CyberThreats.au

Independent cybersecurity education

SearchScammed or hacked?Get help

For you

ScamsIs this a scam?

Types of scams

All scam guides

Practise

Protect yourselfMake my security checklist

Your devices

Everyday situations

Accounts and passwords

Privacy

All protect yourself guides
Cyber threats

Common threats

Newer and specialised threats

All cyber threat guides
Security products

Devices

Accounts and identity

Network and privacy

Backup

All product guides
Free checklists

For you

For work

All free checklists

For work

Small businessSmall business security checklist

Foundations

Payments, suppliers and incidents

All business guides

AI and cloud

All AI and cloud guides
Microsoft 365Microsoft 365 readiness checklist

Identity and access

Email

Teams, SharePoint and OneDrive

Data, devices and admin

All Microsoft 365 guides

Microsoft 365 Admin Review Worksheet

A periodic review of key Microsoft 365 security settings, linked to Microsoft's documentation, with a PDF record.

Last reviewed 21 October 2026

22 questions. Answer as many as you like; your checklist updates as you go.

Administration

Is the Global Administrator role held by fewer than five people?

Why it matters: Global Administrator can change everything in the tenant, so every extra holder is another account worth attacking. Microsoft recommends assigning the role to fewer than five people and using least privilege: giving administrators exactly the permissions they need.

Licensing: Microsoft's page doesn't state a licence for assigning roles itself. It lists Microsoft Entra ID P2 or Microsoft Entra ID Governance for Privileged Identity Management, which adds time-limited (just-in-time) roles.

How to do it
  1. List everyone who holds Global Administrator, using the roles view in the Microsoft Entra admin center.
  2. For each person, check whether a narrower built-in role would cover their work (for example Exchange, SharePoint, User or Security Administrator).
  3. Move people to the narrower role where it fits, and remove Global Administrator.
  4. Microsoft describes using cloud-only accounts, not on-premises synced accounts, for admin role assignments.

Based on Microsoft's documentation, checked October 2026. Admin centre menus change; Microsoft Learn has the current steps.

Read our guide: Microsoft 365 admin roles and least privilege explainedOfficial reference: Microsoft Learn: Best practices for Microsoft Entra roles

Are admin role assignments reviewed regularly, removing roles people no longer need?

Why it matters: Admin rights tend to pile up over time. Microsoft recommends using access reviews to find and remove role assignments that are no longer needed, to reduce the risk of unauthorised or excessive access.

Licensing: A manual review needs no extra licence. Microsoft lists Microsoft Entra ID Governance or Microsoft Entra Suite for access reviews, noting some capabilities operate with Microsoft Entra ID P2.

How to do it
  1. Export or list current admin role assignments.
  2. Confirm with each person (or their manager) that the role is still needed.
  3. Remove roles that aren't, including those held by former staff or providers.
  4. Where licensed, set up recurring access reviews so this happens on a schedule.

Based on Microsoft's documentation, checked October 2026. Microsoft Learn has the current steps for access reviews.

Read our guide: Privileged Identity Management (PIM) in Microsoft Entra, explainedOfficial reference: Microsoft Learn: Best practices for Microsoft Entra roles

When staff leave, is sign-in blocked and their licence removed or reassigned, with their mail and OneDrive handed over first?

Why it matters: A former employee's account still signed in, or still licensed, keeps access to organisation data. Microsoft's offboarding steps cover blocking sign-in, saving the mailbox, wiping mobile devices, forwarding mail or converting to a shared mailbox, handing over OneDrive, then removing the licence and deleting the account.

Licensing: Microsoft's overview page doesn't state a separate licence for these offboarding steps.

How to do it
  1. Block the former employee's sign-in to Microsoft 365.
  2. Save their mailbox, and forward their email or convert it to a shared mailbox if needed.
  3. Give another person access to their OneDrive and Outlook data before deleting anything.
  4. Remove the licence and reassign or delete it. Microsoft notes email, contacts and calendar are kept for 30 days after the licence is removed, then deleted permanently.
  5. Review the user list for accounts belonging to people who have already left.

Based on Microsoft's documentation, checked October 2026. Microsoft Learn has the current steps for each stage.

