Without enforced MFA, one phished password is enough to take over a mailbox. Policy "Require MFA (pilot)" would require MFA but is still in report-only mode. If you rely on legacy per-user MFA, it still works but Microsoft is retiring it; move to one of the options below.

1. No Entra ID P1 (Business Basic/Standard): Entra admin center > Identity > Overview > Properties > Manage security defaults > Enabled.
2. With Entra ID P1 (Business Premium, E3, E5): create a Conditional Access policy for All users + All resources that grants access only with MFA. Exclude one break-glass admin account.
3. Give users a heads-up first: they will be asked to set up Microsoft Authenticator at their next sign-in.

These accounts have no second factor registered. Admin accounts without MFA are the single most common way small tenants get compromised.

1. Start with the admins on this list: sign in as each one and register Microsoft Authenticator, or have them do it at https://aka.ms/mfasetup.
2. For everyone else, enforce MFA (see the MFA enforcement finding) so they are forced to register at next sign-in.
3. Accounts nobody signs into any more should be disabled instead of registered (see Stale accounts).

Guest accounts are controlled by another organization. If the person leaves or their home tenant is breached, they still hold full control of yours. On top of that, every extra Global Admin is one more account an attacker can target for full control.

1. Replace guest admins with member accounts in your own tenant, or use GDAP for an IT partner.
2. Remove Global Administrator from anyone who only needs part of it: User Administrator for password resets, Exchange Administrator for mailboxes, Billing Administrator for invoices.
3. Keep two named admins plus one break-glass account with a long random password stored offline.
4. Admins should use a separate admin account, not the one they read email with every day.

Microsoft has switched off Basic auth for most Exchange Online protocols, but nothing at the identity layer blocks the rest (SMTP AUTH, older clients). Password-spray attacks target exactly these protocols because they cannot do MFA.

1. No Entra ID P1: turning on security defaults blocks legacy authentication automatically.
2. With Entra ID P1: create a Conditional Access policy for All users, client apps "Exchange ActiveSync clients" and "Other clients", grant = Block.
3. If a printer or scanner sends email with SMTP AUTH, move it to an SMTP relay connector or a dedicated send service before blocking.

Secure Score is Microsoft’s own measure of how many recommended controls are on. Most of the findings in this report raise it directly.

1. Fix the critical and high findings in this report first, then review the remaining actions at https://security.microsoft.com/securescore.

These seats are paid for but not assigned to anyone. They are usually left over from departed staff or a bulk purchase.

1. Microsoft 365 admin center > Billing > Your products > select the product > Buy/Remove licenses, and lower the quantity.
2. Annual-commitment subscriptions can only be reduced at renewal (or within 7 days of purchase); set a reminder before the renewal date shown on the same page.
3. Bought through a partner/CSP? Ask them to reduce the seat count; they can see the same numbers.

Sign-in is blocked on these accounts, usually because someone left, but their licenses were never removed. A shared mailbox under 50 GB with no archive does not need a license at all.

1. For each account: Microsoft 365 admin center > Users > Active users > select the user > Licenses and apps > uncheck the licenses > Save.
2. If the mailbox must be kept, convert it to a shared mailbox first (Exchange admin center > Mailboxes > Convert to shared), then remove the license.
3. After removing the licenses, lower the seat count so the freed seats stop billing (see Unassigned licenses).

Based on sign-in logs. These accounts are enabled and licensed but nobody has used them in 90 days. They are usually former staff, interns, or service accounts that never needed a full license.

1. Confirm with each manager that the person has left or no longer needs the account.
2. Block sign-in, convert the mailbox to shared if the mail is needed, then remove the licenses.
3. For service accounts (scanners, apps), check whether an unlicensed account or shared mailbox would work instead.

Based on sign-in logs. Unused accounts that can still sign in are what attackers look for: nobody notices when they are taken over.

1. Block sign-in on accounts that belong to people who have left (Microsoft 365 admin center > Users > Active users > Block sign-in).
2. Delete them after 30 days once you are sure nothing depends on them; deleted users can be restored for 30 days.
3. Add an offboarding checklist so leavers are blocked on their last day.

Guests keep access to every Team, site and file they were ever shared, long after the project ends.

1. Review the list and remove guests you no longer work with (Microsoft 365 admin center > Users > Guest users > Delete).
2. Set an expiration on guest access: SharePoint admin center > Policies > Sharing > "Guest access to a site or OneDrive will expire automatically".

Setting up a forwarding rule is the first thing attackers do after taking over a mailbox, so they keep reading mail after the password is changed. Some of these may be legitimate (someone forwarding to a personal address), which is its own data-leak problem.

1. Ask each mailbox owner whether they created the rule. If not, treat the account as compromised: reset the password, revoke sessions (Entra admin center > Users > Revoke sessions), and check the sign-in logs.
2. Delete unwanted rules in Outlook on the web (Settings > Mail > Rules) or with Remove-InboxRule in Exchange Online PowerShell.
3. Make sure the outbound spam policy keeps automatic external forwarding blocked: Defender portal > Policies > Anti-spam > Outbound policy > Automatic forwarding rules = Off.

An “Anyone” link works for whoever has it, including people it was forwarded to. These links end up in email threads and search results, and there is no record of who opened the file.

1. SharePoint admin center > Policies > Sharing: move the slider to “New and existing guests” so external people must sign in.
2. If you need Anyone links for marketing files, keep them but set them to expire in 30 days and default links to “People in your organization”.

Most of these are harmless clutter filters. But hiding replies is a classic step in invoice fraud: the attacker hides the real vendor’s replies so the victim never sees the warning. Worth a quick look.

1. Check each rule with its owner. Any rule nobody recognizes should be deleted and the account checked as in the forwarding finding.

SPF, DKIM and DMARC together decide whether receivers trust mail from your domain, and whether someone else can send mail pretending to be you.

1. Start with a TXT record at _dmarc.yourdomain: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain to collect reports.
2. After two to four weeks of clean reports (SPF and DKIM passing for your real senders), change p=none to p=quarantine, then p=reject.
3. Gmail, Yahoo and Microsoft now reject or junk bulk mail from domains without DMARC, so this also affects whether your own mail lands.

SPF, DKIM and DMARC together decide whether receivers trust mail from your domain, and whether someone else can send mail pretending to be you.

1. Defender portal > Email & collaboration > Policies > Email authentication settings > DKIM > select the domain.
2. Publish the two CNAME records it shows (selector1._domainkey and selector2._domainkey) at your DNS host.
3. Come back and switch “Sign messages for this domain with DKIM signatures” to Enabled.

SPF, DKIM and DMARC together decide whether receivers trust mail from your domain, and whether someone else can send mail pretending to be you.

1. Each sending domain needs exactly one TXT record starting with v=spf1. For Microsoft 365 only: v=spf1 include:spf.protection.outlook.com -all
2. Add an include for every other service that sends as your domain (newsletter, CRM, billing system) in that same single record.
3. Domains that never send mail should publish v=spf1 -all so nobody can spoof them.