Sample Microsoft 365 Security Hardening Report
Below is the complete, unabridged 28-point Traffic-Light Audit Sheet produced by our automated Microsoft 365 inspection tool, shown for the fictional practice Severn Gate Legal LLP (26 staff, Microsoft 365 Business Standard).
Severn Gate Legal LLP
Automated Microsoft Graph and public DNS inspection across 28 security controls identified 8 Red (Action Required) findings, 14 Amber (Worth Hardening) findings, and 6 Green controls, including 4 Cyber Essentials v3.3 blockers.
Priority Red Actions (8 Urgent Fixes)
Every Red finding below can be remediated without disrupting legitimate staff work. Estimated total engineering time: half a day.
Deploy Alphabyte's 6-Policy Conditional Access Baseline (Require MFA for All Users, Require Phishing-Resistant MFA for Admins, Block Legacy Auth, Block High-Risk Countries, Require Compliant Device for Finance/Partner data).
Create an Entra Named Location for 'United Kingdom & Ireland' and block sign-ins from all other countries unless a user is temporarily added to the `M365-Travel-Approved` security group.
Convert the 2 former locum mailboxes to Shared Mailboxes, set `AccountEnabled = false` on all 4 dormant accounts, and remove £49/month in wasted licences.
Reduce Global Administrators to 2 dedicated admin accounts + 2 emergency break-glass accounts. Remove Global Admin from the external web developer immediately.
Create separate unlicensed `admin-name@` accounts with no mailbox for administrative tasks, and strip all admin roles from daily email accounts.
Set `AutoForwardEnabled = Off` in Defender Outbound Spam Policy and set `AutoForwardEnabled = $false` on the default Exchange Remote Domain (`*`).
Once DKIM is enabled, update `_dmarc.severngatelegal.co.uk` to `v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc@severngatelegal.co.uk;` for 14 days, then advance to `p=reject`.
Switch Entra Enterprise Applications → User Consent Settings to 'Do not allow user consent' and enable the Admin Consent Request workflow so staff can request approval with 1 click.
Identity & Sign-In
Multi-Factor Authentication (MFA) Enforced for All Users
Included (All M365 Plans) Cyber Essentials ScopeAny single mailbox without MFA can be compromised via password spraying or credential stuffing in minutes — and is an automatic fail under Cyber Essentials v3.3.
Migrate from legacy per-user MFA to Entra ID Conditional Access (or Security Defaults), require registration within 24 hours for the remaining 3 users, and revoke active refresh tokens.
Legacy Authentication Protocols Blocked (IMAP / POP / SMTP Basic Auth)
Included (All M365 Plans) Cyber Essentials ScopeLegacy authentication protocols cannot enforce MFA and are the #1 route attackers use to bypass MFA prompts.
Keep legacy auth blocked tenant-wide; migrate the single multifunction copier from SMTP Basic Auth to Microsoft Graph High Volume Email or an isolated SendGrid relay.
Phishing-Resistant Authentication Strength & Number Matching
Included / Business Premium for CA StrengthSMS codes are vulnerable to SIM-swap and real-time Adversary-in-the-Middle (EvilProxy) phishing links.
Enforce Microsoft Authenticator Push with Number Matching + Geo-Location display for all staff, register FIDO2 Passkeys for Partners/Admins, and disable SMS MFA once Authenticator enrolment is 100%.
Conditional Access Baseline vs Security Defaults
M365 Business Premium / Entra ID P1 Cyber Essentials ScopeBecause Security Defaults is off and no baseline Conditional Access policy covers all users, new accounts created in the tenant have zero automatic MFA or risk enforcement.
Deploy Alphabyte's 6-Policy Conditional Access Baseline (Require MFA for All Users, Require Phishing-Resistant MFA for Admins, Block Legacy Auth, Block High-Risk Countries, Require Compliant Device for Finance/Partner data).
Geolocation Sign-In Restrictions (UK + Approved Travel Group)
M365 Business Premium / Entra ID P1Without a Named Location country block, automated botnets can continuously probe user passwords and trigger MFA fatigue prompts from overseas.
Create an Entra Named Location for 'United Kingdom & Ireland' and block sign-ins from all other countries unless a user is temporarily added to the `M365-Travel-Approved` security group.
Password Expiration Disabled & NCSC Banned Password List
Included (All M365 Plans) Cyber Essentials ScopeNCSC and Cyber Essentials v3.3 explicitly advise against periodic forced password expiry because it drives staff to choose predictable incremental passwords (`Autumn2026!`).
