ATLANT SECURITY
60 review checks · Updated 16 October 2026 · Read the full audit guide
Complete this file locally, then use your browser’s Print command to save a PDF. Entries are not saved automatically. No data is sent anywhere. Avoid entering passwords, secrets or sensitive evidence; reference a controlled evidence repository instead.
Use Pass only after verification. Gap means the requirement is not met; Not tested means no conclusion. For an accepted exception or a check outside scope, record the reason and approver.
Microsoft Entra admin center, Microsoft 365 admin center and partner relationships.
Verify: Export enabled members, guests, service accounts and owners; reconcile them with current staff and suppliers.
Assessment: Every enabled identity has a current purpose and accountable owner. Investigate orphaned or unexplained accounts.
Verify: Inspect active and eligible roles, group membership and delegated administrator relationships.
Assessment: Each grant is justified; daily work uses a separate account. Unexplained standing privilege is a finding.
Verify: Review cloud and synchronised account policies, password reset methods and helpdesk identity checks.
Assessment: Recovery cannot bypass identity verification. Routine cloud-only password expiry is not treated as a security improvement.
Verify: Inspect cloud-only recovery accounts, credential custody, strong authentication, alerts and the latest authorised access test.
Assessment: Recovery works independently of normal identity dependencies. Review restrictive policy exclusions and alert on every use.
Verify: Where licensed, examine PIM eligibility, activation duration, approvals and activation records.
Assessment: Privilege is time-limited where appropriate; emergency roles remain recoverable. A disabled or unlicensed feature is recorded honestly.
Verify: Sample recent departures and ended supplier engagements; check sessions, credentials, roles and delegated access.
Assessment: Removal covers all access paths, not only the user account. Retained access has an owner and expiry.
Entra authentication methods, Conditional Access, sign-in logs and identity risk reports.
Verify: Compare authentication registration with enabled policy scopes, exclusions and sampled sign-in results.
Assessment: Required users actually encounter the intended control. Registration alone, report-only policies and unexplained exclusions do not pass.
Verify: Inspect accepted methods and authentication-strength requirements for privileged sign-ins.
Assessment: Administrators use the required phishing-resistant methods. SMS, push approval or a registered key alone do not prove enforcement.
Verify: Use policy evaluation tools and authorised pilot sign-ins for normal, guest, unmanaged-device and exceptional access.
Assessment: Expected access succeeds and prohibited access is denied. Retain policy IDs, outcomes and approved exceptions.
Verify: Review sign-in protocols, application dependencies and mailbox-level authentication exceptions, including SMTP AUTH usage.
Assessment: Unused paths are disabled; required applications use an approved method. Do not disable a business workflow without validating its replacement.
Verify: Inspect risk response, session controls, token revocation procedures and the handling of lost devices.
Assessment: There is a tested response to suspected compromise. Distinguish licensed risk automation from manual review and compensating controls.
Verify: Review authentication-method changes, Temporary Access Pass issuance and Conditional Access changes for a defined period.
Assessment: Changes have accountable operators and reviewable records. Emergency exclusions do not become a permanent route around protection.
Entra enterprise applications, app registrations, consent policies and workload sign-in records.
Verify: List enterprise applications and registrations; record business purpose, owners and recent use.
Assessment: Each active application has an owner. Dormant or ownerless applications are reviewed before removal or continued approval.
Verify: Inspect tenant-wide application permissions and delegated grants, including mail, files and directory access.
Assessment: Permissions match the actual workflow. Broad access without a documented need becomes a prioritised finding.
Verify: Review who can grant consent, approval workflows and sensitive grants already present.
Assessment: Users cannot silently approve unacceptable access. Existing grants receive review rather than relying only on the current consent setting.
Verify: Inspect credential expiry, owners, rotation processes and federated credentials for important workloads.
Assessment: Credentials are controlled and monitored; expired ownership, long-lived secrets and unexpected trust relationships are investigated.
Verify: Review service-principal sign-ins and how application access is constrained and monitored.
Assessment: The review does not assume that user MFA protects app-only tokens. Unusual access has an investigation and containment path.
Verify: Sample a retired integration and rehearse the documented process for disabling a compromised application.
Assessment: Revocation covers grants, credentials and continuing automation. The business understands what will stop when access is withdrawn.
Exchange admin center, Defender outbound policies, public DNS and delivered message headers.
Verify: Reconcile accepted domains with all systems that send mail, including finance, support, marketing and website services.
