Microsoft 365 Security Checklist: 13 Essential Steps
Robert Kiss
5/14/2026
General
Practical Microsoft 365 compliance checklist with 13 security steps and CIS-aligned controls to prepare for m365 security audits.
Microsoft 365 Security Checklist: 13 Essential Steps
Practical Microsoft 365 compliance checklist with 13 security steps and CIS-aligned controls to prepare for m365 security audits.
Most organizations roll out Microsoft 365 for email, Teams, and file sharing, then kind of stop there. To be honest, that’s where a lot of risk creeps in. Out-of-the-box settings are convenient, but they’re not designed to meet strict microsoft 365 compliance or CIS benchmark microsoft 365 requirements.
If you’re thinking about a future m365 security audit, or you just want a solid m365 compliance checklist, these 13 essential settings are a very good baseline. They line up nicely with many recommendations in the CIS Microsoft 365 Foundations Benchmark and give you a safer, more controlled tenant without making life impossible for users.
Below is a practical checklist you can walk through step-by-step. I’ll also point out where automated compliance m365 tools like ConfigCobra can take these manual checks and turn them into continuous, audit-ready controls.
1. Turn Off Security Defaults and Move to Conditional Access
It sounds backwards at first, but if you want fine-grained microsoft 365 compliance controls, you usually need to disable Microsoft’s generic Security Defaults and replace them with proper Conditional Access policies.
Security Defaults are “okay” for tiny organizations with no IT support. For anyone thinking about the cis benchmark microsoft 365 or a formal m365 security assessment, they’re too blunt.
Checklist items:
[ ] Sign in as Global Administrator
[ ] Go to Entra ID (Identity) → Properties
[ ] Set “Security defaults” to Disabled
[ ] Reason: “My organization is using Conditional Access”
Once that’s off, you can implement the more robust, auditable controls that CIS and most regulators actually expect.
How ConfigCobra helps here
This is an easy one to miss in larger tenants. ConfigCobra can automatically flag when Security Defaults are still on or when Conditional Access isn’t configured in line with CIS microsoft 365 foundations.
Instead of manually checking the Entra portal every few months, ConfigCobra’s scheduled scans will surface this as a deviation from the benchmark and show it clearly in an audit-ready report.
2. Enforce MFA for All Users with Conditional Access
Multifactor authentication is the single biggest win for microsoft 365 security audit preparation. The key is to enforce it consistently, not just “encourage” it.
Checklist items:
[ ] In Entra ID → Protection → Conditional Access → Policies
[ ] Create a policy (e.g., “CA01 – Require MFA for all users”)
[ ] Apply to: All users (exclude a break-glass admin account)
[ ] Target: All cloud apps
[ ] Grant: Require multifactor authentication
[ ] Start in Report-only if it’s an existing tenant, then switch to On once validated
This aligns closely with several CIS benchmark microsoft 365 controls and is almost always questioned during any m365 security assessment.
MFA consistency and evidence for auditors
Auditors don’t just ask, “Do you have MFA?” They ask, “Can you show that MFA is enforced for all users?”
ConfigCobra automatically checks and documents:
Whether a tenant-wide MFA Conditional Access policy exists
Its scope (all users, all apps, exclusions)
Current status (On / Report-only)
That goes straight into an audit-ready PDF report, which saves you from trawling through screenshots every time you need microsoft 365 audit preparation evidence.
3. Restrict Sign-ins to Approved Countries
By default, anyone from any country can try to sign in to your Microsoft 365. That’s a huge attack surface.
A simple win: only allow sign-ins from countries where you actually operate, plus some controlled exceptions for travel.
Checklist items:
[ ] In Conditional Access → Named locations, create a list like “Approved countries” (e.g., UK, US, EU)
[ ] Users: All users, excluding a break-glass admin
[ ] Cloud apps: All cloud apps
[ ] Locations: Include Any location, but Exclude your “Approved countries”
[ ] Client apps: Browser + Mobile apps and desktop clients
[ ] Access control: Block
This gives you geo-based protection while still allowing legitimate work.
Make travel work with compliant devices
You probably have executives who travel. Blocking every non-approved country outright can backfire.
Add a device filter to the same policy:
[ ] Configure → Filter for devices
[ ] Exclude devices where `isCompliant = true`
Now, if a laptop is managed and compliant in Intune, it can still access Microsoft 365 from abroad, while random devices from high-risk locations stay blocked.
ConfigCobra can continuously check that these location-based policies exist, are active, and mapped correctly to your approved regions. That’s very useful evidence when you’re asked how you limit risky logins for your microsoft 365 compliance posture.
