Skip to content
Pro IT NW

Self-check · 10 questions · About 5 minutes

Could you take back the keys
without anyone's help?

Ten yes / no / don't-know questions about who controls your Microsoft 365 tenant, domain, licences, devices, backups and IT agreement. No sign-up. Nothing is sent anywhere.

IT Separation-Readiness Self-Check

Pro IT NW · proitnw.com/self-check/ · Tick one box per question. Three or more "Don't know" answers: consider an independent Separation-Readiness Review.

The ten questions.

"Yes" is the answer you want. "Don't know" is the honest answer more often than people expect, and it's the one that matters most: you can't fix what you can't see.

  1. 01Does at least one person on your own staff hold a Microsoft 365 Global Administrator account?

    Not a shared login your provider also uses: an account that belongs to your organization.

  2. 02Could you list everyone outside your organization who has standing admin access to Microsoft 365?

    Provider staff accounts, partner (GDAP) relationships, and apps granted admin permissions.

  3. 03Is your domain registered in an account your organization owns and can sign in to?

    You know the registrar, you hold the login, and it has multi-factor sign-in turned on.

  4. 04Do you know who bills your Microsoft licences, and the date they next renew?

    If they're bought through a partner, that partner is the partner of record.

  5. 05Do you know when your IT agreement auto-renews, and how much notice you must give before then?

    The last day you could give notice is the date that matters.

  6. 06Does your IT agreement say how your data and admin credentials are handed back if you leave?

    Including whether hand-back depends on anything else, such as all invoices being settled.

  7. 07Are BitLocker recovery keys for every company laptop stored where your organization can reach them?

    For example, escrowed to your own Microsoft Entra tenant, and checked device by device.

  8. 08Is your backup account in your organization's name, so the history stays with you?

    Covers Microsoft 365 backup and any server or file-share backup.

  9. 09If you needed to, could you remove your provider's remote-management agent from every device?

    Some agents need a removal password that only the provider holds.

  10. 10Does someone in your organization hold the admin login for your firewall?

    Even a read-only account lets you see what's allowed in.

Answer the questions to see where you stand.

    What the Separation-Readiness Review adds.

    The self-check tells you where the gaps are. The review closes the "don't know"s with evidence. It's read-only and independent, and it ends in one written answer to one question: could you remove your IT provider's access without their cooperation, and keep control? Yes, yes with conditions, or not today.

    You keep the report, the findings register, and the read-only scripts used to collect the evidence. Most fixes can be done by the provider you already have. Nothing in it requires changing provider, and we don't refer you to one.

    The domain part of this you can check yourself, right now: who controls your domain?

    Three or more "don't know" answers?

    That's where an independent Separation-Readiness Review earns its keep. Tell us roughly how many people and devices you have and we'll take it from there.

    Talk to us → Check your domain