Microsoft 365 accounts are the doors to an organization’s e-mail, files and team conversations. How these doors are set up often stays as it was on the day of installation. The five checks below are a general list prepared so you can take a quick look at your current environment. It is enough to answer each one with “yes / no / I don’t know”; “I don’t know” is also a valuable answer.
This article is for general information. Some of the features mentioned may depend on the license level; you need to confirm from your license plan which of them are available in your organization.
1. Is multi-factor authentication on for everyone?
Multi-factor authentication (MFA) asks for one more step besides the password when signing in. Even if the password is captured, it makes getting into the account harder. When checking, look at this: is MFA on only for some users, or for everyone? Shared accounts or accounts used for services may have been forgotten outside the list.
2. Who holds the administrator accounts, and why?
Administrator rights increase the impact of an account being compromised. Ask these questions:
- Do you have the list of accounts that hold administrator roles?
- Does each permission have a reason, or has it built up over time?
- Is a separate account used for administration, apart from the account used daily?
- Have the permissions of people who left or changed roles been updated?
The principle is simple: everyone should have only the permissions their task requires.
3. Are the mail forwarding rules familiar?
An automatic forwarding or rule defined on a mailbox can make copies of incoming messages go to another address. There are legitimate uses; but a rule added without the mailbox owner’s knowledge is a hard-to-notice route for information leakage. When checking, look at this: is there a rule that forwards outside the organization, and if so, who defined it, when and why? It can also be assessed separately under what conditions forwarding to the outside is possible across the whole organization.
4. Are conditional access rules defined?
Conditional access lets you set rules for access based on conditions such as “who, with which device, from where, to which application”. For example, an additional verification can be requested when a sign-in comes from an unusual location. When checking, look at this: are any rules defined at all? If they are, whom do they cover, is there an exception list, and are those exceptions still needed? Keeping an emergency administrator account that allows sign-in in a crisis deliberately separate from these rules, and storing it securely, is also part of this item. The availability of this feature may depend on the license level.
5. Are events monitored and reported somewhere?
Getting the settings right is only half the job; you also need to see what happens in the accounts. Unusual sign-in attempts, newly added mail rules or permission changes are examples to monitor. When checking, look at this:
- Is it clear which events are looked at?
- Do alerts go to a responsible person or team instead of getting lost in one person’s inbox?
- Do the findings turn into a report that management can read?
How long records are kept and what detail they contain can also vary according to the license and the settings.
Assessing the result
If the number of “I don’t know” or “no” answers to the five questions is high, this is not an alarm; it is a work list for improvement. For most organizations, starting with administrator accounts and MFA is a reasonable order. Trying every change with a small group before rolling it out helps avoid surprising users.
We can run these checks for you
Doing these checks once is possible; keeping them up takes attention. Our Microsoft 365 management service covers tenant management, Entra ID (MFA, conditional access, roles), and security event monitoring and reporting. We write the frequency and content of the report in the quote.
Also on this topic: Microsoft 365 security: four areas for a good start
Would you like to leave the management of your Microsoft 365 environment to us? Microsoft 365 Management
