Microsoft 365 (Office 365) Security Best Practices: 2026 Checklist

Office 365 security best practices in 2026 come down to a short list of controls that break the attacks Microsoft 365 tenants actually suffer. The essentials: MFA on every account (phishing-resistant for admins) enforced by Conditional Access, legacy authentication and device code sign-in blocked, few administrators with no standing access, user consent to apps locked down, external forwarding off, and audit logs someone reads. The 40 checks below each show where the setting lives, the license it needs and how to confirm it is on. They reflect Microsoft’s settings and timelines as of November 2026.

Office 365, Microsoft 365 and M365 name the same tenant, so these Microsoft 365 security best practices apply whatever your license says. Our Microsoft 365 security assessment checks them by hand, from $4,200 for one tenant of up to 250 users, or $6,800 with attack simulation or hybrid Active Directory in scope (Microsoft 365 assessment pricing).

How Microsoft 365 tenants actually get breached

Almost no tenant compromise starts with an exploit. It starts with a sign-in. Business email compromise, the usual end point, cost victims $3.05 billion in reported losses in 2025, second only to investment fraud in the FBI’s 2025 Internet Crime Report.

Attack path	What happens	Control that breaks it
Password spray	Common passwords tried slowly against every account, hunting for one without MFA	MFA everywhere, legacy authentication blocked
Adversary-in-the-middle phishing	A proxy relays the real sign-in page and steals the session cookie after MFA (Evilginx explained)	Phishing-resistant MFA, compliant devices
Device code phishing	The victim enters an attacker’s code on Microsoft’s genuine device login page	Device code flow blocked
Consent phishing	A user approves an app that reads mail or files, and the grant survives a password reset (malicious connected apps)	User consent restricted, grants reviewed
Mailbox takeover	A hidden inbox rule and a quiet forward set up a fake bank-detail change	Forwarding off, inbox-rule alerts, call-back checks on payment changes

Microsoft’s own breach shows several. In January 2024 it disclosed that Midnight Blizzard password-sprayed a legacy test tenant account with no MFA, then used a legacy test OAuth app with elevated access to grant OAuth apps it had created the Exchange Online full_access_as_app role, and used them to read corporate mailboxes. Both mistakes are on the checklist.

The ten Office 365 security best practices to fix first

1. Require MFA for every account through Conditional Access, or security defaults without Entra ID P1.
2. Block legacy authentication.
3. Require phishing-resistant MFA for every administrator.
4. Block device code flow.
5. Keep Global Administrators under five in total, emergency access accounts included.
6. Restrict user consent to apps and review existing grants.
7. Turn off automatic external forwarding and audit inbox rules.
8. Set up DKIM and DMARC on every sending domain.
9. Make SharePoint and OneDrive Anyone links expire, or remove them.
10. Confirm audit logging is on and alerts reach a person.

The Microsoft 365 security checklist

Free means any tenant. P1 and P2 are Microsoft Entra ID plans: Microsoft 365 Business Premium and E3 include P1, and E5 includes P2. MDO P1 (Defender for Office 365 Plan 1) comes with Business Premium. Office 365 plans and Business Basic or Standard lack P1 and rely on security defaults unless it is added.

The checks carry no benchmark IDs. To cross-reference them, use the CIS Microsoft 365 benchmark our reports map to, or CISA’s SCuBA secure configuration baselines, which come with ScubaGear, a no-cost tool that checks a tenant against them.

Identity and authentication

#	Check	Where	License	How to verify
1	MFA for every user and resource, by Conditional Access or security defaults, not per-user MFA	Conditional Access	Free / P1	P1: no interactive single-factor sign-ins in 30 days, documented exclusions aside. Security defaults: every user registered
2	Phishing-resistant MFA for all admin roles	Conditional Access authentication strength	P1	Admin sign-ins use passkeys, Windows Hello for Business or certificates
3	SMS and voice removed, at least for admins	Authentication methods policy	Free	No admin has a phone method
4	Legacy authentication blocked	Conditional Access or security defaults	Free / P1	Legacy client sign-ins all fail
5	SMTP AUTH off, except named mailboxes	Exchange admin center	Free	Org-wide SMTP AUTH is off; only listed mailboxes have it on
6	Device code flow blocked, with named exceptions	Conditional Access authentication flows	P1	No unexpected Device code sign-ins
7	Adding an MFA method requires MFA or a Temporary Access Pass	Conditional Access user action	P1	A password-only test user cannot add a method
8	Sign-in and user risk policies in Conditional Access, not the retired ID Protection ones	Conditional Access risk conditions	P2	Risky sign-ins require MFA, risky users must remediate
9	Guest invitations limited, stale guests removed	External collaboration settings	Free	No long-dormant guests

