Runbook 02 — Microsoft 365 Security Review

Microsoft 365 has become a critical enterprise security boundary.

Organizations use it for:

Identity

Email

Messaging

Meetings

Documents

File Sharing

External Collaboration

Business Applications

Sensitive Data

Security Monitoring

This means a Microsoft 365 security weakness can affect far more than a single mailbox.

A compromised or poorly governed tenant may expose:

Executive Communications

Customer Information

Financial Documents

HR Records

Intellectual Property

Authentication Data

Business Relationships

The purpose of this runbook is to provide a repeatable methodology for performing an authorized Microsoft 365 security review.

Runbook Information

Runbook: Microsoft 365 Security Review
Type: Defensive Cloud Security Assessment
Level: Intermediate
Primary Roles: Microsoft Security Engineer, Cloud Security Engineer, Security Consultant
Supporting Roles: SOC Analyst, Identity Engineer, Microsoft 365 Administrator, GRC Analyst
Primary Objective: Identify Microsoft 365 security weaknesses and convert them into prioritized remediation actions

Runbook Outcome

At completion, you should have:

Tenant Architecture Summary

Administrative Access Matrix

Privileged Identity Review

Exchange Security Review

Mailbox Security Review

Email Protection Assessment

Teams Security Review

SharePoint Security Review

OneDrive Security Review

External Sharing Inventory

Application Access Review

Data Protection Assessment

Audit and Monitoring Assessment

Security Findings

Remediation Roadmap

Retest Plan

Executive Security Report

Microsoft 365 Assessment Mental Model

Use this sequence:

SCOPE
  ↓
TENANT
  ↓
IDENTITY
  ↓
PRIVILEGE
  ↓
EXCHANGE
  ↓
EMAIL SECURITY
  ↓
MAILBOXES
  ↓
TEAMS
  ↓
SHAREPOINT
  ↓
ONEDRIVE
  ↓
EXTERNAL SHARING
  ↓
APPLICATIONS
  ↓
DATA
  ↓
AUDIT
  ↓
MONITORING
  ↓
INCIDENT READINESS
  ↓
FINDINGS
  ↓
REMEDIATION
  ↓
RETEST

01 — Confirm Authorization

Before reviewing the tenant, confirm:

Written Authorization

Tenant in Scope

Services in Scope

Administrative Access Provided

Permitted Assessment Activities

Excluded Services

Assessment Window

Evidence Handling Requirements

Emergency Contacts

Document:

Assessment Name:

Tenant:

Business Owner:

Technical Owner:

Security Owner:

Start Date:

End Date:

Services in Scope:

Services Excluded:

Change Restrictions:

02 — Define the Security Objectives

Typical objectives include:

Reduce Administrative Risk

Strengthen Identity Security

Protect Email

Reduce Phishing Exposure

Control External Sharing

Review Guest Access

Protect Sensitive Data

Reduce Application Risk

Improve Audit Visibility

Improve Incident Readiness

03 — Define Services in Scope

A Microsoft 365 assessment may include:

Microsoft Entra ID

Exchange Online

Microsoft Teams

SharePoint Online

OneDrive

Microsoft Defender Capabilities

Microsoft Purview Capabilities

Enterprise Applications

Audit and Monitoring

Capabilities vary according to tenant configuration and licensing.

Do not report:

Feature Not Enabled

as a vulnerability without first establishing whether that feature is:

Licensed

Required

Relevant

Part of the Approved Baseline

04 — Understand Shared Responsibility

Microsoft protects the underlying cloud service.

The customer remains responsible for areas such as:

Identity

Access

Configuration

Applications

Data

Sharing

Governance

Monitoring

Think:

MICROSOFT
   ↓
CLOUD PLATFORM

ORGANIZATION
   ↓
IDENTITY
   +
CONFIGURATION
   +
ACCESS
   +
DATA
   +
MONITORING

05 — Establish an Evidence Repository

Use a controlled location.

Example:

M365-Security-Review
|
+-- 01-Scope
|
+-- 02-Tenant
|
+-- 03-Identity
|
+-- 04-Administration
|
+-- 05-Exchange
|
+-- 06-Email-Security
|
+-- 07-Mailboxes
|
+-- 08-Teams
|
+-- 09-SharePoint
|
+-- 10-OneDrive
|
+-- 11-External-Sharing
|
+-- 12-Applications
|
+-- 13-Data-Protection
|
+-- 14-Audit
|
+-- 15-Findings
|
+-- 16-Report

06 — Protect Assessment Evidence

Evidence may contain:

Usernames

Email Addresses

Tenant Information

Administrative Roles

Application Names

Security Configuration

Sharing Relationships

Sensitive File Metadata

Apply:

Least-Privilege Access

Approved Storage

Encryption

Retention Requirements

Secure Disposal

Never unnecessarily collect:

Passwords

Tokens

Private Keys

Authentication Secrets

Sensitive Message Contents

07 — Establish the Tenant Baseline

Document the current environment before recommending changes.

