Microsoft 365 Security Baseline Checklist

MFA enforced for all users via Conditional Access

Security Defaults enables MFA but allows users to postpone registration and can be bypassed in some legacy scenarios. Conditional Access enforcement is more reliable. Verify in Entra ID > Security > Conditional Access - look for an active policy requiring MFA for all users on all cloud apps. Requires Entra ID P1 (included in Business Premium).

Legacy authentication protocols blocked

Legacy protocols such as Basic Auth, IMAP and POP bypass MFA entirely. An attacker with a valid password can authenticate without triggering any MFA challenge. Verify in Entra ID > Security > Conditional Access - look for a policy blocking the Legacy Authentication client apps condition, with no exceptions for active user accounts.

Global Administrator count is two to three accounts maximum

Every unnecessary Global Admin account is an additional attack surface. The role grants complete tenant control and should not be used for day-to-day administration tasks. Verify in Entra ID > Roles and administrators > Global Administrator. Count both active and eligible assignments if PIM is enabled.

Break-glass accounts configured and monitored

Break-glass accounts are emergency admin accounts excluded from Conditional Access and MFA policies to prevent complete tenant lockout. Two accounts are standard. They should never be used for routine work. Configure an alert to fire if either account signs in. Verify in Entra ID > Monitoring > Diagnostic settings or via Microsoft Sentinel if deployed.

Privileged Identity Management enabled for high-impact roles

PIM removes standing privileged access - admins must request and justify activation of privileged roles, which are then time-limited and audited. At minimum, apply PIM to Global Admin, Exchange Admin and SharePoint Admin roles. Verify in Entra ID > Identity Governance > Privileged Identity Management. Requires Entra ID P2.

Service accounts and app registrations reviewed

Forgotten service accounts and application registrations with broad Microsoft Graph permissions are common persistence points after a compromise. Verify in Entra ID > App registrations and Entra ID > Enterprise applications. Look for registrations with client secrets that have not been rotated in the past 12 months, or Graph API permissions broader than the application requires.

Dormant user accounts identified and actioned

Accounts belonging to departed employees or contractors that remain active are high-value targets. Run a last sign-in report in Entra ID > Users, filter by last sign-in date. Accounts not signed in for 90 or more days with active licences should be reviewed, disabled or deleted per your offboarding policy.

Microsoft Intune configured and corporate devices enrolled

Intune provides the device management layer that enables Conditional Access to require compliant devices. Without enrolment, you cannot enforce device-level security standards. Verify in Intune > Devices > Overview - check enrolment coverage across your Windows, iOS and Android device population. Included in Microsoft 365 Business Premium.

Device compliance policy defined and enforced

Without a compliance policy, Intune marks all devices as compliant by default, which renders device-based Conditional Access meaningless. Define a policy requiring at minimum: current OS version, BitLocker encryption enabled, antivirus active, and a PIN or password. Verify in Intune > Devices > Compliance policies - confirm the policy is assigned to all users or all devices.

Conditional Access requires a compliant device for Microsoft 365

This ensures that only managed, compliant devices can access corporate data. Users on personal or non-compliant devices are blocked or given restricted access. Verify in Entra ID > Security > Conditional Access - look for a policy with the Grant control set to 'Require device to be marked as compliant'. Check that the policy scope covers all users and all cloud apps.

Microsoft Defender for Endpoint onboarded on enrolled devices

Defender for Endpoint provides endpoint detection, threat investigation and automated response. It is included in Microsoft 365 Business Premium. Verify in the Microsoft Defender portal > Endpoints > Device inventory - check that your enrolled device count roughly matches the expected number of corporate devices. Devices not appearing may not be properly onboarded.

Safe Links policy configured and applied to all users

Safe Links rewrites URLs in email and Office documents and checks them against Microsoft's threat intelligence at the time they are clicked, not just at delivery. Without it, a URL that was clean at delivery can later point to a malicious site. Verify in the Microsoft Defender portal > Email & collaboration > Policies & rules > Threat policies > Safe Links.

