The Microsoft 365 Security Checklist Most Tenants Are Missing

Most Microsoft 365 tenants we look at are running on a mix of default settings and whatever got configured during initial rollout. The licensing for real security capability is often already there (Entra ID P1/P2, Defender for Office 365), it just isn't turned on or tuned.

Identity

• Block legacy authentication. Protocols like POP, IMAP and older Exchange ActiveSync don't support modern authentication and are a common target for password-spray attacks. Block them via Conditional Access unless you have a specific, documented exception.
• Enforce MFA for everyone, including admins. Security Defaults gives baseline MFA, but Conditional Access policies give you the control to also factor in device compliance and location, worth the move once you're past the basics.
• Put admin roles under Privileged Identity Management. Standing Global Admin access is one of the highest-value single things to eliminate. PIM makes privileged roles time-bound and require justification.
• Turn on sign-in risk and user risk policies. Entra ID Protection can require additional verification or block sign-in entirely when it detects atypical travel, leaked credentials, or other risk signals, if you're licensed for it, it's usually not enabled by default.

Email & data

• Enable Safe Links and Safe Attachments in Defender for Office 365, not just baseline anti-spam filtering.
• Disable automatic external mail forwarding by default. This is a common exfiltration technique after a mailbox compromise: a forwarding rule quietly created by an attacker, easy to miss without monitoring.
• Turn on mailbox audit logging. Without it, investigating "was this mailbox actually accessed" after a suspected compromise is much harder.

Applications

• Restrict user consent to third-party apps. Left open, any user can grant an unverified app access to their mailbox or files, a well-known path for OAuth-based phishing.
• Review existing app permissions periodically. Over time, tenants accumulate app registrations nobody remembers granting.

Where to start if you can only do a few things

In order of impact for most organisations: block legacy authentication, enforce MFA everywhere via Conditional Access, restrict third-party app consent, and turn on mailbox audit logging. Each of these addresses a genuinely common real-world attack path, not a theoretical one.