Capture:

Tenant Name

Verified Domains

User Population

Guest Population

Administrative Roles

Primary Services

Security Products

Data Protection Capabilities

Logging Architecture

08 — Build the Tenant Overview

Example:

Area	Current State
Primary Domain	example.com
Users	Review
Guests	Review
Privileged Users	Review
Exchange Online	Enabled
Teams	Enabled
SharePoint	Enabled
OneDrive	Enabled
Central Monitoring	Review

09 — Review Verified Domains

Inventory business domains.

Capture:

Domain

Purpose

Owner

Verification Status

Mail Usage

Current Requirement

Ask:

Is Every Domain Still Required?

Who Owns It?

Is It Used for Email?

Are Legacy Domains Still Present?

10 — Review Administrative Roles

Identify tenant-level administrative access.

Prioritize roles capable of affecting:

Identity

Security

Exchange

Applications

Compliance

Tenant Configuration

11 — Build the Administrative Access Matrix

Identity	Role	Purpose	Permanent	Strong Authentication	Review
Admin-A	Tenant Admin	Emergency	Review	Yes
Admin-B	Exchange Admin	Messaging	Yes	Yes
User-C	Broad Admin	Unknown	Yes	Review

12 — Validate Administrative Need

For every privileged identity ask:

Who Owns the Account?

Which Administrative Task Requires It?

Could a Smaller Role Work?

Does Access Need to Be Permanent?

How Is Its Use Monitored?

13 — Review Least Privilege

The preferred model is:

ADMINISTRATIVE TASK
        ↓
MINIMUM REQUIRED ROLE

not:

ADMINISTRATIVE TASK
        ↓
MAXIMUM TENANT PRIVILEGE

Finding Example

Finding:
Excessive Microsoft 365 Administrative
Privilege

Observation:
An identity retains a broad tenant
administrative role despite requiring only
service-specific administration.

Risk:
Compromise or misuse of the identity could
affect multiple Microsoft 365 services and
enterprise information.

Recommendation:
Replace broad tenant privilege with the
minimum administrative role required for
the documented responsibilities.

14 — Review Privileged Account Separation

Determine whether administrators use separate identities for:

Normal Productivity

and:

Privileged Administration

A stronger model is:

rohit.user
    ↓
Email / Teams / Documents

adm-rohit
    ↓
Authorized Administration

15 — Review Standing Privilege

Determine whether sensitive roles are:

Permanently Assigned

or activated only when needed.

Where supported by the organization’s identity architecture, consider:

Just-In-Time Access

Approval

Time Limits

Audit Trail

16 — Review Emergency Access

Emergency or break-glass access should be:

Limited

Documented

Strongly Protected

Monitored

Tested

Excluded Only Where Explicitly Required

Do not assume an emergency account is secure merely because it is rarely used.

17 — Review Administrative Authentication

For privileged identities assess:

MFA

Authentication Methods

Conditional Access

Device Controls

Session Controls

Risk-Based Controls

Security Principle

The combination:

HIGH PRIVILEGE
      +
WEAK AUTHENTICATION

should receive high assessment priority.

18 — Review Conditional Access Architecture

Review policies affecting:

Administrators

Standard Users

Guests

Applications

Devices

Locations

Authentication Risk

Document:

Policy

Scope

Conditions

Controls

Exclusions

Business Owner

19 — Review Conditional Access Exclusions

Pay particular attention to:

Excluded Users

Excluded Groups

Excluded Applications

Legacy Exceptions

Temporary Exceptions

Ask:

Why Does the Exclusion Exist?

Who Approved It?

Is It Still Required?

When Will It Expire?

Finding Example

Finding:
Broad Conditional Access Exclusion

Observation:
A user group is excluded from an important
identity security policy without a current
documented requirement.

Risk:
Excluded identities may authenticate
without controls required by the tenant
security baseline.

Recommendation:
Validate the exception, remove unnecessary
exclusions, and implement expiration and
periodic review for approved exceptions.

