A Microsoft 365 security checklist for MSPs.

Use one baseline, and record the exceptions

The point of a checklist is consistency. Define a standard configuration, apply it to every tenant, and write down each deviation with a reason and an owner. Tenants that drift one by one are harder to secure, harder to audit and harder to hand over between engineers.

Before you start, check your licensing. Several controls below depend on the licences assigned to each client, and Microsoft changes its packaging over time, so confirm what each tenant is entitled to rather than assuming.

1. Identity: MFA and conditional access

• Require multi-factor authentication for all users, not only administrators.
• Enforce it through conditional access policies or the tenant’s baseline security settings, so it is applied centrally rather than user by user.
• Prefer phishing-resistant methods, such as an authenticator app with number matching or hardware keys, over SMS where you can.
• Block sign-ins from countries where the client has no staff or travel, and require compliant devices for sensitive applications.
• Test every policy in report-only mode first, and keep two emergency access accounts excluded from policies, with strong credentials stored securely and monitored.

2. Admin role hygiene

• Keep the number of Global Administrators small, and use narrower roles for day-to-day work.
• Give technicians separate admin accounts that are not used for email or browsing.
• Review who holds privileged roles at least quarterly, including partner and delegated access.
• Where licensing allows, use just-in-time elevation rather than standing access.

3. Legacy authentication

Older protocols, such as basic authentication for IMAP, POP and SMTP, cannot satisfy MFA. Identify what still uses them, move those applications and devices to modern authentication, then block legacy authentication with a policy. Do this carefully: scanners, line-of-business software and old mail clients are the usual surprises.

4. Email protection

• Publish SPF and DKIM for every sending domain, and a DMARC record. Start with monitoring, then move towards enforcement once legitimate senders are accounted for.
• Turn on anti-phishing, anti-spoofing and safe-attachment protections that your licences provide.
• Disable automatic external forwarding, and alert on new inbox rules that forward or delete mail, which are a common sign of a compromised mailbox.
• Warn users on external senders and run phishing awareness training.

For managed detection around these controls, see cybersecurity and managed SOC.

5. Device compliance

Enrol client devices in a management platform, set a compliance baseline (encryption on, supported operating system, endpoint protection active) and make access to company data depend on it. Decide what happens on personal devices, and apply app-level protection where full management is not appropriate.

6. Backup of Microsoft 365 data

Do not assume the service is the backup. Understand the retention and recovery options included with each tenant, then decide whether an independent copy of mailboxes, SharePoint, OneDrive and Teams data is justified. Test a restore on a schedule, because an untested backup is only a hope. Our cloud backup service is one option.

7. Audit logging and alerts

• Confirm audit logging is enabled and understand how long it is retained for each licence level.
• Alert on risky sign-ins, new admin role assignments, mailbox forwarding changes and mass downloads.
• Send alerts somewhere a person will see them, with a defined response, not to an unattended mailbox.

8. Licence right-sizing

Unused licences cost money, and misassigned ones leave controls switched off. Review assignments monthly, remove licences from leavers and match each user to the lowest tier that still provides the controls the baseline needs. If a client plans to adopt Copilot, tighten permissions and sharing first, as set out on our Microsoft 365 and Copilot page.

9. Offboarding

1. Disable sign-in and revoke active sessions and tokens.
2. Reset the password and remove MFA methods.
3. Convert the mailbox to shared or archive it, following the client’s retention policy.
4. Transfer file ownership and remove the user from groups, Teams and delegated access.
5. Remove or reassign the licence, and recover company devices.

Tie this to a ticket template so it happens the same way every time, and have a second person confirm that access has actually been removed before the ticket closes.

10. Periodic review

Put the checklist on a calendar. A short monthly check and a fuller quarterly review, with a written summary for the client, show the value of the service, catch drift early and give clients something concrete to approve at renewal. Missan is the India company of the Missan group, a Microsoft Cloud Solution Provider engineering since 2004, and we can support this work behind your brand.

Rolling it out without upsetting clients

Security changes that lock people out damage trust faster than a risk they never saw. Roll out in stages: pilot with the client’s IT contact, use report-only mode for conditional access, announce changes in plain language, and schedule enforcement for a quiet period. Keep a documented rollback step for every policy, and make sure the service desk knows what is changing before users start calling.

What usually goes wrong

• Excluding too many accounts from MFA “temporarily”, then never revisiting the list.
• Shared mailboxes and service accounts with passwords that nobody owns or rotates.
• Old administrators left in privileged roles after staff or suppliers move on.
• Alerts nobody reads, which turns monitoring into a false comfort.

Questions people ask

Related services

• Cybersecurity and managed SOC
• Microsoft 365 governance and Copilot
• Cloud backup