4. Block Unapproved Device Platforms
If your business only supports Windows and macOS, why allow logins from Linux, legacy Windows Phone, or other platforms you don’t manage?
This is simple, but it reduces the variety of endpoints you need to keep secure and makes your m365 security assessment story cleaner.
Better alignment with device management policies
Blocking device types you don’t manage also supports CIS microsoft 365 foundations expectations around endpoint control.
ConfigCobra will detect if such blocking policies are missing or misconfigured. Over time, if someone “temporarily” loosens a rule, its drift detection highlights that change so you can bring things back to your standard.
5. Disable Persistent Browser Sessions
Persistent sessions keep users signed in even after closing the browser. Convenient, yes. But on shared or personal devices, it’s risky.
[ ] Session: Persistent browser session = Never persistent
Now, when someone closes their Microsoft 365 tab, they’ll be prompted to sign in next time. It’s a small friction point that significantly reduces the chance of unauthorized access from a forgotten, open session.
Why auditors like to see this
In my experience, this kind of control often comes up as a “nice to have” in audits, especially if you have bring-your-own-device (BYOD) in scope.
ConfigCobra checks and documents session-related Conditional Access rules as part of its automated m365 compliance assessment, making it clear you’re not silently keeping people logged in forever.
6. Require App Protection for Mobile Devices
Most employees will install Outlook, Teams, or Office on their personal phones. That’s fine, but only if you protect corporate data on those devices.
Checklist items:
[ ] Create Intune App Protection Policies for Android and iOS
[ ] Client apps: Browser + Mobile apps and desktop clients
[ ] Grant: Require app protection policy
This ensures mobile access is wrapped in data protection policies, which is a big point in many microsoft 365 compliance frameworks.
Data protection on BYOD for compliance
From a CIS benchmark microsoft 365 guide perspective, this ticks boxes around controlling data on unmanaged devices.
ConfigCobra checks whether mobile access is tied to protection requirements and can highlight gaps where users are still allowed to connect with no app protection at all.
7. Block Legacy (Basic) Authentication
Legacy authentication (basic auth) is weak and widely abused in password spray and brute-force attacks. Even if Microsoft disables a lot of it by default in new tenants, you should explicitly block it.
Checklist items:
[ ] In Conditional Access → New policy from template
This is a common requirement in any m365 security audit and appears directly in many CIS microsoft 365 foundations controls.
Continuous verification that basic auth stays off
Environments evolve. A line-of-business app might try to re-enable basic auth “temporarily” and never put it back.
ConfigCobra’s scheduled CIS scans will keep re-checking this and flag any re-introduced basic authentication paths, so you don’t drift away from your hard-won baseline.
8. Require MFA to Join Devices to Entra ID
You don’t want just anyone registering devices into Entra ID without additional verification.
[ ] Users: All users (or restrict to device join admins)
[ ] Target resource: User actions → Register or join devices
[ ] Grant: Require multifactor authentication
This tightens the control around device lifecycle and supports more advanced compliance models that expect strong assurance for device onboarding.
Stronger identity-device link for audits
From an audit point of view, this creates a documented chain: only MFA-verified users can add devices. ConfigCobra will treat that as another CIS-aligned control and include it in your microsoft 365 compliance automation reports.
9. Standardize Strong MFA Methods
Not all MFA methods are equal anymore. SMS and phone calls are considered weaker and are increasingly discouraged in security frameworks.
Checklist items:
[ ] In Entra ID → Protection → Authentication methods → Policies
[ ] Enable Microsoft Authenticator for all users
[ ] Enable FIDO2 security keys (e.g., YubiKey) for all users who need higher assurance
[ ] Prefer these stronger methods over SMS / phone call
This will look good in any m365 security assessment and aligns with modern CIS and NIST guidance.
Documenting MFA methods for microsoft 365 audit preparation
Auditors often ask which MFA factors you support and whether they’re phishing-resistant. Having Authenticator and FIDO2 as defaults is a strong position.
ConfigCobra can validate those policies are enabled and correctly scoped, then surface that in an audit-ready PDF so you can answer these questions without scrambling for portal screenshots.
10. Lock Down Entra ID Tenant Creation and Admin Access
There are a couple of small but important settings in Entra ID user settings that are easy to miss.
Checklist items:
[ ] Go to Entra ID → Users → User settings
[ ] Restrict non-admin users from creating tenants = Yes
[ ] Restrict access to Microsoft Entra admin center = Yes (admins only)
This prevents standard users from spinning up new tenants or wandering into admin portals they shouldn’t see.
Why this matters for compliance scope
From a microsoft 365 compliance perspective, extra tenants created by users can blow up your scope and complicate your cis certified microsoft 365 story.