Set passwords to never expire (`Set-MgDomain -PasswordValidityPeriodInDays 2147483647`) while enforcing MFA + Entra Smart Lockout (10 attempts / 60s lockout) and custom banned password words (`Severn`, `Cardiff`, `Legal`).
Dormant, Former-Staff & Unlicensed Sign-In Enabled Accounts
Included (All M365 Plans) Cyber Essentials ScopeUnmonitored ex-staff or contractor accounts are a prime target for quiet takeover and data exfiltration.
Convert the 2 former locum mailboxes to Shared Mailboxes, set `AccountEnabled = false` on all 4 dormant accounts, and remove £49/month in wasted licences.
Privileged & Admin Access
Global Administrator Count (Target: 2 to 4 Maximum)
Included (All M365 Plans) Cyber Essentials ScopeIf any one of those 6 accounts is phished, the attacker has total control to delete all OneDrive/SharePoint data, disable MFA, and lock the firm out.
Reduce Global Administrators to 2 dedicated admin accounts + 2 emergency break-glass accounts. Remove Global Admin from the external web developer immediately.
Separate Non-Mailboxed Admin Accounts (No Daily Email/Web Use)
Included (Unlicensed Cloud Accounts) Cyber Essentials ScopeUsing an account that receives external emails and browses the web while holding Global Admin rights is an automatic fail under Cyber Essentials v3.3.
Create separate unlicensed `admin-name@` accounts with no mailbox for administrative tasks, and strip all admin roles from daily email accounts.
Two Cloud-Only Emergency 'Break-Glass' Accounts Configured
Included (All M365 Plans)If a Conditional Access policy misconfiguration or DNS/federation outage occurs, administrators can lock themselves out of the tenant completely.
Create two cloud-only `bg-admin-01@` and `bg-admin-02@*.onmicrosoft.com` accounts secured with 24+ character random passwords stored in dual-custody physical/1Password vaults and FIDO2 hardware keys, excluded from Conditional Access.
Admin Session Lifetime & Re-Authentication Frequency
M365 Business Premium / Entra ID P1An unattended laptop or stolen session cookie keeps full Entra/Exchange Admin Center privileges alive for months.
Configure a Conditional Access Session Control policy requiring Sign-In Frequency of 8 hours and `Persistent Browser Session = Never` for all directory admin roles.
Email & Anti-Phishing
External Email Auto-Forwarding Blocked Tenant-Wide
Included (Exchange Online)In Business Email Compromise (BEC) attacks, criminals set up a hidden auto-forward rule so they can monitor conveyancing/invoice threads for weeks even after a password reset.
Set `AutoForwardEnabled = Off` in Defender Outbound Spam Policy and set `AutoForwardEnabled = $false` on the default Exchange Remote Domain (`*`).
Hidden Mailbox Forwarding & Suspicious Inbox Rules Audit
Included (Exchange Online)Forwarding firm financial emails to personal consumer mailboxes leaks client data outside M365 governance and mimics BEC persistence rules.
Review and remove the `@btinternet.com` forwarding rule with the staff member, and enable Defender alerting on creation of new inbox forwarding/redirect rules.
SPF Record Hardened (Single Record, `-all` or `~all`, <10 Lookups)
Public DNSMissing or overly permissive SPF records allow external servers to spoof emails from your domain.
No change required — SPF is properly hardened with `-all`.
DKIM Cryptographic Signing Enabled on Custom Domain
Included (Exchange Online + DNS)Without custom-domain DKIM signing, DMARC alignment fails when emails are forwarded and major receivers (Gmail, Yahoo, enterprise gateways) downgrade deliverability.
Publish the `selector1` and `selector2` CNAME records in DNS and enable 2048-bit DKIM signing in the Defender Portal for `severngatelegal.co.uk`.
DMARC Policy Enforced (`p=quarantine` or `p=reject`)
Public DNS`p=none` is monitoring-only: anyone on the internet can send a fake payment-redirection or invoice email pretending to be `@severngatelegal.co.uk` and receiving mail servers are instructed not to block it.
Once DKIM is enabled, update `_dmarc.severngatelegal.co.uk` to `v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc@severngatelegal.co.uk;` for 14 days, then advance to `p=reject`.
External Sender Warning Banner (`Set-ExternalInOutlook`)
Included (Exchange Online)Without external tagging, staff cannot easily spot display-name spoofing where an attacker sets their display name to a Managing Partner's name.
Keep `Set-ExternalInOutlook -Enabled $true` active and add the firm's trusted sister domains to the allow list if needed.
Shared Mailboxes Blocked from DirectInteractive Sign-In
Included (Exchange Online) Cyber Essentials ScopeShared mailboxes should only be accessed via delegated permissions from a named user's MFA-protected account. Leaving direct sign-in enabled creates backdoor accounts.