Security defaults block legacy protocols and device code flow, the latter in all new tenants since July 1, 2026, but require MFA at every sign-in only for privileged admin roles and prompt other users only when Microsoft judges it necessary (Microsoft’s security defaults documentation). Only Conditional Access requires MFA on every sign-in for every user. There, check the Microsoft-managed “Block device code flow” policy, which Microsoft can switch on from report-only unless an admin turns it off, or build your own. Microsoft has tracked device code phishing by Storm-2372 since August 2024. Basic authentication for SMTP AUTH will be disabled by default in existing tenants at the end of December 2026, but admins can re-enable it, so check.

Conditional Access hygiene

#	Check	Where	License	How to verify
10	Exclusions limited to the two emergency accounts and named service accounts such as Entra Connect Sync	Each policy	P1	Every exclusion has a written reason and an owner
11	No enforcing policy left in report-only	Policy list	P1	Intended controls show On
12	Trusted locations never skip MFA	Named locations	P1	No location-based MFA bypass
13	Admin portals require a compliant or hybrid-joined device	Grant controls	P1 + Intune	A personal laptop cannot reach admin portals
14	Token protection piloted for Exchange, SharePoint and Teams	Session controls	P1	Report-only results reviewed, then enforced

An MFA policy with a twelve-person “temporary” migration group excluded has twelve holes.

Admin roles and privileged access

#	Check	Where	License	How to verify
15	Fewer than five Global Administrators, emergency accounts included	Roles and admins	Free	Count active assignments
16	Two cloud-only emergency accounts with passkey or certificate MFA	Users	Free (alerting needs Azure Monitor or a SIEM)	Any sign-in to them raises an alert
17	Admin roles on separate cloud-only accounts	Users	Free	No role on a synced or mailbox account
18	Least-privileged roles, fewer than 10 privileged assignments	Roles and admins	Free	Service admin roles used for service tasks
19	Just-in-time activation for privileged roles	Privileged Identity Management	P2	Roles show Eligible, not Active
20	Partner admin relationships reviewed	Admin center partner relationships	Free	Every partner is current and under contract

Those thresholds, and keeping synced accounts out of admin roles, are Microsoft’s own guidance for Entra roles.

Apps and OAuth consent

#	Check	Where	License	How to verify
21	User consent Microsoft-managed, verified publishers only, or off	Enterprise apps consent settings	Free	Not “Allow user consent for apps”
22	Admin consent workflow on	Same page	Free	Requests reach a named reviewer
23	Existing grants reviewed	Enterprise apps permissions	Free	Every app holding Mail.Read, Files.Read.All, full_access_as_app or Directory.ReadWrite.All has an owner
24	Users cannot register apps; app secrets inventoried	User settings, App registrations	Free	Setting is No
25	Exchange Web Services allow list limited to named apps	Exchange Online organization settings	Free	Only listed apps reach EWS

The Microsoft-managed consent setting, the default for new tenants, blocks user consent to Files.Read.All, Sites.Read.All, Mail.Read, Calendars.Read, Chat.Read and more (Microsoft’s app consent policy documentation). Older tenants often still allow wider user consent, and changing the setting never revokes old grants. Microsoft began disabling EWS on or soon after October 1, 2026 for tenants without an allow list, with permanent shutdown on April 1, 2027 (Exchange team announcement). Midnight Blizzard read mail through it.

Exchange Online mail security

#	Check	Where	License	How to verify
26	External auto-forwarding Off, not “Automatic - System-controlled”	Outbound spam policy	Free	Auto-forwarded messages report shows only approved exceptions
27	Inbox rules and mailbox forwarding audited	Exchange admin center	Free	No rule forwards out, deletes, or hides mail in RSS Feeds without reason
28	DKIM on for every custom domain	Email authentication settings	Free	Headers show your domain signing
29	DMARC published and moving to p=reject, SPF complete	Public DNS	Free	Reports show only known senders
30	Standard or Strict preset policy, impersonation protection for executives and finance	Preset security policies	MDO P1	Protected users listed
31	Reject Direct Send on, if nothing uses it	Exchange Online organization settings	Free	Outside mail claiming your domain is refused
32	FullAccess and SendAs on finance and executive mailboxes reviewed	Mailbox delegation	Free	Every delegate is current

“Automatic - System-controlled” forwarding means Off in most tenants but can still mean On in older tenants that were already using it, so Microsoft advises choosing On or Off explicitly. Microsoft also DKIM-signs only the onmicrosoft.com domain until you configure each custom domain.