ConfigCobra’s drift detection helps here too: if these toggles get flipped back for some reason, you’ll see it in the next scan, not three years later when an auditor finds it.
11. Tighten Enterprise App Consent
Users can connect a surprising range of third-party apps to Microsoft 365. By default, they can often grant those apps access to organization data.
Checklist items:
[ ] Go to Entra ID → Enterprise applications → Consent and permissions
[ ] Change from “Allow user consent for apps” to:
Ideally: Admin consent required for all apps
Or at least: Allow user consent for apps from verified publishers
[ ] Set “Group owner consent” (if still available) to Do not allow
This keeps you in control of which apps get access to corporate data, which is a critical area for both microsoft 365 compliance and privacy regulations.
Visibility into risky app permissions
In my experience, third-party app sprawl is one of the biggest blind spots in Microsoft 365.
ConfigCobra helps by mapping CIS controls related to application permissions into a clear view of:
Which app consent model you’re using
Whether it aligns with CIS and other frameworks (ISO 27001, NIST CSF, etc.)
That mapping becomes very handy when you’re cross-referencing controls across multiple standards.
12. Harden SharePoint External Sharing Defaults
SharePoint and OneDrive are generous with sharing by default. Generous is great for collaboration, not so great for compliance.
Checklist items:
[ ] Go to Microsoft 365 admin center → SharePoint admin
[ ] Policies → Sharing
[ ] Change external sharing from “Anyone” to New and existing guests – guests must sign in or use verification code
This stops fully anonymous “anyone with the link” sharing while still allowing controlled external collaboration.
Reducing data exposure risks
From a m365 security audit point of view, auditors will often ask, “Can files be shared anonymously?”
ConfigCobra’s automated m365 compliance assessment can check that your SharePoint sharing model matches your policy and CIS recommendations and alert you if it drifts back to “anyone” due to an overly enthusiastic admin.
13. Make View-Only the Default Sharing Permission
One last SharePoint tweak that prevents accidental data changes: adjust the default permission on sharing links.
Checklist items:
[ ] In SharePoint admin → Policies → Sharing
[ ] Set “Choose the permission that’s selected by default for sharing links” to View instead of Edit
Users can still change a link to allow editing when needed, but the safe default becomes read-only.
Subtle but powerful for governance
This looks like a tiny UX detail, but it’s actually a solid microsoft 365 compliance control. It reduces unintended data modification and aligns with least-privilege principles.
ConfigCobra can verify this default is set correctly as part of its CIS benchmark microsoft 365 guide checks, and it will highlight when someone flips it back to “Edit” globally, so you can respond quickly.
If you walk through this 13-step Microsoft 365 security checklist, you’ll already be far ahead of many organizations that simply accept the defaults and hope for the best.
In summary, you’ve:
Disabled blunt Security Defaults and replaced them with auditable Conditional Access
Enforced strong, standardized MFA for all users and device joins
Restricted sign-ins by location and device platform
Locked down legacy authentication, admin access, and app consent
Hardened SharePoint and OneDrive sharing behavior
These are exactly the kind of measures auditors look for in an m365 security assessment, and they map well to the CIS Microsoft 365 Foundations Benchmark and wider microsoft 365 compliance expectations.
However, doing all of this manually—and keeping it aligned over time—is hard. Settings drift, new admins make “temporary” exceptions, and each microsoft 365 audit preparation cycle becomes a scramble.
If you’re ready to move from one-off hardening to continuous, automated compliance, it’s worth looking at a dedicated tool like ConfigCobra.
ConfigCobra continuously checks your Microsoft 365 tenant against 129 CIS Microsoft 365 Foundations controls, supports both Level 1 and Level 2 profiles, and runs scheduled assessments daily, weekly, or monthly. It will:
Detect configuration drift in real time (for example, if someone weakens a Conditional Access rule or sharing policy)
Generate audit-ready PDF reports with mapped CIS controls, evidence, and remediation steps
Map your CIS posture to other standards like ISO 27001, SOC 2, GDPR, NIS2, HIPAA, PCI DSS, and NIST CSF
Support team collaboration with role-based access so security, compliance, and IT can all work from the same source of truth
To be honest, that’s the difference between a one-time hardening project and a living, breathing microsoft 365 compliance automation program.
If you want to automate the checklist above and be ready for your next m365 security audit without last-minute panic, explore ConfigCobra’s Microsoft 365 compliance automation capabilities and free trial at https://configcobra.com/compliance
Use this checklist as your baseline, then let automation keep you there. That combination is what turns Microsoft 365 from “good enough” into a cis certified microsoft 365–ready environment.
