Microsoft 365 security checklist: 15 settings to check this month

Microsoft secures the platform; you are responsible for how your tenant is configured. Some of the items below depend on your licence, which is noted where it matters. None of them replace a full review against the CIS Microsoft 365 Benchmark, but together they close the gaps attackers use most.

Identity and sign-in

1. Multi-factor authentication for every user. No exceptions for executives, shared mailboxes with sign-in enabled or service accounts that can use an alternative. Check enforcement, not just registration.
2. Legacy authentication blocked. Older protocols such as POP, IMAP and basic SMTP sign-in cannot use MFA and are a favourite route in.
3. Conditional Access policies in place. Sign-ins should be checked against the user, device, location and risk, not just a password and a code. Requires Microsoft Entra ID P1 or a plan that includes it, such as Business Premium.
4. Separate, protected admin accounts. Administrators should use a dedicated cloud-only admin account with phishing-resistant MFA, and an ordinary account for email and browsing. Keep the number of Global Administrators small.
5. User consent to apps restricted. Stop users granting third-party apps access to mailboxes and files without an administrator's approval.

Email

6. SPF, DKIM and DMARC published, with DMARC enforced. A DMARC policy of "none" only monitors. Work towards quarantine or reject so others cannot send email as your domain. See Email Security and DMARC.
7. Anti-phishing, Safe Links and Safe Attachments configured. These Microsoft Defender for Office 365 protections need policies applied to all users to be effective.
8. Automatic forwarding to external addresses blocked. Attackers who get into a mailbox often set up a forwarding rule to keep reading mail after the password is changed.

Data and sharing

9. External sharing limits set in SharePoint and OneDrive. Decide who can share outside the organisation and whether "anyone with the link" is allowed, and set links to expire.
10. Sensitivity labels and data loss prevention for sensitive information. Label and protect records such as health, financial and identity information, so they cannot be emailed or shared by mistake.
11. Microsoft 365 backed up independently. Microsoft keeps the service available, but retention settings are not a backup against deletion, ransomware or a compromised admin account. See Cloud and Microsoft 365 Backup.

Devices

12. Devices managed and compliant. Use Microsoft Intune to require encryption, a screen lock and current updates, and let only compliant devices reach company data.
13. Endpoint detection and response on every device. Antivirus alone is not enough. See Endpoint Protection and EDR.

Monitoring

14. Audit logging on and alerts going to a person. Confirm the unified audit log is enabled and that alerts for events such as new forwarding rules, mass downloads and admin role changes reach someone who will act.
15. Secure Score reviewed regularly. Microsoft Secure Score lists recommended actions for your tenant. Review it monthly and treat a falling score as a prompt to investigate.

How did you go?

If you could not answer several of these with confidence, you are in good company: most tenants we review run close to default settings. Our Secure Microsoft 365 service assesses your tenant against the CIS Microsoft 365 Benchmark and the Essential Eight, closes the gaps and keeps it that way with continuous monitoring. Or start with a security review.