Useful two ways: as a setup order for a new tenant, and as an audit of one you inherited and have never really looked at.
Work through this in order. The first four items are the ones that cause real damage when they are missed, and they are all free. The rest is tidiness that pays back later.
If you are auditing a tenant you inherited rather than building a new one, the same list works as a set of questions. Anything you cannot answer is worth chasing down, and if several are unanswerable that is technical cleanup rather than a settings job.
If you only do four things, do these. Each one is free and each one prevents a category of expensive problem.
Write it down. What the tenant is, which plan, who holds admin, what the recovery details are, which shared mailboxes exist and who can reach them.
This is dull and it is the difference between a smooth handover and a fortnight of archaeology. The businesses that suffer most when a person leaves are not the ones with complicated setups. They are the ones where the setup was simple and entirely undocumented, so nobody realised how much depended on one person until that person was gone.
Keep the record somewhere the business controls, and somewhere findable in an emergency. A document nobody can locate during an outage is not a record.
This list is genuinely usable on your own, and plenty of owners do. Where people ask for help is the recovery cases and the mail authentication, which are the two that punish guessing.
It is the Microsoft 365 admin centre, and you can only reach it with an account that holds admin rights. If you sign in and cannot see it, your account is a normal user account, which is itself useful information: somebody else holds the keys.
Finding out who is the first job. If nobody knows, that is a recovery process rather than a settings change, and it is worth starting early because it runs on Microsoft's timetable.
Multi-factor authentication on every account, and especially on admin accounts. It is free, it takes minutes, and it prevents the great majority of the account compromises that hit small businesses.
The usual objection is that it is one more step at sign-in. That is true. It is also far less disruptive than losing control of the mailbox your invoices go out from.
A shared mailbox, nearly always. When enquiries land in one person's inbox, the business cannot see its own leads while that person is away, and it loses the history entirely when they leave.
Shared mailboxes are included on most business plans at no extra licence cost, which surprises people. There is rarely a good reason not to use one for anything addressed to the business rather than to an individual.
Do not just delete the account, because the mail goes with it. The usual approach is to block sign-in immediately, convert the mailbox so it is still reachable, and forward or delegate it to whoever is picking up that work.
Then release the licence, which is the step everyone forgets and the reason so many businesses pay for leavers for months.
Licences, accounts, security settings and the day to day of running a tenant.
Move mailboxes to a new provider without losing mail or downtime.
Authentication, reputation, and the fixes that actually move the needle.
Plain definitions for the records and terms you get asked about.
Untangle the accounts, domains and logins nobody has a full list of.
What to verify before and after a site goes live.
Most of this is an afternoon for someone who does it regularly, and considerably longer for someone doing it once. Tell us what state your tenant is in.