Assessment report · The Scan

Microsoft 365 Maturity Assessment

Tab & Shift Engineering Ltd. · 90 people · engineering and field services

Prepared for	Prepared by	Date	Status
Paige Tab Co-founder and Managing Partner	Floor 16 Technologies	Apr 24, 2026	v1.0 · Issued
Scan window	Evidence	Scale	Findings valid
Apr 6 to 17, 2026	Automated scan and four 30-minute interviews	Eight areas, scored 1 to 5	90 days

1. 01Summary
2. 02How we measured
3. 03The eight scores
4. 04Risks, ranked
5. 05Findings by area
6. 06Licensing: paid for and used
7. 07Quick wins
8. 08What fixing it buys
9. 09The year, in brief
10. 10Next step

Summary

Tab & Shift's people use Microsoft 365 every day and use it well. The content underneath them is not in order, and the first fix is a retention schedule, because nothing can be cleaned up safely without one.

Where things stand

Adoption is not the problem. 86 of 90 staff were active in the last 180 days. They generated about 210,000 email actions, 169,000 Teams messages and 61,000 SharePoint file actions. One Teams message in eight is posted in a channel rather than a private chat, which is better than most companies this size.

The content is. The Scan found 520,000 files and 1.6 TB across 78 SharePoint sites and 90 OneDrives. 62% of the files have not been opened or changed in three years. 38,400 are exact duplicates of a file somewhere else. There is no retention policy, no retention label and no sensitivity label anywhere in the tenant. Tab & Shift's own records policy, a 2019 PDF on the Quality site, says project records are kept for ten years after a project closes. Nothing in Microsoft 365 carries that out, and nothing stops a deletion either.

Access has been granted by convenience. 41 of the 78 sites give access to "Everyone except external users", including HR Team and HR Records 2019. The median staff account can open 29 sites. Tenant sharing allows "Anyone" links with no expiry, and 212 of them are live today, 74 of which allow editing.

AI has started ahead of the rules. Tab & Shift bought ten Copilot seats in January. Four people use them weekly and three have not been used at all. Copilot answers from whatever the person asking can open, so today it can draw on the two HR sites for anyone in the company. Two of the four people we interviewed said staff are already pasting proposal text into free chat tools.

What is already in good shape

Two of the eight areas should be left alone while the rest is fixed. Multifactor sign-in is on for every licensed account, and 61 of 104 devices are managed (security baseline, 2.9). Teams is used the way it is meant to be used (collaboration habits, 3.1). Neither needs a project. Both need the small fixes listed in their sections.

What the work looks like

Five phases over twelve months, in the order the dependencies set. Each one is priced on its own, and the first fixes need no new licensing at all. The one-page roadmap and the fix list carry the detail.

How we measured

The Scan ran over two weeks with read-only access approved by Sam Okafor, Tab & Shift's IT coordinator. It covered every SharePoint site and OneDrive, the tenant's sharing, security and compliance settings, licensing, and 180 days of usage.

The scale

Each area is scored from 1 to 5 against the levels of the Microsoft 365 Maturity Model. A score of 2.0 means the practice exists and repeats in places. It does not mean it is half done.

The eight scores

Overall maturity is 2.0 out of 5 today, against a twelve-month target of 3.3. The four lowest scores are the four that decide what AI can safely see, which is why the roadmap starts there rather than with new tools.

Risks, ranked

Nine risks, ordered by what they could cost Tab & Shift rather than by how technical they are. Every one is a setting or a figure the Scan measured. None is a guess about attackers.

Likelihood and impact

Numbers match the table above. The three flagged sit in the top right: likely to happen, and costly when they do.

Likelihood up the side, impact along the bottom.

Findings by area

Each area combines what we heard in the interviews with what the Scan measured, followed by what we recommend and what changes when it is done. The areas run lowest score first.

Tab & Shift has a records policy and nothing that carries it out. The policy says project records are kept ten years after a project closes and personnel files seven years after someone leaves. Microsoft 365 has no retention policy, no retention label and no hold, so a deletion by anyone with edit rights is final once the recycle bin empties. Nothing old is ever removed either, which is how 62% of the content came to be three years untouched.

Content by age, share of 520,000 files

Deep Sky marks the 62% past three years: the content an archive date would move out of the working set.

Access at Tab & Shift has been granted for convenience and never taken back. "Everyone except external users" sits on 41 of the 78 sites, through 63 separate grants at site or library level. Tenant sharing allows Anyone links that need no sign-in and never expire. Sharing outside the company is low, so the restraint so far is people's habit rather than a setting.

Who can open the sensitive sites

AI use has started ahead of AI rules. Copilot, Claude and ChatGPT all answer from what the person asking can open, so the permission picture above is the AI picture. Today a field technician's Copilot can draw on HR Team, and 62% of what any answer draws on is three years old or more. None of that is the tool's fault. It is showing Tab & Shift a permissions problem it already had.

Anyone at Tab & Shift can create a team, and many have. Sites outlive their owners: when someone leaves, their account is turned off but nobody looks at what they owned. There is no naming standard, no expiry and no record of a review.

78 flat sites with no hub and no shared navigation. Most project work lives in one Projects site with 6,800 folders, each shaped by whoever created it. The good news is a project number, TS-YY-NNN, that Tab & Shift already uses on 71% of project folders. It is a sound scheme. It has just never been required.

Tab & Shift has automated the easy thing well: safety observations go from a form on a phone into a list, 410 of them in 180 days. The processes that cost the most hours still run on email and spreadsheets: expense claims, field job sheets and the project list.

Better than most companies this size. Security defaults turn on multifactor sign-in for every account, and the 27 Business Premium seats bring device management and sign-in rules that are partly in use. The gaps are specific and cheap to close.

The strongest area. Teams is in daily use by 86 of 90 staff, project channels carry real work, and project reviews are recorded. The one gap matters for everything else: files dropped into a chat are stored in the sender's OneDrive, so the record of the work leaves with the person.

Licensing: paid for and used

27 paid licenses have not been used in 90 days. At list prices that is about $6,200 a year. None of the cleanup or lock down work needs a new license for the 27 Business Premium users. Whether the other 63 staff move up from Business Standard is a decision for the lock down phase, covered in the label set.

Scenario list prices, annual commitment. Your agreement and discounts will differ; your reseller confirms before anything is canceled.

Quick wins

Ten fixes that need no licensing, no project and no outside help. Together they take about three working days, and Tab & Shift's IT coordinator can do most of them. They close the most exposed risks before the roadmap starts.

What fixing it buys

Every figure on the left was measured by the Scan. Every figure on the right is what the roadmap delivers when the named phase is done.

The year, in brief

Lock down is the phase that matters most: it is the one people skip, and it decides what AI can find. Build runs alongside it because the register and approvals do not depend on labels.

Costs and the reason for each step are on the one-page roadmap.

Next step

Review the findings, confirm the priorities, choose the phases. A 60-minute working session with Priya Shah and Marcus Chen to agree the archive date, the order of the first fixes and which phases Tab & Shift wants priced. Floor 16 then provides a fixed price for each phase chosen. Many companies do the quick wins themselves first, and the report is theirs to keep either way.

The Scan and this report cost Tab & Shift nothing. Findings reflect the tenant as of Apr 17, 2026, and are valid for 90 days. Identity, endpoint and network configuration were reviewed only as far as Microsoft 365 settings show them.