Microsoft 365 Security Baseline Checklist

Microsoft 365 is not insecure by default — but it is not securely configured for every business by default either. Default settings allow users to work. Security configuration requires deliberate decisions about authentication, administrator access, external sharing, device controls, audit logging and ongoing monitoring.

The Seven-Control Framework

Use the IT Club Microsoft 365 Security Baseline: AUTHENTICATE → LIMIT → CONTROL → TRUST → RECORD → STANDARDISE → REVIEW

1 — Authenticate: Identity Controls

• □ MFA is enforced for all users
• □ Authentication methods are reviewed — weaker methods phased out where possible
• □ Administrator accounts use stronger authentication (passkey or phishing-resistant MFA)
• □ Legacy authentication protocols are blocked where technically feasible
• □ Break-glass (emergency access) accounts are documented and stored securely
• □ Temporary Access Pass policy is configured for MFA recovery

2 — Limit: Privileged Access

• □ Global Administrators are reviewed — number minimised
• □ Daily user accounts and administrator identities are separated where appropriate
• □ Standing privilege is minimised — PIM considered where licensed
• □ Former IT suppliers no longer retain unnecessary privileged roles
• □ External delegated administration is reviewed and appropriately scoped
• □ Emergency access is documented separately from routine administrator access

3 — Control: External Sharing

• □ SharePoint external sharing level is reviewed and intentionally set
• □ OneDrive external sharing level is reviewed and intentionally set
• □ Teams guest access is reviewed and intentionally configured
• □ Guest accounts are periodically reviewed — inactive guests removed
• □ Anonymous sharing links are controlled — expiry configured where permitted
• □ A process exists for creating and reviewing external sharing

4 — Trust: Device Access

• □ Supported operating system versions are required
• □ Disk encryption (BitLocker for Windows) is verified
• □ Endpoint protection (Microsoft Defender) is active and reporting
• □ Device compliance policies are defined and enforced via Conditional Access
• □ Unmanaged device access has been explicitly decided — not left as default
• □ Mobile device access is addressed through device management or app protection

5 — Record: Audit Logging

• □ Microsoft Purview Audit is verified as active
• □ Audit log retention period is understood and appropriate
• □ Administrator actions — role changes, policy changes — can be investigated
• □ Sign-in activity is available and reviewed
• □ Critical events (consent grants, mass downloads, role changes) alert a named owner

6 — Standardise: Security Baseline

• □ Identity settings (MFA, Conditional Access, auth methods) are documented
• □ Exchange Online security configuration is documented
• □ SharePoint and OneDrive settings are documented
• □ Teams security configuration is documented
• □ Endpoint and device controls are documented
• □ Exceptions to the baseline are documented with justification and review dates

7 — Review: Risk Monitoring

• □ Secure Score is reviewed regularly — at least quarterly
• □ Risky users are reviewed and remediated
• □ Risky sign-ins are reviewed and investigated
• □ Administrator role changes are reviewed regularly
• □ Conditional Access changes and new exclusions are reviewed
• □ Corrective actions from previous reviews are tracked and assigned

Self-Assessment Guide

For each of the seven areas, mark: Green — reviewed and controlled; Amber — partially implemented or not recently reviewed; Red — unknown, absent or uncontrolled.

After completing the assessment: identify the strongest area (Green); identify the highest-risk area (Red or Amber); choose a single next action that would most improve the overall position. Start there.