Microsoft 365 Security Readiness Checklist

Do you have at least two emergency access (break-glass) accounts, protected with phishing-resistant sign-in and excluded from policies that could lock everyone out?

Why it matters: Microsoft's documentation describes two or more cloud-only emergency access accounts as a way back into a tenant if normal admin access fails. It describes protecting them with phishing-resistant methods and excluding them from Conditional Access policies that block or restrict sign-in.

Read our guide: Microsoft 365 security baseline: the settings Microsoft's guidance coversOfficial reference: Microsoft: manage emergency access accounts

Is multifactor authentication required for every user, through security defaults or Conditional Access?

Why it matters: Microsoft describes security defaults as a baseline for organisations on the free tier of Microsoft Entra ID, which requires every user to register for multifactor authentication. It describes Conditional Access as fully customisable.

Licensing: Microsoft's comparison lists no licence requirement for security defaults and at least Microsoft Entra ID P1 for Conditional Access.

Read our guide: Security defaults vs Conditional Access: how they differOfficial reference: Microsoft: security defaults

Is legacy authentication blocked?

Why it matters: Microsoft explains that legacy protocols don't support multifactor authentication and recommends blocking them. Its documentation notes that security defaults block legacy authentication, and describes a Conditional Access policy that does the same.

Read our guide: Security defaults vs Conditional Access: how they differOfficial reference: Microsoft: block legacy authentication

Do administrators sign in with phishing-resistant methods such as passkeys, FIDO2 security keys or Windows Hello for Business?

Why it matters: Microsoft notes that accounts with privileged administrative roles are frequent targets of attackers, and that requiring phishing-resistant multifactor authentication for them reduces the risk of compromise.

Licensing: This is set up with a Conditional Access policy, which Microsoft lists as needing at least Microsoft Entra ID P1.

Read our guide: Microsoft 365 MFA methods compared, from SMS to passkeysOfficial reference: Microsoft: require phishing-resistant MFA for administrators

Is the number of Global Administrators kept small, and are admin role assignments reviewed regularly?

Why it matters: Microsoft's best practices for Microsoft Entra roles describe least privilege, recommend assigning Global Administrator to fewer than five people, and describe recurring access reviews to remove role assignments that are no longer needed.

Read our guide: Microsoft 365 security baseline: the settings Microsoft's guidance coversOfficial reference: Microsoft: best practices for Microsoft Entra roles

Is user consent to applications restricted, with an admin consent workflow for requests?

Why it matters: Microsoft's documentation describes restricting user consent to reduce the risk of malicious applications tricking users into granting access to organisational data. It describes the admin consent workflow as a way for users to request an administrator's review of an app.

Read our guide: App consent in Microsoft Entra ID and consent phishing, explainedOfficial reference: Microsoft: configure how users consent to applications

Are users covered by the Standard or Strict preset security policies?

Why it matters: Microsoft describes preset security policies as applying its recommended settings for anti-spam, anti-malware and anti-phishing protection. It describes Standard as a baseline suitable for most users and Strict as a more aggressive profile for high-value targets.

Licensing: Microsoft's documentation lists Safe Links, Safe Attachments and the impersonation settings in anti-phishing policies under Microsoft Defender for Office 365 (included in Microsoft 365 E5 or available as an add-on).

Read our guide: Microsoft 365 security baseline: the settings Microsoft's guidance coversOfficial reference: Microsoft: preset security policies

Is automatic external forwarding explicitly set to Off, with exceptions only for approved mailboxes?

Why it matters: Microsoft explains that the 'Automatic - System-controlled' forwarding setting can behave differently between organisations, and recommends configuring On or Off instead.

Read our guide: Suspicious inbox rules and forwarding in Microsoft 365, explainedOfficial reference: Microsoft: control automatic external email forwarding

Does every custom domain that sends email have SPF, DKIM and DMARC records?

Why it matters: Microsoft describes SPF, DKIM and DMARC as interdependent building blocks that work together to protect against spoofing and phishing, and states that anything less than all three results in substandard protection.

Read our guide: SPF, DKIM and DMARC for Microsoft 365, explainedOfficial reference: Microsoft: how email authentication works

Do your onmicrosoft.com domain and any domains you don't send email from have a DMARC reject policy?

Why it matters: Microsoft's DMARC guidance describes adding a DMARC record with p=reject for registered domains that never send email, including the onmicrosoft.com domain when it isn't used for email.

