Office 365 Security Checklist: Complete Access Review Guide
Comprehensive Office 365 security checklist covering identity, access review, Conditional Access, data protection, and audit logging. Use this for quarterly security reviews or compliance preparation.
Prerequisites
- •Global Admin or Security Admin access
- •Access to Microsoft Entra admin center
- •Access to Microsoft Purview compliance portal
Identity & Access Review
Review user identities, MFA status, and access permissions.
Review Conditional Access policies requiring MFA for all cloud apps.
Related: CA-01Tips:
- • Check for users excluded from MFA policies
- • Verify MFA registration completion rate is >95%
Review all Global Admin and privileged role assignments. Verify each assignment has business justification.
Related: PA-01Tips:
- • Global Admins should be limited to 2-4
- • Use dedicated admin accounts, not daily-use accounts
Review all external/guest users. Remove guests who no longer need access.
Related: EXT-01Tips:
- • Check guest last sign-in date
- • Verify sponsoring employee still at company
Find accounts with no sign-in activity in 90+ days. Disable or delete as appropriate.
Related: ID-03Audit membership of groups with privileged access or sensitive data access.
Related: GOV-03Conditional Access Review
Audit Conditional Access policies for gaps and misconfigurations.
Confirm CA policy blocks IMAP, POP3, SMTP AUTH, and other legacy protocols.
Related: CA-09Ensure all users and apps are covered by appropriate CA policies.
Tips:
- • Use CA "What If" tool to test policy coverage
- • Check for gaps in user/app targeting
Verify sign-in risk and user risk policies are configured appropriately.
Related: CA-03Review all exclusions from CA policies. Verify each exclusion is still justified.
Confirm 2 break-glass accounts exist and are properly excluded from CA.
Related: PA-05Application Security Review
Review OAuth apps and third-party integrations.
Review all enterprise applications and their permissions. Remove unused or excessive apps.
Related: APP-01Tips:
- • Focus on apps with Mail.Read, Files.ReadWrite permissions
- • Check app last used date
Verify user consent is restricted and admin approval is required for risky permissions.
Related: APP-02Audit service principals and their API permissions. Remove overprivileged access.
Related: APP-03Data Protection Review
Review data loss prevention and sharing settings.
Verify DLP policies are enabled and covering sensitive data types.
Audit SharePoint and OneDrive external sharing configuration.
Check sensitivity label adoption and policy effectiveness.
Audit & Monitoring Review
Verify logging and alerting configuration.
Confirm audit logging is active with appropriate retention.
Related: LOG-01Verify alerts are configured for suspicious activities and admin actions.
Check for failed sign-ins, risky sign-ins, and unusual locations.
Audit recent administrative actions for unauthorized changes.
Access Review Schedule
Set up recurring access reviews for continuous compliance.
Configure recurring access review for all privileged roles.
Related: GOV-03Configure recurring review for external/guest users.
Configure yearly review of all OAuth app permissions.
Automate this checklist with TrueConfig
TrueConfig automatically monitors your Microsoft 365 configuration against these best practices and alerts you when settings drift.