SharePoint, OneDrive and Teams

#	Check	Where	License	How to verify
33	Sharing set to “New and existing guests” or tighter; any Anyone links expire and are view-only	SharePoint admin center, Sharing	Free	Organization and most permissive site checked
34	Default link type “Specific people” or internal only	Same page	Free	New shares default to the narrow link
35	Guest access expires automatically	Same page	Free	Expiration days set
36	Teams external access limited to allowed domains; unmanaged accounts cannot start chats	Teams admin center, External access	Free	An outside test tenant cannot message staff

Teams allows all external domains by default, which is how a fake “IT help desk” message reaches staff past every mail filter. Our guide to spear phishing covers the pretexts.

Logging and detection

#	Check	Where	License	How to verify
37	Audit log on, retention known	Purview Audit	Free / E5	Yesterday’s events are searchable
38	Mailbox auditing not disabled, no audit bypasses	Exchange Online organization settings	Free	No bypassed users
39	Alerts on the detection map below reach a person	Defender alert policies or your SIEM	Free / E5	A test inbox rule raises an alert the same day

Audit (Standard) keeps records for 180 days; Audit (Premium) keeps Entra, Exchange, SharePoint and OneDrive records for a year for E5 users (Microsoft Purview audit retention). Export them if you need longer.

Hybrid identity

#	Check	Where	License	How to verify
40	Entra Connect server treated as Tier 0; soft matching and hard-match takeover off	The server; sync settings	Free	Only identity admins can sign in to it

Microsoft says to treat the Entra Connect server as Tier 0, because whoever controls it can change users in Entra ID. Our Active Directory security checklist covers the on-premises side, and an Active Directory security assessment tests it.

The risk runs both ways: an attacker who takes the sync server or a synced admin account can move into the tenant. Our guide to lateral movement from on-premises to cloud follows that path.

Data protection and Copilot oversharing

Microsoft 365 Copilot does not bypass permissions: Microsoft says it only surfaces organizational data to which individual users have at least view permissions. That is the problem. A site shared with the whole company years ago was hard to stumble on; an assistant that answers from everything a user can open finds it in seconds, and so does an attacker signed in as that user. These four checks sit outside the 40 and matter most before a Copilot rollout; licensing for them varies by plan.

Check	Where	How to verify
Overshared sites found and narrowed	SharePoint Advanced Management, data access governance reports	The reports have been run, and each broadly shared site has an owner who confirmed or reduced its access
High-risk sites kept out of Copilot until their permissions are fixed	SharePoint Advanced Management, Restricted Content Discovery	A test user who can open the site cannot surface its files through Copilot
Encrypting sensitivity labels on confidential content	Microsoft Purview sensitivity labels	A user without both the VIEW and EXTRACT usage rights gets no answer drawn from a labelled file
AI use and oversharing reviewed by a named owner	Microsoft Purview, Data Security Posture Management for AI	Someone reads the reports on a schedule

What to alert on: a Microsoft 365 detection map

Signal	Where it is logged	Operation or filter	What it usually means
Inbox rule created or changed	Purview audit, Exchange	New-InboxRule, Set-InboxRule, UpdateInboxRules	Replies hidden or invoice threads diverted
Mailbox forwarding set	Purview audit, Exchange admin	Set-Mailbox setting ForwardingSmtpAddress	All mail copied outside
Mailbox permission added	Purview audit, Exchange admin	Add-MailboxPermission	Quiet access to an executive or finance mailbox
MFA method added	Entra audit log	User registered security info; Admin registered security info	An attacker adding their own authenticator after a phished sign-in
App granted access	Entra audit log	Consent to application; Add delegated permission grant; Add app role assignment to service principal	Consent phishing or an unreviewed integration
App credentials added	Entra audit log	Add service principal credentials; Update application - Certificates and secrets management	Persistence through an app, the Midnight Blizzard pattern
Admin role granted	Entra audit log	Add member to role	Privilege escalation, or an admin bypassing PIM
Conditional Access weakened	Entra audit log	Update or Delete Conditional Access policy	Someone switching off the control that stopped them
Device code sign-in	Entra sign-in logs	Authentication protocol: Device code	Possible device code phishing
Legacy protocol attempts	Entra sign-in logs	Client app: IMAP, POP, SMTP, Exchange ActiveSync or other legacy clients	Password spray, or a forgotten scanner
Emergency account sign-in	Entra sign-in logs	Any sign-in by break-glass accounts	Never expected outside a real emergency

What it costs to have the checklist verified

Our Microsoft 365 security assessment is this checklist done by hand with a read-only role such as Global Reader; nothing in the tenant changes.