Set `AccountEnabled = $false` on all 7 shared mailboxes in Entra ID (this does not affect delegated mailbox access or email delivery).
Defender for Office 365 Safe Links, Safe Attachments & Executive Impersonation
M365 Business Premium / Defender for Office 365 P1Modern phishing emails use delayed weaponized links (clean at delivery, malicious 20 minutes later when clicked) and display-name impersonation of Senior Partners asking Accounts to pay an urgent supplier.
Enable the Defender 'Standard/Strict Preset Security Policy' with User Impersonation protection for all Partners + Accounts staff (either via Business Premium upgrade or a £1.60/user Defender for Office 365 Plan 1 add-on).
SharePoint, OneDrive & OAuth
Third-Party OAuth App Consent Restricted to Admin Approval
Included (Entra ID)Consent phishing ('Illicit Consent Grant') tricks a user into clicking 'Accept' on a fake Microsoft 365 app prompt, giving attackers persistent API access to read emails and files without needing the user's password or MFA.
Switch Entra Enterprise Applications → User Consent Settings to 'Do not allow user consent' and enable the Admin Consent Request workflow so staff can request approval with 1 click.
SharePoint & OneDrive Anonymous 'Anyone with the Link' Sharing
Included (SharePoint Online)An 'Anyone with the link' URL created 2 years ago remains open forever and can be forwarded to unintended recipients without authentication.
Change default sharing link type from 'Anyone' to 'Specific People (Authenticated OTP)', or enforce a mandatory 14-day expiry and view-only default on all external links.
Internal SharePoint Permissions & Microsoft 365 Copilot Oversharing Check
Included (SharePoint Online)Any junior member of staff — or Microsoft 365 Copilot if enabled — can search and surface confidential HR, payroll, and partner financial documents.
Remove `Everyone except external users` from the 3 restricted SharePoint sites and lock access down to role-based security groups (`SG-Partners`, `SG-HR-Finance`).
External Guest Account Hygiene & Stale Guest Access Review
Included (Entra ID)Unreviewed guest accounts accumulate over time and retain access to shared Teams channels and folders.
Keep guest invitations restricted to Member/Admin roles and review the 6 external guests every 6 months.
Audit, Backup & Governance
Unified Audit Log (`AdminAuditLogEnabled`) & Mailbox Auditing Active
Included (All M365 Plans — 180-Day Retention)Without Unified Audit Logging enabled prior to an incident, forensic investigators cannot see which emails or files were accessed during a breach (and ICO reporting becomes far harder).
No change required — 180-day Unified Audit Log is active and recording.
Independent Cloud-to-Cloud Backup for Exchange, OneDrive & SharePoint
Add-On (Dropsuite / Cove / Acronis M365 Backup)Microsoft's Shared Responsibility Model covers infrastructure uptime, not accidental mass deletion, malicious insider purging, or ransomware encryption synced via OneDrive.
Enable immutable daily cloud-to-cloud backup for all 26 Exchange mailboxes, OneDrive accounts, and SharePoint sites (~£3/user/month).
UK Data Residency & GDPR Tenant Location Verification
Included (All M365 Plans)Misconfigured tenant regions can store UK client personal data outside the UK/EEA in breach of client engagement terms.
Record the UK data-at-rest verification screenshot in the firm's GDPR / Law Society compliance folder.
Devices & Endpoint Compliance
Intune MDM Enrolment & BitLocker Encryption Key Escrow
M365 Business Premium / Intune P1 Cyber Essentials ScopeIf a laptop is lost or stolen on a train and you cannot prove via central escrow that BitLocker encryption was active at the time of loss, the ICO treats it as a reportable data breach.
Escrow all 26 BitLocker recovery keys into Entra ID immediately (supported even on Entra-joined devices) and consider full Intune compliance policies for remote wipe.
Personal Mobile & Unmanaged Home PC Access Controls (MAM / App Protection)
M365 Business Premium / Intune P1 Cyber Essentials ScopeClient files downloaded onto an unmanaged home computer infected with info-stealer malware bypass all office firewall controls.
Block full file downloads on unmanaged browser sessions (allow web-only preview) and enforce Outlook Mobile App Protection policies on iOS/Android phones.
Get your 28-point Traffic-Light Report in 24 hours
We run the exact same read-only inspection on your Microsoft 365 tenant and public domain records, then walk you through the Red, Amber and Green findings in plain English—with zero obligation.
Book your tenant check
Call 029 2240 4615, email hello@alphaops.biz, or book online.