Microsoft 365 Security Checklist

While the Microsoft 365 and Azure Entra ID security checklist will be provided at the end of this article (plus a downloadable PDF), I believe it is important to discuss its most critical parts. 

Just going item by item may seem systematic, but it isn’t. 

If implemented incorrectly, any one of the 200 items on the checklist may give you a false sense of security or, worse, decrease your defense levels. 

For example, “Implement MFA” might seem logical, but there are nuances that even highly technical experts without years of attack/defense experience will miss. 

How? 

Just Google “bypass Microsoft 365 MFA“!

So how should you approach using and implementing the checklist? 

Research!

Every item on the list requires research, planning, and testing. 

Create a small group of test users, include yourself (or a test account of yours, which is safer) in it, and test in small batches. It is tempting to implement a lot of changes at once, but then you risk users complaining, services stopping, and all kinds of other issues, and you would have a hard time knowing which change caused the problem(s). 

Account Security

Multi-Factor Authentication (MFA): Enable MFA for all users is critical but must be implemented cautiously. For example, there are quite expensive but rock-solid ways of implementation, such as allowing Yubikey (or another brand of security physical keys) only. In that case, it would be nearly impossible for a hacker to log in, but you would have to buy 2 devices for each user (one backup, one primary in case they lose the primary device) and configure 2 devices per user. As always, the most secure configuration requires the highest time and resources investment. Another option which is just as secure is certificate-based authentication as MFA for 365/Entra ID. Once again, not an easy solution, but the easy solutions are the ones that can be bypassed. The  least secure MFA option would be SMS-based verification, because intercepting SMS or creating a phishing page capturing the SMS code is trivially easy and can be done by kids. 

Conditional Access Policies: They allow you to enforce MFA for specific scenarios, such as accessing sensitive data or applications, providing an additional layer of security based on user location, device compliance, and risk level. One great way of using conditional access policies is restricting login to compliant, company-owned devices only. But that would require you to increase your licensing level to include Intune. 

Legacy Authentication Protocols: Disable legacy authentication protocols, which do not support MFA, to mitigate vulnerabilities associated with older, less secure authentication methods.

Password Policies: Implement strong password policies, including complexity requirements, minimum length, and expiration periods, to ensure that user passwords are resilient against brute-force attacks.

Passwordless Authentication: Utilize options such as Windows Hello for Business and FIDO2 security keys to provide secure and user-friendly alternatives to traditional passwords, enhancing both security and user experience. 

Sign-In Monitoring: Regularly monitor user sign-ins for anomalies to detect and respond to suspicious activities, such as failed login attempts and sign-ins from unfamiliar locations. Ideally you would assign someone to do that every day, first thing in the morning. Alternatively, hire a cybersecurity expert or a third-party cybersecurity service to do that for you. Otherwise, the moment a breach happens, how would you know? 

Self-Service Password Reset (SSPR): Allow users to reset their passwords securely without administrative intervention, reducing helpdesk workload and ensuring users can regain access quickly if they forget their passwords.

Application Security

Application Registration: Register all applications in Azure AD to ensure they are managed securely, with appropriate permissions and access controls.

OAuth 2.0: Use OAuth 2.0 for application authentication to ensure secure access to resources by granting tokens with limited permissions.

App Permissions: Configure app permissions based on the principle of least privilege to minimize the risk of over-privileged applications being exploited.

App Governance: Enforce app governance policies and regularly review third-party app access to maintain control over the applications integrated with your environment.

Single Sign-On (SSO): Enable SSO to simplify user access to multiple applications, reduce password fatigue, and enhance security by centralizing authentication.

Managed Identities: Use managed identities for Azure resources to eliminate the need for hard-coded credentials in your code, enhancing security and ease of management.

Data Protection

Data Loss Prevention (DLP): Enable DLP policies to help prevent sensitive information from being inadvertently shared or leaked by detecting and blocking risky data transfers.

Sensitivity Labels: Configure sensitivity labels to classify and protect data based on its sensitivity, applying appropriate encryption and access controls.

Microsoft Information Protection (MIP): Use MIP to classify, label, and protect data, ensuring that sensitive information is handled securely.

Encryption: Enable encryption at rest and in transit to ensure that data is protected from unauthorized access during storage and transmission. One key aspect here is that some files should be encrypted at all times – meaning, you should use some form of 3rd party encryption (BoxCryptor, for example) or protect the files using their built-in security mechanisms (password to open, for example). 

Retention Policies: Implement data retention policies to ensure that data is retained for the necessary period for compliance and business requirements, while also facilitating secure disposal of data that is no longer needed.