Your situation	What fits	Price
Tenant never reviewed, up to 250 users	Configuration review	$4,200
A past takeover, contained by your incident response provider; 251 to 1,000 users; or hybrid AD in scope	Review plus attack simulation from a compromised user	$6,800
Several tenants, over 1,000 users, or E5 workloads in depth	Large scope	Quoted, fixed before work
Google Workspace instead (Google Workspace security checklist)	Same tiers	Same prices
Azure subscriptions running workloads (Azure testing guide)	Cloud penetration testing	From $6,800

Each tier ships an executive report, a technical report mapped to the CIS Microsoft 365 benchmark, an attestation letter and findings-platform access, and we re-check every fixed setting free. Onboarding starts within 24 hours of a signed proposal; the configuration review takes 3 to 4 analyst days, with the report within 1 to 2 weeks of read-only access. To measure who clicks, add a phishing simulation from $3,600 (phishing testing pricing). Send the scoping questionnaire for a fixed price in writing, or see a sample report first.

Compliance and cyber insurance

Since November 1, 2025, New York’s 23 NYCRR 500.12 has required covered entities to use MFA for anyone accessing their information systems, unless a CISO approves equivalent controls in writing; entities with a 500.19(a) limited exemption still need it for remote access to their information systems, remote access to third-party applications (cloud ones included) from which nonpublic information is accessible, and all privileged accounts other than service accounts that prohibit interactive login (NYDFS Part 500 testing). SOC 2 auditors test logical access (CC6.1, CC6.6; see SOC 2 penetration testing), and insurers ask whether MFA covers every account (cyber insurance and penetration testing).

Other rules and reviews land on the same controls:

• Cyber Essentials (UK). The Cyber Essentials MFA requirement makes MFA mandatory on every cloud service where it is available, and a missing one is an automatic fail.
• SEC-registered advisers and broker-dealers. Customer information sitting in mailboxes falls under Regulation S-P, and the email tenant is the first area we look at in Regulation S-P safeguards testing.
• Wealth managers. A taken-over adviser mailbox is how fraudulent transfer requests reach a custodian, which is why adviser email leads the scope in our RIA cybersecurity work.
• Law firms. Mailbox compromise and diverted wires are a firm’s main exposure; see our law firm penetration testing services.

Frequently asked questions

What are the most important Office 365 security best practices? MFA on every account, phishing-resistant for admins; legacy authentication and device code flow blocked; fewer than five Global Administrators; user consent restricted; external forwarding off; and alerts that reach a person.

Is Microsoft Secure Score enough to secure Microsoft 365? No. It lists recommended settings but does not judge whether an exclusion undoes a policy, which apps users already approved or which inbox rules forward mail out. Check it monthly and have a person review the tenant yearly.

Do we need Microsoft 365 E5 to follow these M365 security best practices? No. Business Premium covers most of the checklist with Entra ID P1 and Defender for Office 365 Plan 1, but it is capped at 300 users; larger tenants get P1 through Microsoft 365 E3. E5 adds risk-based policies, Privileged Identity Management and one-year audit retention.

Are security defaults enough for a small business? They are a sound floor. Security defaults block legacy authentication and, in tenants created since July 1, 2026, device code flow, but they require MFA at every sign-in only for administrator roles and prompt everyone else when Microsoft judges it necessary. Once you have Entra ID P1, which Business Premium includes, move to Conditional Access.

How does Copilot change Microsoft 365 security priorities? It does not add a new way in, but it makes old oversharing easy to find, for staff and for anyone who takes over an account. Review who can open what in SharePoint and OneDrive before the rollout; the four data protection checks above are the place to start.

Can we penetration test our own Microsoft 365 tenant? Yes. Microsoft’s cloud penetration testing rules of engagement allow testing your own tenant if the work stays inside it: no denial of service, no other customers’ tenants and no phishing of Microsoft employees.

How much does an M365 security assessment cost? At Invadel, $4,200 for a configuration review of one tenant of up to 250 users, and $6,800 with an attack simulation or for 251 to 1,000 users. Larger tenants are quoted, and every tier includes a free retest. Details are on the Microsoft 365 assessment pricing page.

The short version

Most Microsoft 365 breaches start with a sign-in, not an exploit, so identity controls come first. Fix the ten items at the top, then work down the 40 checks. For a fixed-price review with a free retest, see our Microsoft 365 security assessment and its pricing, or send us your scope.