Microsoft 365 Security Configuration Check

Identity & MFA

Protect accounts and administrative access before a password problem becomes a business incident.

0/5

MFA for all usersAdvanced enforcement may require licensingMultifactor authentication makes stolen or guessed passwords less likely to become successful account access.Stronger authentication requirements for administratorsAdvanced admin controls may require licensingAdministrator accounts can change tenant-wide settings, permissions, mail flow, and security controls.Separate administrative accounts where appropriateSeparate admin accounts can reduce exposure when an everyday mailbox or workstation is compromised.Legacy authentication disabled where applicableEnforcement options may require licensingOlder authentication methods may not support modern protections such as MFA.Regular review of privileged/admin rolesAdmin rights often accumulate over time and can increase the impact of a compromised account.

Email Security

Reduce spoofing, phishing, malicious links, and attachment risk in the channel attackers use most often.

0/7

SPF configuredSPF helps receiving mail systems understand which servers are authorized to send mail for your domain.DKIM configuredDKIM helps recipients verify that a message was authorized by the domain and was not altered in transit.DMARC configured and monitoredDMARC helps guide how recipients treat unauthenticated mail and provides visibility into domain spoofing.Anti-phishing/impersonation protectionsDefender features may require licensingImpersonation controls can help flag messages pretending to be executives, vendors, or trusted domains.Malicious attachment and URL protectionDefender features may require licensingAttachments and links are common delivery paths for malware, credential theft, and fraud attempts.External sender identification where appropriateClear external sender cues can help employees slow down before acting on suspicious requests.User-accessible phishing reportingEasy reporting helps suspicious messages reach the right reviewer before others are affected.

Accounts & Access

Keep user lifecycle, shared accounts, guests, and stale access from drifting out of control.

0/5

Documented onboarding/offboardingA written process reduces missed accounts, permissions, groups, devices, and mailbox changes.Same-day account disabling for departing employeesFormer employee access can create preventable exposure after someone leaves the business.Shared accounts minimizedShared accounts make accountability, MFA, permissions, and incident response harder.Guest/external access reviewed regularlyExternal users may retain file, Teams, SharePoint, or group access longer than intended.Stale/inactive accounts reviewedInactive accounts can preserve unnecessary access and may be missed during normal operations.

Devices & Endpoint Security

Connect Microsoft 365 access decisions to the security posture of business devices.

0/5

Business devices centrally managedDevice management may require licensingCentral management helps keep device inventory, configuration, software, and access policies consistent.Disk encryptionEncryption helps protect business data if a laptop or device is lost or stolen.Endpoint protection/EDREDR features may require licensingEndpoint protection helps detect and respond to malware, suspicious behavior, and device compromise.OS and application patchingTimely patching reduces exposure to known vulnerabilities on systems employees use every day.Appropriate device compliance/access policiesCompliance policies may require licensingCompliance and access policies can help reduce risky sign-ins from unmanaged or unhealthy devices.

Data Protection & Sharing

Review how files, sensitive data, permissions, and recovery are controlled across Microsoft 365.

0/4

SharePoint/OneDrive external sharing controls reviewedExternal sharing can expose business files when tenant, site, folder, or link settings are too broad.Sensitive data access limited appropriatelyAdvanced data controls may require licensingSensitive data should be available to people who need it without becoming broadly accessible.User permissions reviewedPermissions can accumulate through groups, role changes, and shared folders.Important Microsoft 365 data has an appropriate backup/recovery strategyRetention or backup features may require licensingRetention and recycle-bin features may not meet every business recovery need.

Monitoring & Response

Make alerts, logs, ownership, and incident procedures actionable before a problem escalates.

0/4

Security alerts are actively reviewedAdvanced alerts may require licensingAlerts only reduce risk when someone is responsible for reviewing and acting on them.Audit logging is appropriately configuredAdvanced audit may require licensingUseful logs help investigate sign-ins, mailbox activity, sharing changes, and suspicious behavior.Someone is responsible for responding to security incidentsIncidents move faster when ownership, escalation, and decision-making are clear.Procedures exist for compromised accounts and business email compromiseClear procedures reduce confusion during account takeover, mailbox rule abuse, payment fraud, or impersonation.