Checklist · Email and domains

Microsoft 365 tenant baseline

The identity, mail and sharing settings that decide whether one stolen password becomes a tenant takeover.

Owner: Microsoft 365 administratorTime: 2 hours

0 of 23

Administrator accounts

Two emergency (break-glass) accounts exist, with long random passwords stored offline, excluded from Conditional Access, and sign-in alerts on them.
Global Administrator is held by fewer than five people; day-to-day work uses lesser roles.
Administrators have separate cloud-only accounts with no licence or mailbox.
Privileged roles are time-limited through PIM or an equivalent just-in-time process.
Administrators sign in with phishing-resistant MFA (FIDO2 key or certificate).

Conditional Access requires MFA for all users, and for all administrators on every app.
Legacy authentication (IMAP, POP, SMTP AUTH, basic auth) is blocked.
Sign-ins from countries where you have no staff are blocked or challenged.
Access to Microsoft 365 requires a compliant or managed device for sensitive roles.
Users register MFA methods from a trusted location, and the authenticator number-matching prompt is on.
Password protection blocks common and company-specific passwords.

Users cannot consent to third-party app permissions; an admin consent workflow handles requests.
App registrations and service principals are reviewed, and expired or unused secrets are removed.
Guest access is limited, guests are reviewed on a schedule, and external sharing defaults to named people.
Anonymous "anyone" links are off, or restricted to a short expiry.

Automatic forwarding to external addresses is blocked.
Safe Links and Safe Attachments (or the equivalent filtering) are on for all users.
Mailbox auditing is on, and the mail flow rules list contains nothing nobody can explain.
Shared mailboxes cannot be signed in to directly.
SPF, DKIM and DMARC are published for every domain (see the email domain checklist).

Sign-in and audit logs are retained long enough for an investigation and shipped to the SIEM.
Alerts exist for new inbox rules, new admin role assignments, mass downloads and impossible-travel sign-ins.
Secure Score recommendations were reviewed, and the ones not applied have a recorded reason.

Adjust it to your environment before relying on it. A finished list shows a routine was followed; it does not guarantee nothing was missed.

14-day free trial. No credit card. Cloud or on-premises.