Account and workload inventory
Map every active user, guest, break-glass account, workload identity, and high-impact application.
Secure Microsoft 365 With a Practical, Evidence-Led Control Guide
Assess and strengthen Microsoft 365 identity, admin access, email, collaboration, data protection, endpoints, monitoring, recovery, and remediation with practical technical guidance.
Microsoft 365 security control areas
Review the tenant in the order risk travels
Identity creates the access decision. Administrator privilege changes the tenant. Email and collaboration move data. Endpoint, security operations, recovery, and remediation determine whether the organization can prevent, detect, contain, and improve.
01Identity and accessControl Microsoft 365 sign-in, MFA, Conditional Access, resilience, and evidence.02Administrator accessReduce standing privilege and validate tenant role governance.03Email protectionHarden Exchange Online against phishing, malware, BEC, and spoofing.04Collaboration securityControl sharing, guests, site ownership, Teams apps, and session exposure.05Data protectionApply information protection, DLP, retention, records, and discovery controls.06Endpoint accessRequire compliant managed endpoints before Microsoft 365 data access.07Security operationsCorrelate alerts, audit, hunting, evidence, and incident response.08Recovery readinessValidate recovery mechanisms, coverage, restore testing, and ownership.09Risk remediationSequence findings, change safely, retest, and govern residual risk.
Tenant control baseline
Start a 60-control review with 18 high-value checks
Begin with the controls that most often reveal access, administrative, and email-security gaps. The full guide expands these prompts into evidence-led validation.
A checklist helps structure the review; it does not replace a professional cybersecurity audit, compliance assessment, penetration test, or legal/compliance review.
Access foundations
Establish a defensible sign-in baseline
Map who and what can access the tenant, use modern authentication methods, and validate recovery paths before enforcing policy.
Sign-in method governance
Confirm an authentication-method policy is current and legacy MFA/SSPR policy management is no longer relied upon.
Phishing-resistant authentication
Require strong MFA for privileged roles and test phishing-resistant methods for high-risk users.
Emergency access readiness
Maintain at least two controlled emergency access accounts with separate credential storage and scheduled sign-in tests.
Conditional Access design
Target Conditional Access policies deliberately, capture report-only results, and document exclusions.
Legacy protocol containment
Block or control legacy authentication paths before treating modern sign-in controls as complete.
Administrative governance
Reduce standing privilege and record each elevated decision
Inventory sensitive rights, use time-bound elevation where available, and certify access on a documented cadence.
Administrator role inventory
Inventory Global Administrators, role assignments, group-based assignments, delegated administration, and service principals.
Just-in-time elevation
Replace routine permanent high privilege with eligible, time-bound PIM assignments where licensing supports it.
Activation safeguards
Require activation justification, an approver, notification, and finite activation duration for sensitive roles.
Scope boundary review
Review role-assignable groups and administrative units for scope creep.
Recurring access certification
Schedule recurring reviews for tenant administrators, guests with elevated access, and application owners.
Decision evidence retention
Preserve exported role assignments and completed review decisions as evidence.
Messaging resilience
Make email protection measurable at the tenant boundary
Set a deliberate Defender baseline, reduce bypass paths, and validate domain authentication against actual mail flow.
Defender policy baseline
Confirm the tenant has an intentional baseline: built-in, Standard, Strict, or documented custom Defender policies.
Link protection coverage
Review Safe Links coverage for email, supported Office apps, and Teams when licensing and workload scope support it.
Attachment protection coverage
Review Safe Attachments coverage, dynamic delivery behavior, and exclusions.
Impersonation defense
Protect impersonated users and domains, and validate anti-spoofing outcomes against real mail flow.
Forwarding and bypass controls
Inspect external forwarding controls, mail flow rules, and allow entries that could bypass protection.
Domain authentication enforcement
Verify SPF, DKIM, and a tested progressive DMARC policy for each outbound domain and relevant subdomain.
Control review continuation
Expand the review into practical tenant governance
Use these prompts to examine how workload settings, data controls, endpoint health, operations, recovery, and change decisions combine into a defensible Microsoft 365 operating model.
Review area 01
Shared workspaces and guest access
Set clear boundaries for external sharing, guest participation, and the services that support team work.
Control 01
External sharing posture
Review tenant and site-level external sharing settings; record the most permissive effective level.
Control 02
Anonymous link exposure
Locate anonymous links, broad anyone links, stale guests, and sites without accountable owners.
Control 03
Guest access lifecycle
Set a policy for guest invitation, shared channels, cross-tenant access, and guest lifecycle.
Control 04
Sensitivity label boundaries
Use sensitivity labels where appropriate to apply collaboration boundaries to Teams and sites.
Control 05
Teams application governance
Review Teams app permissions, org-wide app settings, and high-privilege consent requests.
Control 06
Sharing change evidence
Retain sharing and guest-change evidence that supports investigation and access review.
Review area 02
Information protection and records
Validate how labels, loss prevention, retention, and evidence practices protect sensitive business information.
Control 07
Label publishing configuration
Inventory sensitivity labels, publishing policies, label scope, encryption behavior, and exceptions.
Control 08
DLP simulation and approval
Run DLP changes in simulation or test mode, review matches and alerts, then approve enforcement deliberately.
Control 09
Location coverage validation
Verify DLP covers the intended Microsoft 365 locations rather than assuming a policy applies everywhere.
Control 10
Protection objective separation
Separate data-protection goals from retention, records management, eDiscovery, and backup objectives.
Control 11
Retention and legal-hold design
Review retention labels, policies, disposition, legal hold readiness, and role separation.
Control 12
Safe policy-test evidence
Capture sample policy alerts and test artifacts without retaining customer-sensitive data unnecessarily.
