The 200-point Microsoft 365 security audit checklist

Every check we run, organized by control domain. Each item below is reviewed by Ali personally with read-only access — nothing in your tenant is changed.

#	Check	Why it matters
1.1	MFA enforced for all users	Blocks over 99% of identity-based attacks (Microsoft DDR 2025)
1.2	Legacy authentication protocols disabled	Legacy protocols bypass MFA and Conditional Access entirely
1.3	Conditional Access policies reviewed for gaps	Unscoped or excluded users leave a bypass path
1.4	Risky sign-in and risky user policies enabled	Flags credential-stuffing and impossible-travel sign-ins

#	Check	Why it matters
2.1	Number of standing Global Admins	Every standing admin is a high-value target
2.2	Privileged Identity Management (PIM) usage	Time-limited elevation reduces the attack surface
2.3	Break-glass emergency accounts configured correctly	A misconfigured break-glass account is itself a risk

#	Check	Why it matters
3.1	Inbox forwarding rules to external domains	A common sign of an already-compromised mailbox
3.2	Safe Links and Safe Attachments enabled	Catches malicious links and files at the point of click/open
3.3	Anti-phishing and impersonation protection policies	Directly reduces business email compromise exposure

#	Check	Why it matters
4.1	SPF record present and correctly scoped	Limits which servers can send as your domain
4.2	DKIM signing enabled for the domain	Verifies message integrity in transit
4.3	DMARC policy enforcement level (none / quarantine / reject)	Weak enforcement leaves your domain easy to spoof

#	Check	Why it matters
5.1	Anonymous / "anyone with the link" sharing scope	Determines how far a shared file can travel
5.2	Guest account access review	Former contractors and partners often retain access
5.3	Teams external access and federation settings	Controls who outside the org can reach Teams users

#	Check	Why it matters
6.1	Sensitivity labels applied to financial/HR content	Enables classification-aware protection downstream
6.2	DLP policies in enforce vs. audit-only mode	Audit-only policies don't actually block anything
6.3	Retention policies for mail and documents	Governs how long records are kept and recoverable

#	Check	Why it matters
7.1	Unified Audit Log enabled and retention period	Short retention can erase evidence before it's needed
7.2	Alert policies routed to a monitored inbox	An alert nobody sees is the same as no alert

#	Check	Why it matters
8.1	Device compliance policies enforced	Keeps unmanaged or non-compliant devices off company data
8.2	Backup coverage beyond native retention	Native retention is not a substitute for a real backup
8.3	Ransomware recovery plan tested	An untested plan often fails when it's actually needed

Full checklist covers 200 individual checks across these 8 domains; the items above are representative examples from each.