Assessment: Every sender is owned and documented. Obsolete services and unexpected domains are investigated.
Verify: Inspect DNS and authentication results on authorised test messages from each sending service.
Assessment: Legitimate mail authenticates and aligns with the visible From domain. Plan enforcement changes around validated senders and monitoring.
Verify: Review outbound policy, remote domains, mailbox forwarding and inbox-rule destinations together.
Assessment: Unapproved external forwarding is prevented. A single tenant setting is not accepted as proof that all paths were checked.
Verify: Export Full Access, Send As and Send on Behalf grants; examine shared-mailbox identities and direct sign-in.
Assessment: Delegation has current owners and business reasons. Unneeded direct sign-in and historic permissions are removed through an approved change.
Verify: Review mail-flow rules, inbound/outbound connectors and trust or filtering bypasses.
Assessment: Exceptions have a limited scope, an owner and a review date. Investigate routing or bypasses unrelated to a current requirement.
Verify: Search a defined period for rule changes, forwarding changes and unusual access; correlate with sign-in history.
Assessment: Suspicious changes are resolved or escalated. A configuration review does not declare the tenant breach-free without investigating activity.
Microsoft Defender portal: email policies, protection coverage, quarantine and incidents.
Verify: Reconcile users and groups with assigned licences, preset policies, custom policies and exclusions.
Assessment: Expected recipients receive the intended protection. Capture effective policy precedence and missing coverage.
Verify: Review protected people and domains, actions, thresholds and exceptions.
Assessment: High-impact impersonation targets are included where the capability is used. Stale executives or broad exceptions are corrected.
Verify: Inspect applicable settings, excluded URLs and authorised benign tests in the workloads being used.
Assessment: Protection behaves as intended; exclusions and user override options have an approved rationale.
Verify: Review attachment policies and the settings for SharePoint, OneDrive and Teams protection where licensed.
Assessment: Each in-scope workload has verified protection. A mail policy alone is not evidence of collaboration-workload coverage.
Verify: Inspect allow entries, transport-rule overrides, quarantine permissions and release procedures.
Assessment: Bypasses are narrow and reviewed. Users and helpdesk staff cannot routinely release threats without the intended safeguards.
Verify: Submit an authorised harmless test through the user-reporting process and follow its route to the response team.
Assessment: Reports reach an accountable responder with a recorded outcome. An enabled reporting button without operational handling is a gap.
SharePoint admin center, Teams admin center, site permissions and Entra external identities.
Verify: Review tenant and site settings, default link types, expiry and who can invite external users.
Assessment: Defaults fit data sensitivity and business needs. Existing sites and exceptions are reviewed separately.
Verify: Inspect owners, members, direct grants, broad groups and broken inheritance on selected sensitive sites.
Assessment: Access corresponds to an approved audience. Unexpected broad access is evidenced using a permitted test identity.
Verify: Review anonymous and organisation-wide links to selected sensitive files and folders.
Assessment: Unnecessary links are revoked after owner review. Changing the default link type is not recorded as revoking old links.
Verify: Sample guest invitations, sponsors, last use, review decisions and access after an engagement ends.
Assessment: Guests have sponsors and review dates; stale memberships and cross-tenant access exceptions are addressed.
Verify: Inspect guest access, external federation, shared channels, meeting access and third-party apps.
Assessment: Each collaboration path is reviewed in its own context; external chat access is not confused with guest file access.
Verify: Test approved browser and download restrictions against in-scope SharePoint and OneDrive content.
Assessment: Results match the agreed device policy. Document any access path that permits downloading sensitive data to unmanaged devices.
Intune admin center, endpoint protection inventory and effective device access results.
Verify: Reconcile active access with enrolled devices, ownership, operating systems and stale records.
Assessment: Unsupported or unknown devices do not disappear from the audit simply because they are absent from Intune.
Verify: Review policy assignments, grace periods, exclusions and sign-in outcomes for a noncompliant test device.
Assessment: Compliance requirements affect access as designed. A compliance dashboard alone is not evidence of enforced access control.
Verify: Sample disk-encryption status and the permissions and process used to retrieve recovery keys.
Assessment: Required devices are encrypted and keys are recoverable only by authorised staff through a controlled process.
Verify: Inspect sensor onboarding, active protection, tamper controls and alert connectivity on sampled endpoints.
Assessment: Required protection is healthy and reporting; installed software without current telemetry does not pass.
