TOOLBOX · DOWNLOAD
Microsoft 365 configured securely.
This checklist summarizes the most important security settings for Microsoft 365 per service: Entra ID, Exchange Online, protection against malware and phishing, SharePoint and OneDrive, Teams, and logs. It is based on the baselines of the US agency CISA from the SCuBA project (ScubaGear v2.0.0 of October 22, 2026) and on Microsoft's documentation. Each item names the baseline identifier so that you can look it up and check it with the free ScubaGear tool.
Free PDF · Checklist
Securing Microsoft 365: Checklist for Entra ID, Exchange, SharePoint, and Teams
- Format
- PDF, A4
- Length
- 9 pages
- Size
- 127 KB
- Updated
- Oct 25, 2026
- Sources
- 19
- Usage
- Redistribution in unchanged form permitted
WHO IT IS FOR
Who This
Is for.
Key settings for Entra ID, Exchange Online, Defender, SharePoint, OneDrive, and Teams, with CISA baseline identifiers and licensing notes.
- Microsoft 365 administrators in small and medium-sized companies
- IT service providers that manage Microsoft 365 tenants for customers
- Information security officers who review the state of a tenant
9 SECTIONS
What Is
Inside.
- 01
How to use the checklist
Where the items come from, what "shall" and "should" mean, and how you measure
- 02
Microsoft Entra ID: sign-in and accounts
Block legacy protocols, strong sign-in, emergency access
- 03
Microsoft Entra ID: roles, apps, and guests
Few Global Administrators, restricted app consent, controlled guests
- 04
Exchange Online: email and mailboxes
Forwarding, sender protection, SMTP AUTH, sharing, and auditing
- 05
Protection against malware and phishing
Preset policies, attachments, links, impersonation, and exceptions
- 06
SharePoint and OneDrive: sharing
Limit external sharing, secure default links, expiration for "Anyone" links
- 07
Microsoft Teams: meetings and external contacts
Who may start meetings, join them, and make contact
- 08
Logs, alerts, and measurement
Turn on auditing, forward alerts, measure progress
- 09
Licensing notes
Which items need more than Microsoft 365 E3 according to CISA
EXCERPT
Microsoft Entra ID: sign-in and accounts
Microsoft recommends blocking sign-ins with legacy protocols because they do not support multifactor authentication. According to Microsoft's analysis, more than 97% of credential stuffing attacks and more than 99% of password spray attacks use such protocols.
- Legacy authentication blocked (MS.AAD.1.1, shall).
- Phishing-resistant MFA for all users (MS.AAD.3.1, shall), such as device-bound passkeys, FIDO2 security keys, Windows Hello for Business, or certificate-based authentication; as a minimum, MFA for all users, for example as long as phishing-resistant methods are not yet possible (MS.AAD.3.2, shall); always phishing-resistant for highly privileged roles (MS.AAD.3.6, shall).
- SMS, voice call, and email one-time passcode disabled as methods (MS.AAD.3.5, shall); sign-in context shown in Microsoft Authenticator (MS.AAD.3.3, shall).
- Device code sign-in blocked (MS.AAD.3.9, should).
- High-risk users and high-risk sign-ins blocked (MS.AAD.2.1 and 2.3, shall; requires Entra ID P2).
- Passwords do not expire (MS.AAD.6.1, shall); details in the password policy.
- At least two emergency access accounts, cloud-only with a *.onmicrosoft.com domain, not synchronized, protected with a passkey (FIDO2) or certificate (Microsoft Learn).
- Without a license for Conditional Access: security defaults enabled (Microsoft Learn).
SOURCES
Supported
by Sources.
