Microsoft 365 hardening: a security checklist for businesses

By the QuantumSec team

Microsoft 365's default configuration prioritizes ease of use. This checklist, aligned with the CIS Microsoft 365 Benchmark, walks through the settings that most reduce your attack surface, ordered by impact. Start with identity: Entra ID is where an attacker looks first.

Protect and limit global admins

Reduce the number of global admins to the bare minimum and protect them with phishing-resistant MFA. Use Privileged Identity Management (PIM) to grant privileged roles only when needed (just-in-time) and keep admin accounts separate from day-to-day ones.

Enforce phishing-resistant MFA and conditional access

Enable MFA for all users and, for critical accounts, require phishing-resistant methods (FIDO2, passkeys, Windows Hello). Define conditional access policies that block legacy authentication, restrict by device and location and cover all users without gaps.

Control OAuth app consent

Disable user consent for unverified apps and require admin approval for sensitive permissions. Review existing app registrations and service principals and their permissions: illicit consent is one of the most used vectors against Microsoft 365.

Secure Exchange, SharePoint and logging

In Exchange Online, disable external automatic forwarding and review mailbox permissions. In SharePoint and OneDrive, restrict external sharing and anonymous links. Enable the Unified Audit Log, configure alerts and, if you have Defender and Purview, apply DLP and retention.

FAQ

Is the Secure Score and the CIS Benchmark enough?

They're an excellent configuration baseline, but they don't replace an offensive audit: they review settings one by one, but they don't chain vectors or reproduce what a real attacker would do (illicit consent, AiTM, token theft).

What should I harden first?

Identity: phishing-resistant MFA, conditional access without gaps (including blocking legacy authentication) and protecting global admins with PIM. That's where an attacker looks first.