A Microsoft 365 Hardening Checklist for Small Teams

Renewal-season questionnaires tend to ask the same few questions about Microsoft 365, and Cybersecurity Awareness Month is a good reason to answer them properly. This checklist is built for a small IT team that can set aside about a week. Each item says what to verify, not what to buy, and it does not assume a particular license tier. Microsoft’s own documentation is the authority on how each setting behaves in your tenant.

1. Block legacy authentication

Legacy protocols do not support multifactor authentication. Microsoft’s analysis states that more than 97 percent of credential stuffing attacks and more than 99 percent of password spray attacks use legacy authentication, and its guidance says those attacks would stop with basic authentication disabled or blocked.

Verify:

• Usage. Filter the sign-in logs by client app for legacy protocols, on both the interactive and non-interactive tabs.
• Policy. A Conditional Access policy blocks legacy authentication, rolled out in report-only mode first. Microsoft notes that security defaults can do this where Conditional Access is not licensed.
• Dependencies. Old scanners, scripts and line-of-business apps that rely on it are found before the block goes on, not after.

2. Make MFA resist push-spam

Push fatigue works when a tired user taps Approve. Microsoft documents that number matching is enabled for Authenticator push notifications, and users cannot opt out.

Verify:

• What users actually have. Check the registered authentication methods report instead of assuming everyone uses the app.
• Admins. Where you can, move privileged accounts to phishing-resistant methods such as FIDO2 keys or passkeys.

3. Unified audit log on, retention long enough

Microsoft documents that Audit (Standard) is enabled by default and keeps records for 180 days. That is the number to compare against reality: compromises are often noticed late, and a log that has already expired cannot answer questions.

Verify:

• Someone on the team has permission to search the unified audit log, and has tried it this month.
• You know which retention your licensing gives you. Microsoft documents longer retention in Audit (Premium) and through audit log retention policies.

4. Block automatic external forwarding; review rules and OAuth consent

The FBI’s Internet Crime Complaint Center describes attackers creating mailbox rules that delete key messages and turning on automatic forwarding to an outside account. It recommends blocking automatic forwarding to external addresses.

Verify:

• Forwarding. The outbound policy blocks automatic external forwarding, and you have a list of mailboxes that forward today.
• Inbox rules. Review rules, including hidden ones, on finance and executive mailboxes first.
• OAuth consent. Review who can consent to apps, and look at the enterprise applications list for grants nobody can explain.

5. Separate admin accounts and test break-glass

Verify:

• Admins use a dedicated cloud-only account for admin work, with no everyday mailbox.
• The list of Global Administrators is short, and each person on it is deliberate.
• Break-glass accounts are few, cloud-only, protected with a strong method such as a FIDO2 key, and alerted on at sign-in. Any Conditional Access exclusion is deliberate and limited.
• Someone has signed in with a break-glass account recently to show it works.

6. Turn it into a one-page review

A one-time project fades. A one-page review survives staff changes. For each area above, record the owner, the date last checked, what you looked at, and what you changed. Revisit it on a schedule your team can keep, such as quarterly. The same page can also answer many renewal questionnaires without a scramble.

Sources

• Microsoft Learn: Block legacy authentication with Conditional Access
• Microsoft Learn: How number matching works in MFA push notifications for Authenticator
• Microsoft Learn: Auditing solutions in Microsoft Purview
• FBI IC3 PSA200406: Business email compromise and cloud email accounts

If a check turns up something suspicious, our BEC and Microsoft 365 investigation service can help, and our managed security services cover ongoing monitoring.

Message us to talk through your Microsoft 365 hardening plan.

Sources

• Microsoft Learn: Block legacy authentication with Conditional Access
• Microsoft Learn: Auditing solutions in Microsoft Purview