Verify: Review update policy, overdue security updates and local administrator access on representative devices.
Assessment: Exceptions have owners and treatment dates. Administrator rights are justified rather than assigned by convenience.
Verify: Review app-protection assignments, data-transfer rules, lost-device response and selective wipe where used.
Assessment: Corporate data is handled according to the BYOD policy. Verify the user experience with an authorised test account.
Microsoft Purview, SharePoint permissions and the administration surfaces for the AI features in use.
Verify: Identify where regulated, confidential and commercially sensitive information is stored and who owns it.
Assessment: The review includes actual high-impact locations, not only an empty classification policy or demonstration site.
Verify: Inspect published sensitivity labels, assignment scope and a permitted protected-file access test.
Assessment: Labels and any encryption settings work for the intended audience; the presence of a label alone is not treated as access restriction.
Verify: Review policy scope, exclusions, simulation/enforcement state and a benign test using synthetic data.
Assessment: The intended action occurs in the relevant workload, and alerts are handled. Record licensing and any unprotected channels.
Verify: Inspect retention policies, holds, deletion rules and the handling of departed users.
Assessment: Retention follows approved requirements and does not substitute for a tested recovery plan. Resolve conflicting or unintended policies.
Verify: Where deployed, test approved low-privilege identities against representative sensitive-content scenarios and review sharing permissions.
Assessment: Unexpected discoverability is traced to permissions or governance gaps. Do not infer safety solely from a successful Copilot rollout.
Verify: Inventory AI agents, connectors and other integrations with access to organisational data; inspect consent and data boundaries.
Assessment: Each connection has an owner and approved purpose. Permissions, publication scope and monitoring fit the data it can reach.
Purview Audit, Entra sign-in/audit logs, Defender and any connected SIEM.
Verify: Verify auditing status and retrieve known authorised test events from relevant workloads.
Assessment: Expected events are searchable with actor, action, object and time. Record collection delay and any unavailable events.
Verify: Record retention and export arrangements for Purview, Entra and other relevant logs, including user licensing.
Assessment: Required investigation periods are supported. Do not assume Purview retention also applies to Entra sign-in logs.
Verify: Inspect connector health, permissions, ingestion gaps and monitoring of collection failures.
Assessment: A stopped or degraded pipeline produces an actionable alert. Historical events can be retrieved from the intended destination.
Verify: Test or review detections for administrator changes, consent grants, security-policy changes and emergency-account use.
Assessment: Alert scope includes important change paths and reaches an owner; noise is managed without silencing critical events.
Verify: Review detections for suspicious forwarding, unusual downloads and other scenarios relevant to the organisation.
Assessment: Investigators can correlate identities, apps and activity. Record coverage gaps rather than assuming every licence provides every detection.
Verify: Rehearse log access with the incident-response role and capture an example investigation timeline.
Assessment: Responders have appropriate access, timestamps are interpretable, and evidence handling is documented without copying unnecessary sensitive content.
Response procedures, backup administration, change records and the risk register.
Verify: Walk through an authorised scenario covering account isolation, session revocation, app grants and malicious mailbox changes.
Assessment: The team knows who can act and how to preserve evidence. A password reset alone is not the entire containment procedure.
Verify: Perform an approved recovery test for representative mail and files; record elapsed time and restored content.
Assessment: Recovery meets agreed business objectives. Recycle bins or retention settings are not accepted as a substitute for a demonstrated restore.
Verify: Review backup administrators, authentication, deletion rights and dependence on the production tenant.
Assessment: An attacker controlling ordinary tenant access cannot automatically erase every recovery option; dependencies and residual risks are documented.
Verify: Review owners, deadlines, risk acceptance, expiry dates and retest evidence for outstanding items.
Assessment: Every unresolved material gap has a decision and an accountable owner. Deferred work is not reported as a passed control.
Verify: Inspect pilot groups, change approvals, rollback planning and confirmation of policy effects.
Assessment: Hardening changes are tested before broad enforcement; emergency recovery remains available.
Verify: Agree review dates and triggers such as acquisitions, new domains, licence changes, new apps, AI deployments or incidents.
Assessment: The organisation can detect configuration drift between full reviews and update the evidence after material changes.
Original Atlant Security review questions. These IDs are not CIS or CISA control numbers. This worksheet is not a completed audit report or a certification. Apply the relevant baseline and confirm licensing, business requirements and exceptions.