Checklist / Microsoft 365

5 Microsoft 365 Settings Attackers Hope You Have Not Reviewed

Harris Ejiofor, CISM – CyberShield Advisory

Five areas of a Microsoft 365 environment that are easy to leave unchecked and worth a review this month, described in plain terms for owners and the people who support them.

Why review settings at all

Attackers may not need clever tools. They look for accounts that are easy to sign in to and settings nobody has looked at since setup. Microsoft 365 offers many protections, but a number of them depend on how your organization configures them and on your license. This checklist covers five areas worth reviewing. We describe them in general terms, so ask your IT provider to show you the current state of each.

1. Sign-in requirements

MFA is required for every user, including administrators and shared accounts.
Older sign-in methods that cannot use MFA are blocked or understood.
Someone knows which MFA methods people actually use.

2. Administrator roles

You can list every person with an administrator role.
Each person still needs the access they have.
Administrators use a separate account for administrative work where practical.
Former staff and former vendors have no roles.

3. Email forwarding and mailbox rules

Automatic forwarding to outside addresses is restricted, or you know who uses it and why.
Alerts exist for new forwarding or inbox rules.
Mailbox rules are reviewed after any suspected account compromise.

4. External sharing

You know whether files and folders can be shared with people outside your organization.
Links that anyone can open are limited to where they are truly needed.
Guest accounts are reviewed and removed when a project ends.

5. Alerts and records

Activity logging is turned on, and you know how long records are kept.
Someone receives security alerts and knows what to do with them.
Unusual sign-ins and changes to security settings would be noticed.

How to use this list

Go through each item and mark it yes, no or not sure. Treat not sure as no until someone shows you. Then pick the two or three no answers that would hurt most if they were exploited, and put owners and dates on them. A short list that gets finished is worth more than a long one that does not.

Some protections, including Conditional Access, depend on your Microsoft Entra ID license level. If your plan does not include something, a review is still useful, because it tells you what to ask for or what to do another way.

Take the next step

Our free Microsoft 365 security assessment asks five quick questions about sign-in, email, sharing, devices and backup, and shows where to start. It is a short check, not a full review of your settings.