A Microsoft 365 Tenant Security Baseline You Can Check in an Afternoon

A new or inherited Microsoft 365 tenant can be checked against a practical security baseline in one afternoon. This is not an audit and it will not find everything. It is a read-first checklist covering the settings that most often matter: MFA and Conditional Access, legacy authentication, admin roles, mailbox auditing, forwarding, and external sharing. Look before you change anything, record what you find, and change one thing at a time.

Before you start

You need an account with read access to the Microsoft Entra admin center, the Exchange admin center, the Microsoft Defender portal and the SharePoint admin center. A Global Reader role covers much of it, but some pages need a more privileged role, so use the least that works. Take screenshots or notes as you go. Plan an hour per area, and expect to find questions rather than answers.

1. MFA and Conditional Access (about 45 minutes)

Find out which of two models the tenant uses. Security defaults are a set of preconfigured protections that Microsoft documents here: Security defaults in Microsoft Entra ID. Conditional Access gives finer control but needs appropriate licensing. The two cannot run at the same time, so check which is active before assuming anything.

If security defaults are on, note that and confirm there is a plan if the organization outgrows them. If Conditional Access is used, open each policy and record:

• Which users, groups and apps it targets, and which are excluded.
• What it requires: MFA, compliant device, a location, or a block.
• Whether it is on, off or in report-only mode.

Questions to ask: Is MFA required for administrators? For all users? Are there broad exclusions, such as a group that has quietly accumulated members? Are emergency access accounts excluded as intended, and only those? Microsoft's overview of the feature is here: What is Conditional Access?.

Then check registration. Look at the authentication methods registration report to see how many users have no MFA method registered. Pay attention to the method itself: SMS and voice are weaker than an authenticator app, and phishing-resistant methods such as passkeys or FIDO2 keys are stronger still.

2. Legacy authentication (about 20 minutes)

Legacy protocols such as basic authentication for POP, IMAP and older clients cannot do multifactor authentication, which is why Microsoft recommends blocking them. Microsoft's guidance is here: Block legacy authentication with Conditional Access.

Check whether a block exists. Then look at the sign-in logs and filter by client app for legacy clients over the last 30 days, so you know what would break. Old scanners, line-of-business apps and service accounts are the usual cause. Do not turn on a block without that list; create the policy in report-only mode first, review the impact, and move the dependent devices or apps to modern authentication.

3. Admin roles (about 30 minutes)

In the Entra admin center, list who holds privileged roles, and Global Administrator first. Microsoft recommends assigning Global Administrator to fewer than five people and keeping two cloud-only emergency access accounts. The guidance is in Best practices for Microsoft Entra roles, and the emergency account design is in Manage emergency access accounts.

For each privileged account, ask:

• Is it a named person, a shared account, or a service?
• Does the person still work here and still need the role?
• Is it also the person's daily mailbox account? Admins should use a separate account for administration where practical.
• Is the role the narrowest that does the job, or is Global Administrator being used for convenience?

Where Privileged Identity Management is licensed, check whether roles are eligible rather than permanent. Also look at service principals and app registrations with admin consent, as they can hold broad permissions without appearing in the user list.

4. Mailbox auditing (about 15 minutes)

Mailbox auditing records actions taken in mailboxes and is enabled by default for Microsoft 365 organizations. Verify it rather than assuming. In Exchange Online PowerShell, this read-only check shows whether the organization setting disables it:

Get-OrganizationConfig | Format-List AuditDisabled

A value of False means auditing is not disabled at the organization level. Microsoft's reference is Manage mailbox auditing. Also confirm that the unified audit log is on and that you know how long records are retained for your license, because that decides how far back an investigation can look.

5. Forwarding and inbox rules (about 30 minutes)

Automatic forwarding to external addresses is a common step in business email compromise. Check the outbound spam policy in the Defender portal and see how automatic forwarding is set; Microsoft recommends setting it explicitly to Off rather than relying on the system-controlled default. Details are here: Configure outbound spam policies.

Then look for existing forwarding. Review mailboxes that have forwarding configured on the mailbox itself, and review mail flow rules that redirect or copy mail externally. For user inbox rules that forward or delete, see the read-only approach in our inbox rule investigation guide. A forwarding rule is a lead to verify with the mailbox owner, not proof of compromise.

6. External sharing (about 30 minutes)

In the SharePoint admin center, check the tenant-level external sharing setting and compare it with each site's setting; a site cannot be more permissive than the tenant. Note whether anonymous links are allowed, how long they last, and whether guests can reshare. Then look at the guest users listed in Entra ID and ask who invited them and whether they are still needed. Microsoft's overview is Overview of external sharing in SharePoint and OneDrive.

For tenants preparing for Copilot, oversharing deserves extra attention; see our guide on SharePoint oversharing.

Write down what you found

End with a short list in three columns: what is fine, what needs a decision, and what needs a change with an owner. Resist fixing everything that afternoon. Several of these changes, particularly blocking legacy authentication and tightening Conditional Access, can lock out real users or systems if applied without preparation.

Limits and when to get help

This checklist covers six areas and ignores many others, including device management, email authentication records, data loss prevention and backup. Licensing changes what is available. If you find signs of compromise, such as unknown forwarding, unfamiliar admin accounts or unexplained sign-ins, treat it as an incident: preserve logs, do not delete anything, and bring in someone experienced before you start remediation.