Read our guide: Staff offboarding in Microsoft 365: removing access when someone leavesOfficial reference: Microsoft Learn: Remove a former employee

Identity and access

Are there at least two emergency access (break-glass) accounts, and have they been tested in the last 90 days?

Why it matters: If a Conditional Access mistake, an outage or a lost admin device blocks normal sign-in, emergency accounts are the way back in. Microsoft describes keeping at least two, using phishing-resistant sign-in that differs from normal admin accounts, alerting on every use, and validating them at least every 90 days.

Licensing: Microsoft's page doesn't state a licence for the accounts themselves. Its alerting example uses sign-in logs sent to Azure Monitor. Conditional Access exclusions apply where Conditional Access (Microsoft Entra ID P1 or higher) is in use.

How to do it
  1. Confirm there are at least two cloud-only emergency accounts using the .onmicrosoft.com domain.
  2. Check they use a phishing-resistant method such as a passkey (FIDO2), different from the methods other admins use.
  3. Check they're excluded from Conditional Access policies that block or restrict sign-in.
  4. Check an alert fires whenever one signs in.
  5. Test signing in with each, and record the date. Microsoft describes doing this at least every 90 days and after IT staff changes.

Based on Microsoft's documentation, checked October 2026. Microsoft Learn has the current steps.

Read our guide: Microsoft 365 security baseline: the settings Microsoft's guidance coversOfficial reference: Microsoft Learn: Manage emergency access accounts in Microsoft Entra ID

Is MFA enforced for every user, through security defaults or Conditional Access?

Why it matters: Microsoft describes security defaults as a free baseline that requires every user to register for MFA, requires admins to use MFA, and blocks legacy authentication. It describes Conditional Access as fully customisable, and says organisations using Conditional Access policies that replace security defaults have to turn security defaults off.

Licensing: Microsoft's comparison lists no licence requirement for security defaults, and at least Microsoft Entra ID P1 for Conditional Access.

How to do it
  1. Check whether security defaults are on, or whether Conditional Access policies are in use.
  2. If neither is in place, review Microsoft's comparison to decide which suits the tenant.
  3. If using Conditional Access, confirm a policy requires MFA for all users, with emergency accounts excluded.
  4. Microsoft notes that, since July 2024, security defaults no longer give users a 14-day grace period to register for MFA.

Based on Microsoft's documentation, checked October 2026. Microsoft Learn has the current steps.

Read our guide: Security defaults vs Conditional Access: how they differOfficial reference: Microsoft Learn: Security defaults in Microsoft Entra ID

Have you checked the authentication methods registration report to see which users aren't yet able to use MFA?

Why it matters: A policy that requires MFA only works for people who have registered a method. Microsoft's authentication methods activity report shows how many users are capable of MFA, passwordless sign-in and self-service password reset, and which methods they've registered.

Licensing: Microsoft says a Microsoft Entra ID P1 or P2 licence is required to access Usage and insights, which includes this report.

How to do it
  1. Open the authentication methods activity report in the Microsoft Entra admin center (Microsoft Learn shows the current path).
  2. On the Registration tab, check how many users are capable of MFA.
  3. Note users with no strong method registered, and follow up with them.
  4. Microsoft notes the report isn't real time and can lag by up to 36 hours.

Based on Microsoft's documentation, checked October 2026. Microsoft Learn has the current steps.

Read our guide: Microsoft 365 MFA methods compared, from SMS to passkeysOfficial reference: Microsoft Learn: Authentication methods activity

Are administrators required to sign in with phishing-resistant methods such as passkeys (FIDO2) or Windows Hello for Business?

Why it matters: Microsoft notes that accounts with privileged admin roles are frequent targets, and that requiring phishing-resistant MFA for them reduces the risk of compromise. It lists the roles it recommends covering, starting with Global Administrator.

Licensing: This uses Conditional Access, which Microsoft's security defaults comparison lists as needing at least Microsoft Entra ID P1. The policy page itself doesn't state licensing.

How to do it
  1. Make sure each administrator has registered a phishing-resistant method first. Microsoft warns that enabling the policy without this risks locking you out of the tenant.
  2. Create a Conditional Access policy targeting the admin roles Microsoft lists, requiring the phishing-resistant MFA authentication strength.
  3. Exclude emergency access accounts.
  4. Start in report-only mode, check the impact, then switch the policy on.

