Microsoft 365 Security Checklist

0 / 24 in place · 0%

Identity and access

Multifactor authentication is enforced for every user, not just adminsEnforced through Conditional Access or security defaults, with no legacy exclusions left open.
Legacy authentication is blockedBasic auth protocols bypass MFA entirely and are the most common way accounts are taken over.
Global Administrator accounts are down to a handful, and are cloud-onlyAim for fewer than five, each on phishing-resistant MFA, none used for daily work.
Privileged roles are time-limited, not standingPrivileged Identity Management makes elevation just-in-time, approved, and logged.
Conditional Access controls access by device and risk, not just passwordRequire a compliant or hybrid-joined device for access to email and data.
Guest and external access is reviewed on a scheduleAccess reviews expire guest accounts that are no longer needed.

Email and collaboration

Anti-phishing policy with impersonation protection is onDefender for Office 365 mailbox intelligence and impersonation protection for your executives and finance team.
Safe Links and Safe Attachments are enabledCovers Teams and SharePoint, not just inbound mail.
External sender warnings are switched onA first-contact safety tip is the cheapest defence against payment redirection fraud.
SPF, DKIM, and DMARC are published and enforcedDMARC at least at quarantine, ideally reject, so nobody can spoof your domain.
Auto-forwarding to external addresses is blockedA classic data-exfiltration and business-email-compromise route.

Data protection

Sensitivity labels are defined and applied to the data that mattersLabels with encryption travel with the document outside your tenant.
Data loss prevention policies cover email, Teams, and endpointsCatch the accidental send of card numbers, health data, or client files.
External sharing in SharePoint and OneDrive is set deliberatelyDefault to specific-people links, not anyone-with-the-link.
Retention policies match your legal and regulatory obligationsBoth to keep what you must and to dispose of what you should not hold.
Audit logging is on and retainedYou cannot investigate what was never recorded.

Devices

Devices must be compliant before they reach company dataIntune compliance policy tied to Conditional Access.
Disk encryption is enforced on managed devicesBitLocker on Windows, FileVault on macOS, reported back to Intune.
App protection policies cover personal phonesProtect Outlook and Teams data on BYOD without managing the whole device.
Defender for Endpoint is deployed and reportingOnboarded devices with automated investigation turned on.

Monitoring and response

Someone owns the security alerts, and they are tunedUntuned alerts get ignored, which is the same as having none.
Sign-in and audit logs flow somewhere they are kept and watchedMicrosoft Sentinel or at least a defined review, with retention for lookback.
You have tested what happens when an account is compromisedA written, rehearsed response beats improvising during an incident.
Secure Score is tracked over time, with an ownerNot as a number to chase, but as a trend that should move the right way.

If you ticked most of these, you are ahead of most tenants. The ones you did not tick are usually where an assessment pays for itself. We can run this properly against your tenant and hand you a prioritised fix list.

Get a free posture assessment Talk to our team

Microsoft 365 Security Checklist

Identity and access

Email and collaboration

Data protection

Devices

Monitoring and response

Keep going

Copilot Readiness Assessment

Azure Landing Zone Review

Want this run against your real environment?