Use this checklist to audit a Microsoft 365 tenant yourself. It covers the admin, identity, email, sharing, device, and logging settings that matter most, in the order we would check them.
Key Takeaways
- Start with admin accounts and sign-ins, where a single mistake exposes the most.
- Write down what you find before you change anything, and test access changes in report-only mode.
- Some items need Business Premium or E3 licensing, so check your plan first.
Before you start
You’ll need an account that can read the Microsoft Entra, Defender, Exchange, and SharePoint admin centers. Global Reader is a good choice because it can view settings without changing them. Record each result in a spreadsheet, and treat this as an audit first and a project second. It also works as a Microsoft 365 security assessment checklist if you’re reviewing a tenant for a client or a new employer.
Admin accounts
- Fewer than five Global Admins, as Microsoft recommends
- Admins use separate accounts, not their everyday mailbox
- Admin accounts use phishing-resistant MFA
- Two emergency access accounts exist, are monitored, and have been tested
- No former employees or vendors hold admin roles
Identity and sign-ins
- MFA is enforced for every user, not just available
- Legacy authentication is blocked
- Conditional Access policies cover all users and all apps, with documented exclusions
- Risky sign-ins are reviewed, if your license includes them
- Disabled and departed accounts are cleaned up
- Guest users are reviewed, and old ones removed
- Users can’t consent to unverified apps, and existing app permissions are reviewed
- SPF, DKIM, and DMARC exist, and DMARC is at quarantine or reject
- Automatic forwarding to external addresses is blocked
- No unexpected inbox or forwarding rules on executive and finance mailboxes
- Anti-phishing, Safe Links, and Safe Attachments are enabled, if licensed
Files and sharing
- “Anyone” links are off or limited in SharePoint and OneDrive
- Default sharing links are set to specific people or your organization
- Sensitive sites have been reviewed for over-broad access
Devices
- Every laptop is enrolled and shows as compliant
- BitLocker or FileVault is enforced and recovery keys are stored
- Non-compliant or unmanaged devices are restricted from company data
Logging and recovery
- Unified audit logging is on, and retention meets what you’ve promised customers
- Someone receives and reviews security alerts
- Your backup covers Microsoft 365 data, and a restore has been tested
What to do with the results
Fix admin accounts, MFA, and legacy authentication first, because they remove the most risk. Then work through email and sharing, and leave device rollout for a planned project. Microsoft Secure Score can help track progress, but it doesn’t replace this review.
For a quick score, take our Microsoft 365 Security Scorecard. If you’d like someone to do the audit and the fixes, see our Microsoft 365 security service.