Email Security

Defender for Office 365: Use Microsoft Defender for Office 365 to provide advanced threat protection for emails, including anti-phishing, anti-malware, and safe links and attachments.

Email Encryption: Enable email encryption to ensure that sensitive email content can only be accessed by intended recipients, protecting it from interception and unauthorized access.

Anti-Phishing Policies: Configure anti-phishing policies to help detect and block phishing attempts, protecting users from fraudulent emails designed to steal credentials or sensitive information.

DKIM, DMARC, and SPF: Implement these email authentication protocols to verify the legitimacy of emails sent from your domain, reducing the risk of email spoofing and phishing attacks.

Audit Logging: Enable audit logging for mailbox activities to provide visibility into actions taken within mailboxes, helping detect and investigate suspicious activities.

Device Security

Intune MDM: Enroll devices in Microsoft Intune for Mobile Device Management (MDM) to ensure that devices are configured, managed, and secured according to your organization’s policies.

After enrolling your devices, make sure you have at least the baseline policies enabled. 

Compliance Policies: Set up device compliance policies to ensure that only devices meeting your security requirements can access corporate resources, enhancing overall security.

BitLocker Encryption: Enable BitLocker encryption for all devices to protect data at rest by encrypting the entire drive, preventing unauthorized access if the device is lost or stolen.

Endpoint Detection and Response (EDR): Implement EDR solutions to help detect, investigate, and respond to advanced threats targeting endpoints, providing robust protection against sophisticated attacks. One great option I often recommend is to use Defender for Endpoint P2 as a separate license; it is well worth the cost.

Windows Defender: Use Windows Defender Antivirus and Firewall to provide comprehensive protection against malware and network threats, safeguarding your devices and data.

Network Security

Azure Firewall: Use Azure Firewall to secure network traffic and help protect your resources from unauthorized access and threats by applying network security policies.

Network Security Groups (NSGs): Implement NSGs to control inbound and outbound traffic to your Azure resources, enhancing network security through fine-grained access controls.

DDoS Protection: Enable Azure DDoS Protection to help safeguard your applications from distributed denial-of-service attacks, ensuring high availability and performance.

VPNs: Use Virtual Private Networks (VPNs) for secure remote access to ensure that data transmitted between remote users and corporate resources is encrypted and protected from interception.

Azure Bastion: Configure Azure Bastion for secure RDP/SSH access to eliminate the need for public IP addresses on your virtual machines, reducing the attack surface.

Identity and Access Management (IAM)

Privileged Identity Management (PIM): Configure PIM to help manage, control, and monitor access to important resources, ensuring that privileged roles are only granted when necessary and for a limited time.

Conditional Access Policies: Implement Conditional Access policies for critical applications to ensure that access is granted based on defined criteria, such as user risk, device compliance, and location. To enable location-based conditional access policies you would need to first specify networks and locations and name them. Then you can use them in the policies. 

Role-Based Access Control (RBAC): Use RBAC to assign permissions based on roles to ensure that users only have access to the resources necessary for their job functions, minimizing the risk of over-privileged accounts.

Identity Protection: Enable Azure AD Identity Protection to help detect and respond to identity-based risks, such as compromised accounts and risky sign-ins, enhancing overall security.

Access Reviews: Regularly conduct access reviews to ensure that only authorized users have access to critical resources, maintaining a secure and compliant environment.

General Security Practices

Regular Security Reviews: Most security standards or frameworks would suggest having yearly security audits, but for most companies that is not feasible nor practical. My recommendation is to run at least one comprehensive security audit when you start working on your defenses. Then, do yearly short reviews on what was done and what you plan to implement next year. 

Security Training: Providing security training and awareness programs for your employees because it helps cultivate a security-conscious culture. Human error is the most likely reason for most security incidents, by addressing this you will decrease the number of incidents. 

Incident Response Plans: Develop and test incident response plans at least once a year. If your company has more than 500 employees, test the DFIR plans twice a year. Your organization should be prepared to respond effectively to security incidents and minimize potential damage.

Logging and Monitoring: Enabling comprehensive logging and monitoring across all services will give you visibility into suspicious activities and events. You should be able to quickly detect a regular employee running VBA scripts, PowerShell scripts, or suspicious binaries they should not be running. This will help you detect and respond to security threats promptly.

Zero-Trust Security Model: Implement a zero-trust security model to ensure that all access requests are thoroughly verified, regardless of their origin, enhancing overall security.

