These assessments will give an organisation a thorough understanding of the risk posed by their Microsoft 365 configuration as well as detailed remediation guidance to ensure that the highlighted issues can be addressed and that the tenant can be hardened against any potential attack.
Microsoft 365 Security Review Methodology Summary
The following gives examples of the types of issues that this assessment can discover:
Identity and Authentication
We review how users and administrators authenticate, including multi-factor authentication coverage and the methods permitted, legacy authentication, password policies, self-service password reset, and the protections in place against password spraying and token theft.
Conditional Access
We assess how Conditional Access policies restrict access based on user risk, sign-in risk, device state and location, where appropriate. We also check the controls applied to administrators and examine policy exclusions and gaps that could allow access without the intended protections.
Privileged Roles
We review the assignment of privileged roles such as Global Administrator, including the number of standing administrators, the use of Privileged Identity Management for just-in-time elevation, the protection of break-glass accounts, and whether administrative accounts are separated from day-to-day user accounts.
External Access and Applications
We review guest and external collaboration settings, the applications and service principals registered in the tenant and the permissions granted to them, and whether users are able to consent to third-party applications accessing organisational data.
Exchange Online
We review mail flow and anti-phishing protections, including SPF, DKIM and DMARC, the Defender for Office 365 policies applied to inbound mail, mailbox auditing, and controls over automatic forwarding and mailbox delegation that are commonly abused following an account compromise.
SharePoint, OneDrive and Teams
We review sharing settings for sites, files and Teams, including anonymous and external sharing, link defaults and expiry, and the controls applied to data leaving the organisation.
Devices
We review the device compliance and enrolment requirements enforced on users accessing the tenant, and whether access from unmanaged or non-compliant devices is restricted.
Logging and Monitoring
We assess whether audit logging and alerting across the tenant record sign-in, administrative and mailbox activity, and whether logs are retained for long enough to support an effective response to a security incident.