- CISA SCuBA baseline Microsoft Entra ID (ScubaGear v2.0.0, October 22, 2026) (opens in a new tab)MS.AAD.1 to 9, list of highly privileged roles, license requirements, accessed October 25, 2026
- CISA SCuBA baseline Exchange Online (v2.0.0) (opens in a new tab)MS.EXO.1 to 7 and 13, accessed October 25, 2026
- CISA SCuBA baseline Security Suite (v2.0.0) (opens in a new tab)MS.SECURITYSUITE.1 to 8, license requirements, accessed October 25, 2026
- CISA SCuBA baseline SharePoint and OneDrive (v2.0.0) (opens in a new tab)MS.SHAREPOINT.1 to 3, accessed October 25, 2026
- CISA SCuBA baseline Microsoft Teams (v2.0.0) (opens in a new tab)MS.TEAMS.1, 2, 4, 5, accessed October 25, 2026
- CISA: Secure Cloud Business Applications (SCuBA) Project (opens in a new tab)Project, ScubaGear as a free assessment tool, accessed October 25, 2026
- Microsoft Learn: Microsoft Secure Score (opens in a new tab)Introduction, accessed October 25, 2026
- Microsoft Learn: Security defaults in Microsoft Entra ID (opens in a new tab)Content, target audience, Conditional Access with P1/P2, accessed October 25, 2026
- Microsoft Learn: Block legacy authentication (opens in a new tab)Overview, accessed October 25, 2026
- Microsoft Learn: Emergency access accounts (opens in a new tab)Number, cloud accounts, authentication, accessed October 25, 2026
- Microsoft Learn: Automatic external email forwarding (opens in a new tab)Three settings and their effect, accessed October 25, 2026
- Microsoft Learn: Turn auditing on (Microsoft Purview) (opens in a new tab)Default status, exception for Business plans, accessed October 25, 2026
- Microsoft Learn: Best practices for Microsoft Entra roles (opens in a new tab)No. 5, fewer than five Global Administrators, accessed October 25, 2026
- Microsoft Learn: User consent for applications (opens in a new tab)Recommendation of verified publishers, accessed October 25, 2026
- Microsoft Learn: Preset security policies (opens in a new tab)Standard, Strict, Built-in protection, accessed October 25, 2026
- Microsoft Learn: Enable or disable SMTP AUTH (opens in a new tab)Organization and mailbox setting, accessed October 25, 2026
- Microsoft Learn: Mailbox auditing (opens in a new tab)Enabled by default, accessed October 25, 2026
- Microsoft Learn: External sharing in SharePoint and OneDrive (opens in a new tab)Sharing levels, accessed October 25, 2026
- Microsoft Learn: External access in Microsoft Teams (opens in a new tab)Default: all external domains, allow list, accessed October 25, 2026
This checklist is a TOMORIS recommendation based on the CISA baselines, which are binding only for US federal agencies. Microsoft's names, default values, and license terms change constantly; Microsoft's current documentation and the currently valid version of the baselines are authoritative. Test changes before implementing them, for example with emergency access and a pilot group.
TOOLBOX
Explore
Further.
- Kostenlos
Microsoft 365 domain check (German)
Tenant, Exchange Online, DKIM
Check Now - Kostenlos
Email security check (German)
Check SPF, DKIM, DMARC
Check Now - Kostenlos
DMARC generator
Build a DMARC record step by step
Check Now Introducing MFA in Microsoft 365
Checklist from security defaults through Conditional Access to passkeys, without locking yourself out.
Learn More
EMAIL & MICROSOFT 365
More on
This Topic.
- PDF
SPF, DKIM and DMARC
From an inventory of all senders to the p=reject policy: a rollout plan with DNS examples based on current standards, including DMARC RFC 9989.
View - PDF
MFA in Microsoft 365
Security defaults or Conditional Access, emergency access accounts, choice of methods, rollout in report-only mode and Microsoft’s mandatory MFA: roll out MFA without locking yourself out.
View - PDF
Securing Exchange Online
What Exchange Online always protects, what Defender for Office 365 Plan 1 and 2 add, which values Microsoft recommends, and which exceptions undermine protection.
View
YOUR NEXT STEP
From Paper
to Practice.
We review with you what is already implemented in your environment and put the rest into practice: as a project with EXPERTS or as ongoing operations with GRID.