Based on Microsoft's documentation, checked October 2026. Microsoft Learn has the current steps.

Read our guide: Microsoft 365 MFA methods compared, from SMS to passkeysOfficial reference: Microsoft Learn: Require phishing-resistant MFA for administrators

Is legacy authentication blocked?

Why it matters: Microsoft explains that legacy authentication protocols don't support MFA, and recommends blocking them. Security defaults block legacy authentication; with Conditional Access, Microsoft describes a dedicated blocking policy.

Licensing: Microsoft says customers without licences that include Conditional Access can use security defaults (no extra licence) to block legacy authentication. The Conditional Access policy needs at least Microsoft Entra ID P1.

How to do it
  1. Check the sign-in logs for legacy authentication use: add the Client App column and filter on the legacy protocols, on both interactive and non-interactive tabs.
  2. Contact the owners of anything still using legacy authentication and move them to modern authentication.
  3. Create the block legacy authentication policy in report-only mode, excluding emergency access accounts.
  4. Once results look as expected, switch the policy on.

Based on Microsoft's documentation, checked October 2026. Microsoft Learn has the current steps.

Read our guide: Security defaults vs Conditional Access: how they differOfficial reference: Microsoft Learn: Block legacy authentication

Are guest users reviewed, and removed when they no longer need access?

Why it matters: Guest accounts often outlive the project they were created for. Microsoft notes that guests might not be aware of their group memberships, and describes access reviews where guests or a decision maker confirm whether access is still needed.

Licensing: A manual review needs no extra licence. Microsoft lists Microsoft Entra ID P2 or Microsoft Entra ID Governance for access reviews of guests.

How to do it
  1. List guest users and the groups, Teams or apps they belong to.
  2. Check with the owner of each group or project whether each guest still needs access.
  3. Remove guests who don't, including those who never accepted their invitation.
  4. Where licensed, set up recurring access reviews of guests across Microsoft 365 groups.

Based on Microsoft's documentation, checked October 2026. Microsoft Learn has the current steps.

Read our guide: Guest access and external identities in Microsoft 365Official reference: Microsoft Learn: Manage guest access with access reviews

Is user consent to apps limited, for example to verified publishers and low-impact permissions, with an admin consent workflow for other requests?

Why it matters: A malicious app can trick a user into granting it access to mail and files, without needing a password. To reduce this risk, Microsoft recommends allowing user consent only for apps from verified publishers, and describes an admin consent workflow so users can request approval for other apps.

Licensing: Microsoft's page doesn't state a licence requirement; it lists the Privileged Role Administrator role (and Global Administrator when using the admin center) as prerequisites.

How to do it
  1. Open the user consent settings for enterprise applications in the Microsoft Entra admin center.
  2. Check which option is selected: consent turned off, verified publishers with selected permissions, or consent for all apps.
  3. If using the verified publishers option, classify which permissions count as low impact.
  4. Turn on the admin consent workflow so blocked requests come to a reviewer.

Based on Microsoft's documentation, checked October 2026. Microsoft Learn has the current steps.

Read our guide: App consent in Microsoft Entra ID and consent phishing, explainedOfficial reference: Microsoft Learn: Configure how users consent to applications

Have the permissions already granted to enterprise apps been reviewed recently?

Why it matters: Microsoft describes reviewing app permissions when an app looks malicious or has more permissions than it needs. It also notes that revoking a permission doesn't stop users consenting again unless consent settings are changed too.

Licensing: Microsoft's page doesn't name a licence tier; it lists Cloud Application Administrator or Application Administrator as the roles needed.

How to do it
  1. In the Microsoft Entra admin center, open Enterprise apps and review the list of applications.
  2. For each unfamiliar or high-permission app, open Permissions and check the Admin consent and User consent tabs.
  3. Revoke admin-consented permissions that aren't needed. Microsoft explains user-consented permissions are revoked through Microsoft Graph or PowerShell.
  4. Tighten user consent settings so the same permissions aren't granted again.

Based on Microsoft's documentation, checked October 2026. Microsoft Learn has the current steps.