Microsoft 365 and Azure Entra ID Security Checklist

Account Security

1. Enable Multi-Factor Authentication (MFA) for all users.
2. Use Conditional Access Policies to enforce MFA for specific scenarios.
3. Disable legacy authentication protocols.
4. Enforce password policies (complexity, length, expiration).
5. Implement passwordless authentication options.
6. Monitor and manage user sign-ins for anomalies.
7. Review and audit user roles and permissions regularly.
8. Set up self-service password reset (SSPR).
9. Enable risk-based Conditional Access policies.
10. Use Azure AD Identity Protection for risk detection and response.
11. Configure Azure AD Password Protection to block common passwords.
12. Set up Azure AD authentication methods policies.
13. Enable sign-in risk policy to prompt for additional verification.
14. Review sign-in logs and risky sign-in reports.
15. Enable user risk policy to block compromised accounts.
16. Configure account lockout settings to prevent brute force attacks.
17. Enable Continuous Access Evaluation (CAE).
18. Set up emergency access accounts.
19. Implement time-based one-time password (TOTP) for MFA.
20. Use Azure AD smart lockout to block brute force attacks.
21. Review and manage service account permissions.
22. Enable password expiration notifications.
23. Set up Azure AD Identity Governance.
24. Use Azure AD B2B for secure guest access.
25. Implement dynamic groups for automated membership management.
26. Configure MFA registration policies to enforce timely registration.
27. Enable password hash synchronization.
28. Use PIM to manage Azure AD roles.
29. Regularly review and remove inactive user accounts.
30. Configure session controls for additional access security.

Application Security

31. Register all applications in Azure AD.
32. Use OAuth 2.0 for application authentication.
33. Configure app permissions to follow the principle of least privilege.
34. Monitor consented permissions and remove unused app registrations.
35. Enable App Governance policies.
36. Review third-party application access regularly.
37. Enforce application-specific Conditional Access policies.
38. Implement API management for custom applications.
39. Use managed identities for Azure resources.
40. Set up secure application secret storage.
41. Enable single sign-on (SSO) for enterprise applications.
42. Configure application proxy for secure remote access.
43. Review and manage service principal permissions.
44. Set up application insights for monitoring app performance and security.
45. Enable Microsoft Defender for Cloud Apps.
46. Monitor and control OAuth app behavior.
47. Implement certificate-based authentication for apps.
48. Configure lifecycle policies for application objects.
49. Set up app registration ownership review.
50. Enable Conditional Access App Control.
51. Use application role assignments for access control.
52. Regularly audit API permissions and usage.
53. Configure app consent policies to control user consent.
54. Use managed identities to avoid hardcoding credentials.
55. Enable service principal logging and monitoring.

Data Protection

56. Enable Data Loss Prevention (DLP) policies.
57. Configure sensitivity labels for classification and protection.
58. Use Microsoft Information Protection (MIP).
59. Enable Azure Information Protection (AIP).
60. Encrypt sensitive data at rest and in transit.
61. Use Customer Key for Microsoft 365.
62. Enable Rights Management Services (RMS).
63. Implement data retention policies.
64. Regularly audit data access and sharing.
65. Secure OneDrive and SharePoint with advanced security settings.
66. Enable Microsoft Purview for comprehensive data governance.
67. Configure eDiscovery and legal hold for compliance.
68. Set up data classifications to identify and protect sensitive information.
69. Enable file activity monitoring and alerts.
70. Use Microsoft Defender for Endpoint to protect data on devices.
71. Configure sensitivity labels for Teams, SharePoint, and OneDrive.
72. Enable encryption for Office 365 messages.
73. Set up records management for regulatory compliance.
74. Monitor data access patterns for anomalies.
75. Configure and manage data at rest encryption policies.
76. Implement data classification policies for emails and documents.
77. Enable Advanced Data Governance.
78. Use Information Rights Management (IRM) to protect documents.
79. Set up policies for automatic data labeling.
80. Enable endpoint DLP to monitor and protect data on devices.

Email Security

81. Enable Microsoft Defender for Office 365.
82. Configure anti-phishing policies.
83. Set up safe links and safe attachments.
84. Enable email encryption.
85. Implement outbound spam filtering.
86. Use DKIM, DMARC, and SPF to secure email domains.
87. Monitor email activity for anomalies.
88. Train users to recognize phishing attempts.
89. Set up Exchange Online Protection (EOP).
90. Review and manage mailbox permissions.
91. Enable audit logging for mailbox activity.
92. Configure junk email settings and policies.
93. Set up automatic forwarding restrictions.
94. Enable advanced threat protection for emails.
95. Monitor for email forwarding rules that may indicate compromise.
96. Configure mailbox auditing for critical users.
97. Set up quarantine policies for suspicious emails.
98. Use Threat Explorer to investigate email threats.
99. Enable Zero-Hour Auto Purge (ZAP) for malware and phishing.
100. Configure email authentication settings (DMARC, DKIM, SPF).
101. Set up anti-spoofing protection.
102. Use Clutter to manage low-priority emails.
103. Enable mailbox recovery and retention policies.
104. Configure email retention and deletion policies.