20 — Review Guest Identities

Inventory external users.

For each guest determine:

Sponsor

Organization

Business Purpose

Resources Accessed

Last Review

Current Requirement

21 — Guest Lifecycle Model

Use:

INVITE
  ↓
APPROVE
  ↓
GRANT ACCESS
  ↓
REVIEW
  ↓
REMOVE

not:

INVITE
  ↓
KEEP FOREVER

Finding Example

Finding:
Stale Guest Accounts

Observation:
External guest identities remain enabled
after the associated business relationship
or project has ended.

Risk:
Former external collaborators may retain
access to Microsoft 365 resources without
current authorization.

Recommendation:
Remove stale guest access and implement
recurring sponsor-based access reviews.

22 — Review Authentication Methods

Review which authentication methods are:

Allowed

Required

Used by Administrators

Used by Standard Users

Used for Recovery

Assess them against the organization’s security strategy.

23 — Review Risky Authentication Activity

Where identity-risk capabilities are available, review:

Risky Sign-Ins

Risky Users

Unusual Locations

Unusual Devices

Suspicious Authentication Patterns

Do not automatically conclude:

Risk Event
=
Compromise

Validate context.

24 — Review Exchange Online Architecture

Document:

Accepted Domains

Mail Flow

Connectors

Transport Rules

Shared Mailboxes

External Forwarding

Delegated Access

25 — Review Accepted Domains

For every domain determine:

Business Purpose

Current Requirement

Mail Role

Owner

Identify obsolete or unexplained configurations.

26 — Review Mail Flow Rules

Create:

Rule	Purpose	Owner	Security Impact	Review
Rule-A	Business routing	Messaging	Medium	Current
Rule-B	Filter bypass	Unknown	High	Review

Look for rules that:

Bypass Filtering

Redirect Messages

Modify Security Handling

Apply Broad Exceptions

27 — Review Mail Connectors

For each connector identify:

Source

Destination

Purpose

Authentication

Owner

Current Requirement

Legacy connectors should receive particular attention.

28 — Review External Mail Forwarding

Identify mailboxes configured to forward externally.

Document:

Mailbox

Destination

Owner

Business Reason

Approval

Review Date

Finding Example

Finding:
Unapproved External Mail Forwarding

Observation:
A mailbox automatically forwards corporate
email to an external destination without a
documented business exception.

Risk:
Sensitive communications may leave the
organization's managed Microsoft 365
environment.

Recommendation:
Disable unapproved forwarding and establish
a controlled approval and periodic review
process for legitimate exceptions.

29 — Review Mailbox Delegation

Assess:

Full Access

Send As

Send on Behalf

For sensitive mailboxes ask:

Who Has Delegated Access?

Why?

Who Approved It?

Is It Still Required?

30 — Review Executive and High-Value Mailboxes

Prioritize:

Executives

Finance

HR

Legal

IT Administrators

Security Teams

Review:

Delegation

Forwarding

Inbox Rules

Authentication

Recent Security Events

31 — Review Shared Mailboxes

Create:

Mailbox	Owner	Members	Sensitive	External Forwarding	Review
finance@	Finance	6	Yes	No	Current
support@	IT	12	Medium	Review	Review

32 — Review Inbox Rules

Suspicious mailbox rules may:

Move Messages

Delete Messages

Hide Alerts

Redirect Information

Validate unexpected rules with the mailbox owner.

33 — Mailbox Rule Investigation Model

RULE IDENTIFIED
      ↓
OWNER VALIDATION
      ↓
CREATION CONTEXT
      ↓
SIGN-IN REVIEW
      ↓
FORWARDING REVIEW
      ↓
IMPACT ASSESSMENT

34 — Review Email Authentication

Assess the organization’s email domains for:

SPF

DKIM

DMARC

Email Authentication Mental Model

SPF
 ↓
Which Systems May Send?

DKIM
 ↓
Was the Message Signed?

DMARC
 ↓
How Should Authentication Results
Influence Handling?

35 — Review SPF

Assess:

Authorized Sending Sources

Third-Party Senders

Legacy Providers

Record Governance

Avoid making DNS changes without understanding all legitimate sending services.

36 — Review DKIM

Determine:

Which Domains Are Configured?

Who Owns the Configuration?

Are Legitimate Mail Flows Covered?

37 — Review DMARC

Assess:

Policy

Reporting

Authorized Senders

Deployment Maturity

Exception Handling

A mature deployment typically evolves through:

VISIBILITY
   ↓
VALIDATION
   ↓
CONTROL

rather than enforcing a strict policy without first understanding legitimate mail flows.