Read our guide: App consent in Microsoft Entra ID and consent phishing, explainedOfficial reference: Microsoft Learn: Review permissions granted to enterprise applications

Monitoring

Are risky sign-ins and risky users reviewed regularly?

Why it matters: Microsoft's risk reports flag sign-ins and users that look unusual, such as possible leaked credentials. Admins can confirm a sign-in as compromised or safe, or dismiss the risk, and start a password reset for a risky user.

Licensing: Microsoft's ID Protection table says Free and P1 tenants see limited risky user and risky sign-in information (no risk detail or risk history); full reports and risk-based policies need Microsoft Entra ID P2 or Microsoft Entra Suite.

How to do it
  1. Open the risky users and risky sign-ins reports in the Microsoft Entra admin center.
  2. Investigate each entry: the app, location, device and MFA details.
  3. Confirm compromised or safe, or dismiss, based on what the investigation finds.
  4. For a risky user, Microsoft describes starting a password reset from the report; the compromised account guide on this site covers the wider response.
  5. Microsoft notes the risky sign-ins report holds up to 30 days of data.

Based on Microsoft's documentation, checked October 2026. Microsoft Learn has the current steps.

Read our guide: Compromised Microsoft 365 account: what Microsoft's response guide describesOfficial reference: Microsoft Learn: ID Protection risk reports

Is audit log search turned on, and do you know how long audit records are kept?

Why it matters: Without audit records it's hard to tell what happened after a suspected compromise. Microsoft says audit log search is turned on by default for enterprise organisations, keeps records for 180 days for non-E5 users under Audit (Standard), and one year by default for some E5 activity.

Licensing: Microsoft says retention is 180 days for non-E5 users (Audit Standard) and one year by default for Entra ID, Exchange and SharePoint activity for E5 users. It links to subscription requirements for Audit (Standard) and Audit (Premium).

How to do it
  1. Confirm audit log search is on. Microsoft Learn shows how to check this (it describes an Exchange Online PowerShell check).
  2. Check that the people who investigate incidents have the Audit Logs or View-Only Audit Logs role in Microsoft Purview.
  3. Run a test search to confirm results come back.
  4. Note the retention period for your licences, so you know how far back an investigation can look.

Based on Microsoft's documentation, checked October 2026. Microsoft Learn has the current steps.

Read our guide: Audit logs, alerts and Secure Score in Microsoft 365, explainedOfficial reference: Microsoft Learn: Search the audit log

Are the default alert policies on, with notifications going to someone who reads them?

Why it matters: Microsoft's default alert policies include 'Suspicious email forwarding activity', 'Creation of forwarding/redirect rule' and 'Elevation of Exchange admin privilege'. Alerts appear in the portal regardless, but email notifications only go to the recipients set on each policy.

Licensing: Microsoft lists E1/F1/G1, E3/F3/G3 or E5/G5 for the three default alerts named here. Threshold-based and unusual-activity alerts need advanced licensing such as Microsoft 365 E5 or Defender for Office 365 Plan 2.

How to do it
  1. Open the alert policies page in the Microsoft Purview or Defender portal.
  2. Check the default policies for forwarding, inbox rules and admin privilege changes are turned on.
  3. Set notification recipients to a mailbox or person who will act on them.
  4. Check that the people reviewing alerts have roles that let them see each alert category.

Based on Microsoft's documentation, checked October 2026. Microsoft Learn has the current steps.

Read our guide: Audit logs, alerts and Secure Score in Microsoft 365, explainedOfficial reference: Microsoft Learn: Alert policies

Has Microsoft Secure Score been reviewed recently, with a decision recorded for each high-impact recommendation?

Why it matters: Secure Score lists recommended security actions and tracks which are done. Microsoft says it isn't an absolute measure of how likely a breach is and shouldn't be interpreted as a guarantee against one.

Licensing: Microsoft says recommendations appear for supported products the organisation is licensed for, and that the full set of recommendations is shown regardless of licence edition. Read access is available to roles such as Security Reader and Global Reader.

How to do it
  1. Open Microsoft Secure Score in the Microsoft Defender portal.
  2. Review the recommended actions, starting with those worth the most points.
  3. For each, plan it, mark it as addressed by another tool, or record a decision to accept the risk.
  4. Check the score history to see what changed since the last review.