Device Security

105. Enroll devices in Intune for Mobile Device Management (MDM).
106. Set up device compliance policies.
107. Enable BitLocker encryption for all devices.
108. Use Windows Defender Antivirus.
109. Enable Windows Defender Firewall.
110. Implement Endpoint Detection and Response (EDR).
111. Configure device health monitoring.
112. Set up device restrictions and configurations.
113. Enforce software updates and patch management.
114. Monitor device activity and compliance.
115. Implement Mobile Application Management (MAM).
116. Enable Conditional Access policies for device compliance.
117. Configure Windows Hello for Business for secure sign-ins.
118. Set up automatic device enrollment and provisioning.
119. Monitor for jailbroken or rooted devices.
120. Enable compliance reporting and alerts.
121. Configure application protection policies for mobile apps.
122. Set up device wipe and lock capabilities.
123. Monitor and manage device encryption status.
124. Enable security baselines for device configuration.
125. Use Microsoft Defender ATP for advanced threat protection.
126. Set up device health attestation.
127. Configure device compliance policies for macOS, iOS, and Android.
128. Implement secure boot policies.
129. Monitor and manage device hardware and software inventory.

Network Security

130. Use Azure Firewall to secure network traffic.
131. Implement Network Security Groups (NSGs).
132. Enable Azure DDoS Protection.
133. Use VPNs for secure remote access.
134. Monitor network traffic with Azure Network Watcher.
135. Configure Azure Bastion for secure RDP/SSH access.
136. Set up virtual network peering securely.
137. Enforce strict network segmentation.
138. Use Web Application Firewall (WAF) for web apps.
139. Implement security baselines for network configurations.
140. Enable Just-In-Time (JIT) VM access.
141. Configure private endpoints for Azure services.
142. Monitor and manage network security groups and rules.
143. Use Azure Traffic Manager for high availability and security.
144. Enable logging and diagnostics for network resources.
145. Implement network isolation for sensitive workloads.
146. Set up Azure Front Door for secure and fast content delivery.
147. Use Azure Private Link to secure service access.
148. Enable network anomaly detection.
149. Configure network security policies for virtual networks.
150. Implement virtual network service endpoints.
151. Use Azure Sentinel for advanced threat detection.
152. Enable DNS security features.
153. Set up network access control policies.

Identity and Access Management (IAM)

154. Configure Privileged Identity Management (PIM).
155. Enable Just-In-Time (JIT) access for privileged roles.
156. Implement role-based access control (RBAC).
157. Use Azure AD Privileged Access Management (PAM).
158. Review and manage guest access and external users.
159. Audit and manage admin accounts separately.
160. Set up identity synchronization with secure settings.
161. Monitor and review sign-in logs and reports.
162. Use identity governance to automate lifecycle management.
163. Enable Azure AD Password Protection.
164. Set up access reviews for user and group memberships.
165. Implement Conditional Access policies for critical applications.
166. Use access reviews for privileged roles.
167. Monitor for unusual sign-in activity.
168. Implement Azure AD Join for secure device management.
169. Configure B2C for customer identity management.
170. Set up access policies for external identities.
171. Monitor and manage directory synchronization.
172. Enable hybrid identity for seamless access management.
173. Set up password writeback for hybrid environments.
174. Enable Identity Secure Score for continuous improvement.
175. Configure user risk policies in Azure AD Identity Protection.
176. Set up dynamic membership rules for security groups.
177. Monitor and review user activity logs.
178. Implement identity protection policies for high-risk users.
179. Enable password reset registration and usage reports.

General Security Practices

180. Regularly review and update security policies.
181. Conduct periodic security assessments and audits.
182. Train employees on security best practices.
183. Set up incident response and recovery plans.
184. Monitor security alerts and respond promptly.
185. Use security baselines for consistent configuration.
186. Enable logging and monitoring across all services.
187. Implement least privilege access across all systems.
188. Regularly review and update Conditional Access policies.
189. Use Secure Score to prioritize and track security improvements.
190. Implement a zero-trust security model.
191. Monitor and manage compliance requirements.
192. Set up and test disaster recovery plans.
193. Review and manage access to sensitive information.
194. Use Azure Security Center for unified security management.
195. Monitor and review activity logs regularly.
196. Implement security training and awareness programs.
197. Regularly update and patch all systems and applications.
198. Configure secure access to on-premises applications.
199. Implement Azure Policy for compliance and governance.
200. Use Microsoft Defender for Identity for advanced threat detection.

For a downloadable version of the checklist, which you can print out, please fill out the form at the top of this page.