Review area 03
Device trust and endpoint health
Confirm that device posture, endpoint security, and access decisions reinforce one another.
Control 13
Device access population
Assess which Windows, macOS, mobile, and unmanaged devices can reach Microsoft 365 data.
Control 14
Defender–Intune integration prerequisites
Connect Microsoft Defender for Endpoint to Intune only after confirming role and licensing prerequisites.
Control 15
Compliance-to-access dependencies
Review device compliance criteria and the Conditional Access policies that depend on them.
Control 16
Endpoint protection state
Validate disk encryption, firewall, antivirus, attack-surface reduction, and tamper-protection states.
Control 17
Baseline policy consistency
Confirm security baselines and configuration policies do not conflict with compliance policy expectations.
Control 18
Device-risk remediation ownership
Review device-risk handling, remediation ownership, and stale device records.
Review area 04
Detection, audit, and response operations
Establish accountable monitoring, useful audit evidence, and an investigation process that spans Microsoft 365 signals.
Control 19
Secure Score prioritization
Read Secure Score as prioritization guidance, not as proof that the tenant cannot be compromised.
Control 20
Security monitoring ownership
Define monitoring ownership for Defender incidents, alert queues, Purview Audit, and service health.
Control 21
Audit availability validation
Verify audit is enabled for the actual license type; do not assume small-business tenants have it active by default.
Control 22
Audit evidence custody
Document expected audit retention, search permissions, export limits, and evidence custody requirements.
Control 23
Cross-domain incident triage
Exercise incident triage across email, endpoint, identity, collaboration, and cloud app signals.
Control 24
Advanced-hunting governance
Use advanced hunting only with permitted roles, a defined investigation question, and record handling discipline.
Review area 05
Application consent and ownership
Make application permissions, consent decisions, and ongoing ownership reviewable and defensible.
Control 25
Application permission inventory
Inventory enterprise applications, service principals, OAuth grants, owners, permissions, and tenant-wide consent.
Control 26
High-privilege consent review
Review high-privilege or broadly authorized OAuth applications before assuming delegated consent is low risk.
Control 27
Consent approval governance
Define an approval process for user consent, admin consent, publisher verification, and risky application investigation.
Control 28
App governance detection policies
Use App governance policies where available to alert on high permission scope, unusual authorization volume, or anomalous behavior.
Control 29
Ownerless application removal
Remove or block applications that no longer have a business owner, valid purpose, or acceptable permission scope.
Control 30
Application decision record
Preserve consent, owner, permission, review, and removal decisions as part of the tenant evidence set.
Review area 06
Resilience and service recovery
Separate recovery capabilities, test real restoration paths, and protect the controls that support business continuity.
Control 31
Recovery capability mapping
Document native recovery, recycle-bin, retention, legal hold, backup, and archive behaviors separately.
Control 32
Microsoft 365 Backup coverage
When Microsoft 365 Backup is used, verify policy coverage, restore-point creation, roles, and workload scope.
Control 33
Recovery scenario ownership
Establish restore owners and test mailbox, SharePoint, OneDrive, and collaboration recovery scenarios.
Control 34
Restore-test evidence
Record recovery-test timing, exceptions, data validation, and corrective actions rather than relying on policy screenshots.
Control 35
Recovery administration security
Protect recovery administration from ordinary user or help-desk compromise.
Control 36
Business-aligned resilience evidence
Align resilience evidence with business-critical data, recovery priorities, and incident response decisions.
Review area 07
Findings and controlled change
Turn risk findings into accountable, reversible, validated improvements with a usable evidence trail.
Control 37
Finding risk scoring
Rate each finding by business impact, exposure, exploitability, evidence confidence, and control dependency.
Control 38
Remediation accountability
Assign an accountable owner, technical implementer, validation method, and target date to every accepted item.
Control 39
Change safety planning
Use change windows and reversible test plans for Conditional Access, mail flow, DLP, sharing, and privileged access changes.
Control 40
Outcome retesting
Retest the intended policy outcome and the potential business-impact scenario before closure.
Control 41
Exception lifecycle control
Document exceptions, compensating controls, expiration dates, and executive risk acceptance.
Control 42
Evidence refresh cadence
Refresh the tenant evidence set after material implementation, not only at the next annual review.
Authoritative technical references
Verify implementation decisions against Microsoft documentation
Features, roles, licensing, data locations, and supported behavior can vary. Confirm the tenant’s current configuration before changing production controls.
Microsoft Secure ScoreMicrosoft documentationWhat is Conditional Access?Microsoft documentationStart using Privileged Identity ManagementMicrosoft documentationPreset security policiesMicrosoft documentationChange the external sharing setting for a siteMicrosoft documentationLearn about sensitivity labelsMicrosoft documentationEndpoint security policies in Microsoft IntuneMicrosoft documentationMicrosoft Defender XDRMicrosoft documentationRestore data in Microsoft 365 BackupMicrosoft documentation
Frequently asked questions
Practical decisions to resolve before implementation
What does Microsoft 365 security include?
It includes identity, privileged access, email, collaboration, information protection, endpoints, monitoring, recovery, and governance controls that work together in one tenant.
Is Microsoft Secure Score enough to secure a tenant?
No. Secure Score helps prioritize improvements but Microsoft states that it is not an absolute measurement of breach likelihood.
When should an organization request a professional audit?
When it needs independent evidence review, risk-rated findings, control validation, compliance readiness support, or a practical remediation plan.
This guidance is for initial planning and does not replace a professional cybersecurity audit, compliance assessment, penetration test, legal advice, or a review of your organization’s specific licensing and regulatory obligations.
Next step
Get a risk-rated view of the tenant
OC Security Audit can review evidence, validate key controls, explain material risks in business terms, and help build a practical Microsoft 365 remediation plan.