A Microsoft 365 security review is an identity review with a mail server attached. Almost every finding we write in a growing firm’s tenant traces back to one of five surfaces: who can sign in and how, who holds standing privilege, what leaves the tenant by mail or sharing link, what is being logged and for how long, and what happens to the data if an account is taken over. This checklist is the evidence list we work from, organized so an internal IT lead can pull it in an afternoon.
If you want that evidence list as a single fill-in sheet to hand to whoever owns the tenant, use our Microsoft 365 & identity evidence checklist.
Want to put this into practice? Use our free Cyber Risk Self-Assessment.
Two framing notes before the list. First, this is a manual advisory review of client-provided configuration and exports — a structured, point-in-time read that produces an evidence register, findings, and remediation priorities. It is not an automated scan, not hardening, not monitoring, and it does not make anyone compliant with anything. Second, the tenant’s own tooling does a lot of the work for free; a reviewer who cannot tell you what the built-in tooling already reported is not adding much.
Before you start: the two free reads
Microsoft’s built-in secure score is a posture measurement where each recommended action is worth ten points or less and most are scored in a binary fashion — implement the setting, take the points. It is a useful map of what the platform thinks you have not turned on. It is not a risk assessment: it does not know which of your data is regulated, which accounts pay invoices, or which recommendation would break a business process. Treat it as an input, not a verdict.
CISA’s Secure Cloud Business Applications (SCuBA) project publishes secure configuration baselines for Microsoft 365 and a no-cost assessment tool, ScubaGear, that checks a tenant against them. CISA established SCuBA in 2022 after SaaS intrusions exposed visibility gaps, and has made the baselines and tooling available to private-sector organizations, not just federal agencies. Running it before a review costs nothing and converts half the checklist below into a report you already hold.
1. Authentication: who can sign in, and with what
| Evidence to pull | What we look for |
|---|---|
| MFA registration and enforcement by population | Coverage gaps in service accounts, shared mailboxes, executives, contractors, and break-glass accounts — the populations most often excluded “temporarily” |
| Legacy authentication status | Whether legacy protocols are blocked. Microsoft’s own position is that MFA plus blocking legacy authentication stops more than 99.9% of common identity attacks |
| Security defaults or policy-based access | Which model the tenant is on, and whether it matches the licensing |
| Break-glass account configuration | Existence, exclusion from policy, credential custody, and whether sign-ins are alerted on |
| Password and lockout settings | Alignment with current guidance rather than legacy rotation habits |
Two specifics worth knowing. Security defaults is the free baseline: it requires all users to register for multifactor authentication, requires administrators to perform it, blocks legacy authentication protocols, blocks device code flow, and protects privileged activities. Microsoft has enabled it at creation for tenants created on or after October 22, 2019. If an organization holds premium identity licensing or has genuinely complex access requirements, Microsoft’s guidance is that security defaults are probably not the right model and Conditional Access should be used instead.
The Conditional Access detail buyers most often miss: policies are enforced after first-factor authentication completes. Conditional Access is a policy engine, not a perimeter, and it is not designed to be the frontline defense against volumetric attacks. That matters when someone assumes a location-based policy is stopping credential stuffing at the door — it is not; it is deciding what happens after the password already matched.
2. Privilege: who holds standing admin rights
Standing global administrator membership is the finding we write most often, and it is almost always larger than the org chart implies. Pull:
- Full membership of every privileged directory role, with last-sign-in and last-role-use dates.
- Whether privileged roles are permanently assigned or activated just in time. Privileged Identity Management provides just-in-time privileged access and oversight of what privileged users do with it, and requires identity governance licensing — a real budget question, not a checkbox.
- Application and service-principal permissions, especially consented delegated and application permissions that read mail or files tenant-wide.
- Guest and external user inventory with what each guest can reach.
- Administrative accounts that are also someone’s day-to-day mailbox.
Where licensing does not support just-in-time activation, the compensating control is a documented, reviewed, and small standing set with alerting on role changes — not an aspiration to fix it later.
3. Mail flow and data egress
Business email compromise is a process failure with a technical assist, which is why this section pairs configuration with workflow.
- Forwarding. Inventory of mailbox forwarding rules and transport rules that route mail externally. Auto-forwarding created by an attacker is quiet, persistent, and frequently survives a password reset.
- Mail authentication. SPF, DKIM, and DMARC records and enforcement posture for every sending domain, including the ones marketing registered.
- Sharing posture. Default sharing scope for files and sites, anonymous link policy and expiry, and the count of live anonymous links.
- External sender indicators. Whether recipients can see at a glance that a message originated outside the tenant.
- Payment-change workflow. The out-of-band verification step before a bank-detail change is actioned. This is the control that stops the loss; the mail configuration only reduces the volume of attempts.
That last row is where the money is. The FBI’s 2025 Internet Crime Report records 24,768 business email compromise complaints with reported losses of $3,046,598,558 — a fraction of the complaint volume of consumer fraud categories, and a far larger share of the dollars. A tenant can be well configured and still lose a wire if nobody is required to pick up a phone.
4. Logging and retention: can you reconstruct it later
The question an incident makes urgent is what an attacker did between first access and detection. That is answerable only if the log window is longer than the dwell time.