Based on Microsoft's documentation, checked October 2026. Microsoft Learn has the current steps.

Read our guide: Microsoft 365 security baseline: the settings Microsoft's guidance coversOfficial reference: Microsoft Learn: Microsoft Secure Score

Teams, SharePoint and OneDrive

Are SharePoint and OneDrive external sharing settings set deliberately, at the organisation and site level?

Why it matters: Microsoft says external sharing is turned on by default for the whole SharePoint and OneDrive environment. Sharing has to be allowed at the organisation level before any site can share, and where site and organisation settings differ, the more restrictive one applies.

Licensing: Microsoft's overview page doesn't state a separate licence for sharing settings. Microsoft notes unlicensed guests are limited to basic collaboration.

How to do it
  1. Review the organisation-level sharing setting for SharePoint and OneDrive in the SharePoint admin center.
  2. Decide whether 'Anyone' links are needed. Microsoft explains that people with an Anyone link can be cut off by deleting the link or turning off Anyone links for the site.
  3. Check sites holding sensitive information are set more restrictively.
  4. Review the related Microsoft Entra external collaboration settings, which Microsoft links from the same page.

Based on Microsoft's documentation, checked October 2026. Microsoft Learn has the current settings and option names.

Read our guide: SharePoint and OneDrive sharing settings, explainedOfficial reference: Microsoft Learn: External sharing overview

Email

Is automatic forwarding of email to external addresses set explicitly to Off (or On only for approved cases), and checked in the forwarding report?

Why it matters: Microsoft notes users can set inbox rules that forward mail externally, deliberately or as a result of a compromised account. It explains that the default 'Automatic – System-controlled' setting can behave differently between organisations, and describes setting On or Off explicitly. Turning it off disables inbox rules and mailbox forwarding to external addresses.

Licensing: Microsoft's page lists Exchange Online Protection (built into all cloud mailboxes) and Defender for Office 365 Plan 1 and Plan 2 under 'Applies to'; it doesn't state a separate licence for these controls.

How to do it
  1. Open the outbound spam filter policy in the Microsoft Defender portal.
  2. Check the automatic forwarding setting, and set it explicitly to Off, or On only for the users who need it.
  3. Open the Auto forwarded messages report to see which users are forwarding externally.
  4. Investigate any forwarding nobody can explain, as a possible compromised account.

Based on Microsoft's documentation, checked October 2026. Microsoft Learn has the current steps.

Read our guide: Suspicious inbox rules and forwarding in Microsoft 365, explainedOfficial reference: Microsoft Learn: Control automatic external email forwarding

Does each domain used for email have SPF, DKIM and a DMARC policy, moving towards p=reject, with reports going to a dedicated mailbox?

Why it matters: DMARC helps receiving mail systems spot email pretending to come from your domain, which is used in business email compromise and phishing. Microsoft describes setting up SPF and DKIM first, starting DMARC at p=none, then moving gradually to quarantine and reject.

Licensing: Microsoft's page doesn't state a licence requirement for DMARC; it lists Exchange Online Protection (built into all cloud mailboxes) under 'Applies to'.

How to do it
  1. Check SPF and DKIM are set up for every custom domain and subdomain that sends email.
  2. Check each domain's DMARC record and current policy (none, quarantine or reject).
  3. Send aggregate (rua) reports to a dedicated mailbox or group, not a person's inbox, as Microsoft describes.
  4. After monitoring, move gradually from p=none to p=quarantine to p=reject.
  5. For domains that never send email, Microsoft describes a DMARC record with p=reject.

Based on Microsoft's documentation, checked October 2026. DNS changes are made at the domain registrar or DNS host; Microsoft Learn has the current steps.

Read our guide: SPF, DKIM and DMARC for Microsoft 365, explainedOfficial reference: Microsoft Learn: Set up DMARC to validate the From address

Are the Standard or Strict preset security policies applied to users, rather than relying only on defaults?

Why it matters: Microsoft says preset policies are based on its datacenter observations and balance keeping harmful content out with avoiding disruption. Standard and Strict apply to no one until they're turned on and users are assigned.

Licensing: EOP protections in the presets apply to all cloud mailboxes. Microsoft says the Defender for Office 365 parts (Safe Links, Safe Attachments, impersonation protection) need Microsoft 365 E5 or a Defender for Office 365 subscription.