Safe Attachments policy configured and applied to all users

Safe Attachments detonates email attachments in a virtualised sandbox before delivering them to the recipient. Without it, malicious attachments are only checked against known signatures, missing novel or obfuscated malware. Verify in the Microsoft Defender portal > Email & collaboration > Policies & rules > Threat policies > Safe Attachments.

Anti-phishing policy with impersonation protection enabled

Impersonation protection detects emails that attempt to spoof your executives, key staff or trusted partner domains. Add your CEO, CFO and any board-level contacts to the protected users list, and your primary domain to the protected domains list. Verify in the Microsoft Defender portal > Email & collaboration > Policies > Anti-phishing.

DKIM and DMARC configured for all sending domains

DKIM cryptographically signs outbound email to prove it came from your domain. DMARC tells receiving mail servers what to do with mail that fails DKIM or SPF - reject it, quarantine it or report it. Without these, your domain can be trivially spoofed in phishing campaigns targeting your customers or suppliers. Check your DNS records using MXToolbox or similar.

Email forwarding rules audited across all mailboxes

Creating a silent forwarding rule is a common technique attackers use after compromising an account - it gives persistent access to all incoming email even after the password is reset. Run a PowerShell report to enumerate all inbox rules with forwarding actions across all mailboxes, or use the Exchange admin centre > Mail flow > Rules. Any external forwarding rules that cannot be explained should be treated as an indicator of compromise.

Microsoft 365 audit logging enabled with retention confirmed

Audit logging records user and admin activity across the tenant - sign-ins, file access, admin changes, mail delivery. Without it, you cannot investigate an incident or satisfy a legal or regulatory disclosure obligation. Verify in the Microsoft Purview compliance portal > Audit > Search. Confirm that audit is enabled and review the retention period - default is 90 days for most plans, 180 days on Business Premium.

Alert policies reviewed and routed to a monitored address

Microsoft 365 generates default alerts for high-risk events: mass file deletion, impossible travel sign-in, forwarding rule creation, and more. These alerts are often routed to a mailbox that nobody reads. Verify in the Microsoft Purview compliance portal > Alert policies - review the notification email addresses on each policy and confirm someone is responsible for reviewing alerts.

Microsoft Secure Score baselined and reviewed regularly

Secure Score provides a numerical measure of your security configuration against Microsoft's recommended controls. It is not a complete security measure, but it tracks configuration drift over time and identifies specific improvements. Verify in the Microsoft Defender portal > Secure Score. Record the current score as a baseline - review it at least monthly.

Tenant-level external sharing settings reviewed and restricted

Microsoft 365 defaults allow sharing with anyone via an anonymous link. Review the SharePoint admin centre > Policies > Sharing and set the tenant-level default to at most 'New and existing guests'. Note that site owners can set more permissive settings than the tenant default if site-level overrides are not blocked. Check both the tenant setting and any high-risk individual sites.

Sensitivity labels published and in active use

Sensitivity labels are the mechanism that governs what Microsoft Copilot can surface, what can be shared externally, and how content is protected in transit. Without labels, there is no classification layer and DLP policies have no label-based enforcement. Verify in the Microsoft Purview compliance portal > Information protection > Labels. Even a simple three-label taxonomy provides a meaningful foundation.

DLP policy in place for at least one sensitive content category

A data loss prevention policy that alerts on external sharing of financial records, HR data or client information is better than no policy. Start with a policy covering the highest-risk content category for your business and expand from there. Verify in the Microsoft Purview compliance portal > Data loss prevention > Policies. Check that at least one policy is active and not in audit-only mode indefinitely.

Retention policies configured for email and Teams messages

Without retention policies, email and Teams messages may be permanently deleted by users or purged automatically, before satisfying any legal hold or regulatory obligation. Conversely, data retained indefinitely creates its own risk. Configure a baseline retention policy for email and Teams conversations in the Microsoft Purview compliance portal > Data lifecycle management > Retention policies.