The Microsoft 365 unified audit log captures user and admin operations across the service and, under the standard auditing tier, retains records for 180 days — raised from a 90-day default that still governs records generated before October 17, 2023. Premium auditing adds retention policies, longer default retention for core workloads, and higher-bandwidth programmatic access; ten-year retention requires a specific add-on license per user. Whichever tier applies, confirm three things: that the log is on, who has permission to search it, and whether anything exports it somewhere that outlives the native window.
Also inventory sign-in log retention, alerting on privileged role changes and impossible-travel events, and whether anyone actually receives those alerts at an address they read.
5. Recovery: what survives an account takeover
Mailbox and file recovery inside the tenant is not the same as a backup, and the distinction becomes expensive during an incident. Record retention and litigation-hold posture, deleted-item and version-history windows, whether a separate copy of tenant data exists outside the tenant, and — the item that decides everything — the date and result of the last documented restore test. We treat an untested restore path as an unverified control; the reasoning is in how to prove your backups will actually restore.
Turning the checklist into a finding
The difference between a checklist and an assessment is that an assessment says what a gap means. Our pattern for each item: the observed configuration, the evidence source and date, the exposure it creates in this environment, a severity, and a remediation with an owner and a dependency. “MFA coverage is 87%” is an observation. “Thirteen accounts without MFA include two with mailbox delegate rights over the finance shared mailbox; remediate ahead of the sharing-policy work because it is a prerequisite for the conditional policy in item 4” is a finding.
That output is what a Microsoft 365 and identity security assessment delivers: a structured, point-in-time manual advisory review of client-provided Microsoft 365 and Entra portal configuration and exports, with an evidence register, severity-ranked findings, and remediation priorities. Implementation, hardening, and monitoring are separately scoped — we do not review and remediate under the same engagement, because the independence is the point.
For organizations working out where identity sits in a broader program, what a cybersecurity risk assessment includes and costs covers the wider scope, and vCISO vs MSP vs MDR: who owns what covers who is supposed to fix any of it.
FAQ
What should a Microsoft 365 security assessment cover?
Five surfaces: authentication (MFA coverage by population, legacy authentication status, and which access-policy model the tenant uses), privilege (standing administrative role membership, just-in-time activation, and application and service-principal permissions), mail flow and data egress (forwarding rules, SPF/DKIM/DMARC, sharing and anonymous-link policy, and the out-of-band payment-verification workflow), logging and retention (unified audit log status, retention window, and alerting), and recovery (retention, holds, external copies, and the last documented restore test).
Is Microsoft Secure Score enough on its own?
No. Secure score measures posture against Microsoft’s recommended actions, scoring each at ten points or less and most in a binary fashion. It does not know which data is regulated, which accounts move money, or which recommendation would break a business process. It is a strong input to a review and a poor substitute for one.
Should we use security defaults or Conditional Access?
Security defaults is the free baseline that requires MFA registration for all users, requires administrator MFA, blocks legacy authentication and device code flow, and protects privileged activities. Microsoft’s guidance is that organizations with premium identity licensing or complex security requirements should use Conditional Access instead. Note that Conditional Access policies are enforced after first-factor authentication completes, so they govern what happens after a password matches rather than acting as a frontline perimeter.
How long does Microsoft 365 keep audit logs?
Under the standard auditing tier the unified audit log retains records for 180 days. Records generated before October 17, 2023 follow the previous 90-day default. Premium auditing adds retention policies and longer default retention for core workloads, and ten-year retention requires an additional per-user add-on license.
Does DSE implement the fixes it finds?
The assessment is a manual advisory review that produces an evidence register, findings, and remediation priorities. Implementation, hardening, and ongoing monitoring require separately evidenced scope, and where a qualified network specialist delivers any part of that work, the delivery model is disclosed. Keeping assessment and remediation in separate engagements preserves the independence that makes the finding credible.
What this guide is / What it is not
What it is: A practitioner evidence checklist for a point-in-time manual advisory review of a Microsoft 365 and Microsoft Entra ID tenant, referencing Microsoft Learn product documentation, CISA’s SCuBA secure configuration baselines, and the FBI IC3 2025 Internet Crime Report. What it is not: Legal advice, an audit, a certification, an attestation, a penetration test, an automated tenant scan, or a guarantee that any configuration prevents compromise. DSE’s Microsoft 365 and Entra work is advisory and evaluation only — implementation, hardening, and monitoring require separate scope and evidence. DSE holds no vendor partner, reseller, or certification status and does not resell licenses. Findings reflect the tenant as configured during the review window.
The Bottom Line
Work the identity surface first, because that is where the severity concentrates and where every other control inherits its assumptions. Pull the free reads — the tenant’s own secure score and a SCuBA baseline check — before paying anyone to look, so the engagement starts on analysis rather than discovery. Then hold the review to a real deliverable: observed configuration, evidence source and date, exposure in your environment, severity, and a remediation with an owner. A checklist tells you what to look at; only that structure tells you what to do on Monday.
Key facts
- Microsoft states that more than 99.9% of common identity-related attacks are stopped by using multifactor authentication and blocking legacy authentication, and that security defaults have been rolled out at creation to tenants created on or after October 22, 2019 (Microsoft Learn, 2026).
- The Microsoft 365 unified audit log retains records for 180 days under the standard auditing tier, an increase from the 90-day default that still applies to records generated before October 17, 2023 (Microsoft Learn, 2026).