Read our guide: SPF, DKIM and DMARC for Microsoft 365, explainedOfficial reference: Microsoft: set up DMARC

Does someone review alerts about suspicious inbox rules, forwarding and blocked senders?

Why it matters: Microsoft's default alert policies include alerts for the creation of forwarding or redirect rules, suspicious email forwarding activity and users restricted from sending email. Microsoft notes that a restricted user typically indicates a compromised account.

Licensing: Microsoft's alert policy list shows which subscriptions include each default alert.

Read our guide: Suspicious inbox rules and forwarding in Microsoft 365, explainedOfficial reference: Microsoft: alert policies

Have you reviewed the SharePoint and OneDrive external sharing level for your organisation?

Why it matters: Microsoft's documentation describes four organisation-level sharing levels, from 'Anyone' to 'Only people in your organization', and notes that the OneDrive setting can be more restrictive than the SharePoint setting but not more permissive.

Read our guide: SharePoint oversharing and Copilot, explainedOfficial reference: Microsoft: manage sharing settings for SharePoint and OneDrive

Are 'Anyone' links turned off, or set to expire?

Why it matters: Microsoft describes Anyone links as giving access without signing in. Its documentation describes settings that make Anyone links expire within a set number of days or limit them to view-only access.

Read our guide: SharePoint oversharing and Copilot, explainedOfficial reference: Microsoft: manage sharing settings for SharePoint and OneDrive

Are guest accounts reviewed regularly and removed when no longer needed?

Why it matters: Microsoft describes access reviews as a way for guests or a decision maker to re-certify guest access, after which access can be removed for guests who no longer need it.

Licensing: Microsoft lists Microsoft Entra ID P2 or Microsoft Entra ID Governance as required for access reviews.

Official reference: Microsoft: manage guest access with access reviews

If you use or plan to use Microsoft 365 Copilot, have you reviewed oversharing in SharePoint first?

Why it matters: Microsoft explains that Copilot uses data each user already has permission to access. Its guidance describes using Microsoft Purview and SharePoint Advanced Management to find overshared sites and files that could be surfaced by Copilot.

Licensing: Microsoft states that SharePoint Advanced Management is included with Copilot licences, that foundational Purview capabilities are included in Microsoft 365 E3, and that some optimised features are included in Microsoft 365 E5 or E7.

Read our guide: SharePoint oversharing and Copilot, explainedOfficial reference: Microsoft: secure and governed foundation for Copilot

Are company devices managed, for example with Microsoft Intune, and is a compliant device required to access company data?

Why it matters: Microsoft explains that Intune device compliance policies set minimum configuration requirements, and that a Conditional Access policy can require a device to be marked as compliant before it can access services.

Licensing: Microsoft's Intune licensing page lists Intune Plan 1 as included in Microsoft 365 Business Premium, E3 and E5, among others. Conditional Access needs at least Microsoft Entra ID P1.

Official reference: Microsoft: require device compliance with Conditional Access

Do company devices install operating system and application updates automatically?

Why it matters: Patch applications and patch operating systems are two of the eight mitigation strategies in the Australian Signals Directorate's Essential Eight.

Official reference: ACSC: Essential Eight explained

Is audit logging on, and does someone review sign-in logs or alerts?

Why it matters: Microsoft states that audit log search is turned on by default for Microsoft 365 and Office 365 enterprise organisations, and describes a PowerShell command to confirm it. Its documentation lists how long audit records are kept for different licences.

Licensing: Microsoft states that audit records are kept for 180 days for non-E5 licences and one year by default for E5 licences or the relevant add-ons.

Read our guide: Compromised Microsoft 365 account: what Microsoft's response guide describesOfficial reference: Microsoft: search the audit log

Do you review Microsoft Secure Score and its recommended actions regularly?

Why it matters: Microsoft describes Secure Score as a measure of how far an organisation is using security controls that can help offset the risk of being breached. It states that Secure Score isn't an absolute measurement and shouldn't be interpreted as a guarantee against a breach.

Official reference: Microsoft: Secure Score

Do you know how you would restore OneDrive, SharePoint and mailbox data, and has a decision been made about whether a separate backup is needed?

Why it matters: Microsoft describes Microsoft 365 Backup as a service that can back up all or selected SharePoint sites, OneDrive accounts and Exchange mailboxes. Its overview lists the restore points and recovery windows the service offers.

Licensing: Microsoft describes Microsoft 365 Backup as a pay-as-you-go offering charged on consumption rather than per user.

Read our guide: Microsoft 365 backup: what's built in and how options differOfficial reference: Microsoft: overview of Microsoft 365 Backup