFA, and fewer standing admin roles make the rest of the environment easier to support.

- Require MFA for every staff account, including regional managers, leasing staff, and remote employees.
- Separate everyday user accounts from Microsoft 365 and Entra ID admin accounts.
- Limit global administrator roles and review who can reset passwords, add users, or change domains.
- Document how account recovery works if a manager is unavailable or a device is lost.

## Review mailboxes, sharing, and collaboration

Property management work depends on shared mailboxes, SharePoint, OneDrive, and Teams. Those tools need owners, not leftover access from former employees or vendors.

- Inventory shared mailboxes such as leasing, maintenance, accounting, and vendor communication.
- Review mailbox forwarding, delegates, and external sharing on SharePoint, OneDrive, and Teams.
- Remove stale employee, contractor, and guest accounts that no longer need access.
- Confirm mobile access uses company-approved sign-in and that unused devices can be blocked.

## Watch for phishing, suspicious sign-ins, and employee changes

The checklist is only useful if someone owns the review. Pair the technical settings with onboarding, offboarding, and a way to report suspicious mail.

- Give employees a reporting path for phishing and vendor payment-change messages.
- Review suspicious sign-ins, MFA fatigue, and unfamiliar locations when they appear.
- Include Microsoft 365 access in every onboarding and offboarding request.
- Record the standard, the last review date, and the owner for admin roles, sharing, and shared mailboxes.

## Frequently asked questions

### Does this checklist mean ArcTechOne is a Microsoft partner?

No Microsoft partnership or certification is implied. The checklist is practical administration guidance for a property management Microsoft 365 environment.

### What should be checked first if time is limited?

Start with MFA, admin accounts, shared mailbox permissions, forwarding rules, stale accounts, and the offboarding path for departing employees.

### Can this be part of managed IT or co-managed support?

Yes. The same checklist can be used during an assessment, a security review, or ongoing Microsoft 365 administration.

## Related ArcTechOne services

- [Microsoft 365 for property management](https://arctechone.com/microsoft-365-property-management)
- [property management cybersecurity](https://arctechone.com/property-management-cybersecurity)