Microsoft 365 Security Checklist: Tenant Settings to Audit Each Quarter

Microsoft 365 tenants drift: a new admin, a consented app, a sharing exception or a re-enabled protocol undoes last year's hardening without anyone noticing. This template is a tickable quarterly audit checklist for Microsoft 365 tenant settings, built on CISA's Secure Cloud Business Applications (SCuBA) M365 baselines so that every check has a public, versioned source and a policy ID you can quote. It covers Entra ID sign-in and privileged access, applications and workload identities, Exchange Online, the Defender and Purview security suite, SharePoint and OneDrive, Teams and Power Platform, plus how to record results and evidence. It is written for Microsoft 365 administrators, security engineers and internal auditors. For why each control matters and how to deploy it, read the Microsoft 365 Security Guide; this page audits.

This is an independent guide from NHI Mgmt Group, based on Microsoft's public documentation as of November 2026. It is not sponsored or reviewed by Microsoft. Product features change, so confirm settings against Microsoft's current documentation.

How to use this template

• Replace text in square brackets, such as [Organisation], [tenant name] and [SIEM], with your own details.
• Each check shows the SCuBA policy ID (for example MS.AAD.3.1v1) as published in the cisagov/ScubaGear repository when checked on 8 November 2026. "SHALL" policies are the baseline's mandatory items; "SHOULD" policies are recommended. Policy IDs carry a version suffix that changes when CISA revises a policy, so record the baseline version you audited against.
• Mark each line Pass, Fail, Exception (link the risk acceptance) or N/A, and record the evidence: a screenshot, an exported policy, or the ScubaGear report line.
• CISA's baselines assume at least an M365 E3 or G3 licence and list extra licences per policy. Where a feature sits outside your licence, record the compensating control rather than marking N/A.
• If you also follow the CIS Microsoft 365 Foundations Benchmark, add a column with the matching CIS recommendation number so one audit serves both.
• Run ScubaGear, CISA's open source assessment tool, against the tenant first; use this checklist to review its results, cover the manual checks and record exceptions.

1. Audit record

2. Entra ID: sign-in and authentication

Check that every Conditional Access policy above excludes only the documented emergency access accounts. See the Conditional Access Guide and the Break-Glass Account Guide.

3. Entra ID: privileged access

See Microsoft 365 admin centres and admin roles.

4. Entra ID: applications, workload identities, guests and agents

Application and service principal credentials are the non-human identities of a tenant, and they are where consent phishing and long-lived secrets hide.

See How to review Microsoft 365 app registrations with mail permissions, How to find expiring app secrets and certificates in Entra ID and the Consent Phishing and Illicit OAuth Grants Guide.

5. Exchange Online

See the DMARC, SPF and DKIM Guide and the Email Authentication Checklist.

6. Security suite: Defender for Office 365 and Purview

See the Microsoft 365 Unified Audit Log Guide for Detection and the Data Loss Prevention (DLP) Guide.

7. SharePoint, OneDrive, Teams and Power Platform

See the SharePoint and OneDrive Security Guide and the Microsoft Teams Security Guide. Teams external contact settings also limit the help desk impersonation attacks described in the Email Bombing and Help Desk Impersonation over Teams Guide.

8. Findings and sign-off

• Fix targets: failed SHALL checks fixed within [30 days]; failed SHOULD checks within [90 days] or accepted as exceptions by [role].
• Sign-off: [Microsoft 365 service owner] and [CISO or delegate], [date].

Implementation guidance

1. Baseline once, then audit drift: the first run will produce many findings. Prioritise sections 2 and 3 (sign-in and privileged access) and the application checks in section 4, then work through the rest. Later quarters should show only drift.
2. Test before enforcing: put new Conditional Access policies in report-only mode first and review sign-in logs for affected users; roll back by switching the policy off. Disabling SMTP AUTH and legacy authentication breaks old devices and scripts, so find them in sign-in logs before enforcement.
3. Automate collection: schedule ScubaGear or an equivalent configuration export, store reports with the audit record, and diff them each quarter.
4. Measure: percentage of SHALL checks passing; number of Global Administrators; percentage of users with phishing-resistant MFA registered; applications with client secrets older than 180 days; days to close failed SHALL checks. Microsoft describes Secure Score as a posture indicator, not a measure of breach likelihood, so report it as a trend beside these metrics, not instead of them.
5. Read with the misconfiguration list: the Top 10 Microsoft 365 Security Misconfigurations explains the failures auditors find most often.

Standards and references

• CISA: M365 Secure Configuration Baseline for Microsoft Entra ID
• CISA: M365 Secure Configuration Baseline for Exchange Online
• CISA: M365 Secure Configuration Security Suite Baseline
• CISA: M365 Secure Configuration Baseline for SharePoint Online and OneDrive
• CISA: M365 Secure Configuration Baseline for Microsoft Teams
• CISA: ScubaGear assessment tool
• Microsoft Learn: Microsoft Secure Score
• NIST: SP 800-53 Rev. 5 Security and Privacy Controls

Related NHI Mgmt Group resources: Microsoft 365 Security Guide · Entra ID Security Guide · Top 10 Microsoft 365 Security Misconfigurations · Microsoft 365 Unified Audit Log Guide for Detection · Entra ID Applications and Consent Guide