How to do it
  1. Open Preset security policies in the Microsoft Defender portal.
  2. Turn on Standard protection for most users and consider Strict for high-value or priority users, as Microsoft describes the profiles.
  3. Assign recipients for both the EOP and Defender for Office 365 protections.
  4. Microsoft advises against creating, changing or removing the individual policies behind the presets.

Based on Microsoft's documentation, checked October 2026. Microsoft Learn has the current steps.

Read our guide: Defender for Office 365 and built-in email protection, explainedOfficial reference: Microsoft Learn: Preset security policies

Devices

If devices are managed with Intune, does a Conditional Access policy require them to be compliant?

Why it matters: Microsoft describes device compliance policies as making sure devices meet minimum configuration requirements, and Conditional Access as the way to enforce them when users sign in. It warns that without an Intune compliance policy the Conditional Access policy won't work as intended.

Licensing: This uses Conditional Access (at least Microsoft Entra ID P1) and Microsoft Intune. The policy page doesn't state licensing; Microsoft's licensing pages have the details.

How to do it
  1. Confirm Intune compliance policies exist and at least one device shows as compliant.
  2. Create or review a Conditional Access policy that requires a compliant device.
  3. Exclude emergency access accounts and directory synchronisation accounts, as Microsoft describes.
  4. Start in report-only mode, check the impact, then switch the policy on.

Based on Microsoft's documentation, checked October 2026. Microsoft Learn has the current steps.

Read our guide: Intune and device security basics for small organisationsOfficial reference: Microsoft Learn: Require a compliant device

Data protection

If Microsoft Copilot is in use, has overshared content been found and fixed, so Copilot only surfaces what people should see?

Why it matters: Microsoft explains that Copilot uses data the user already has permission to access. That means sites and files shared more widely than intended can appear in answers. Microsoft describes finding overshared, ownerless and inactive sites, and excluding sensitive sites from Copilot discovery.

Licensing: Microsoft lists a Microsoft Copilot licence, SharePoint Advanced Management (included with Copilot licences), and at least the foundational Microsoft Purview capabilities included in Microsoft 365 E3, with some features in E5 or E7.

How to do it
  1. Run the SharePoint Advanced Management assessments Microsoft describes, to find sites with oversized audiences or inappropriate sharing.
  2. Ask owners of high-risk sites to review access, and assign owners to ownerless sites.
  3. Use Restricted Content Discovery to exclude sensitive sites from Copilot discovery.
  4. Apply sensitivity labels to sites and files that need them, as Microsoft describes.

Based on Microsoft's documentation, checked October 2026. Copilot and agent features change often; Microsoft Learn has the current steps. The linked Microsoft page covers Copilot's access to data; it doesn't cover agent-specific controls.

Read our guide: SharePoint oversharing and Copilot, explainedOfficial reference: Microsoft Learn: Configure a secure and governed data foundation for Microsoft 365 Copilot

Is there a backup of Exchange, OneDrive and SharePoint data, with a restore tested?

Why it matters: The ACSC's small business cloud guidance notes Microsoft's service agreement recommends third-party backups. Microsoft also offers Microsoft 365 Backup, which it describes as covering SharePoint sites, OneDrive accounts and Exchange mailboxes with immutable backups.

Licensing: Microsoft describes Microsoft 365 Backup as a pay-as-you-go offering charged on consumption, unlike per-user licences. Pricing varies; check Microsoft's page.

How to do it
  1. Check which backup product covers the tenant's mailboxes, OneDrive accounts and SharePoint sites.
  2. Check the recovery window. Microsoft describes Microsoft 365 Backup policies of 3 months, 6 months, 1 year or 2 years.
  3. Check who can change or delete backups.
  4. Test restoring an item and record the result.

Based on Microsoft's documentation and the ACSC's small business cloud security guidance, checked October 2026. Microsoft Learn has the current steps.

Read our guide: Microsoft 365 backup: what's built in and how options differOfficial reference: ACSC: Technical example – regular backups

Your checklist

Answer the questions above. Your checklist updates as you go.

General information based on official guidance and makers’ instructions, not advice about your situation.

Sources