38 — Review Anti-Phishing Controls

Assess controls addressing:

Impersonation

Spoofing

Phishing

Suspicious Links

Suspicious Attachments

according to available Microsoft 365 security capabilities.

39 — Review Security Exceptions

Identify:

Allowed Senders

Allowed Domains

Transport Exceptions

Filter Bypasses

Administrative Releases

Finding Example

Finding:
Overly Broad Email Security Exception

Observation:
A broad sender or domain exception reduces
normal email-security inspection.

Risk:
Compromise or impersonation of the exempted
source may increase the likelihood of
malicious content reaching users.

Recommendation:
Remove unnecessary exceptions and narrowly
scope documented business exceptions.

40 — Review Quarantine Governance

Assess:

Who Can Review Quarantine?

Who Can Release Messages?

What Can Users Self-Release?

Are Releases Audited?

41 — Review Phishing Reporting

Determine whether users have a clear method to report:

Suspicious Email

Phishing

Spam

Potential Business Email Compromise

Then ask:

Who Receives the Report?

How Quickly Is It Reviewed?

Can Similar Messages Be Identified?

42 — Review Microsoft Teams

Teams combines:

Identity

Messaging

Meetings

Files

Applications

External Collaboration

Review all of these dimensions.

43 — Review Teams Guest Access

Determine:

Whether Guests Are Allowed

Who Can Invite Them

What Guests Can Access

How Guest Access Is Reviewed

44 — Review Teams External Access

Assess:

External Communication

Federation

Approved Domains

Business Requirement

Do not confuse:

External Access

with:

Guest Access

They represent different collaboration models.

45 — Review Teams Membership

For sensitive teams assess:

Owners

Members

Guests

Business Purpose

Sensitivity

46 — Review Team Ownership

A team should not become:

Ownerless

or rely on an employee who has left the organization.

Review ownership continuity.

47 — Review Teams Meeting Policies

Assess controls relevant to:

Anonymous Participation

Lobby Behavior

Screen Sharing

Recording

External Participants

Configuration should match the business use case.

48 — Review Teams Applications

Inventory important:

Microsoft Applications

Third-Party Applications

Custom Applications

Bots

Connectors

For each ask:

Who Approved It?

What Data Can It Access?

Who Owns It?

Is It Still Required?

49 — Review SharePoint Online

SharePoint may contain:

Policies

Projects

Financial Data

Contracts

HR Data

Technical Documentation

Create an inventory of critical sites.

50 — Build the SharePoint Site Matrix

Site	Owner	Sensitivity	Guests	External Sharing	Review
Finance	Finance	High	0	Restricted	Current
Project-X	PMO	Medium	4	Enabled	Review
Legacy	Unknown	Unknown	Review	Review	Review

51 — Review Site Ownership

For each important site confirm:

Business Owner

Technical Owner

Purpose

Membership

Sensitivity

Finding Example

Finding:
Unowned SharePoint Site

Observation:
A business SharePoint site contains active
content but has no documented current
business owner.

Risk:
Access, sharing, retention, and lifecycle
decisions may not receive appropriate
governance.

Recommendation:
Assign an accountable business owner and
perform an access and data review.

52 — Review SharePoint Permissions

Assess:

Owners

Members

Visitors

Guests

Direct Permissions

Sharing Links

Ask:

Who Can Read?

Who Can Edit?

Who Can Manage?

Who Can Share?

53 — Review External Sharing

External sharing should be aligned with:

Data Sensitivity

Business Requirement

Recipient Identity

Link Type

Expiration

Review

External Sharing Mental Model

DATA
 ↓
SENSITIVITY
 ↓
BUSINESS NEED
 ↓
RECIPIENT
 ↓
SHARING METHOD
 ↓
EXPIRATION

54 — Review Broad Sharing Links

Prioritize links that are:

Broad

Long-Lived

Unowned

Used for Sensitive Data

No Longer Required

Finding Example

Finding:
Excessive External File Sharing

Observation:
Sensitive business information is
accessible using sharing permissions
broader than the documented collaboration
requirement.

Risk:
Information may remain accessible to
unintended recipients.

Recommendation:
Restrict sharing to explicitly authorized
identities and periodically review active
external access.

55 — Review OneDrive

Assess:

External Sharing

Sensitive Data

Ownership

Offboarding

Data Transfer

Retention

56 — Review OneDrive Offboarding

When an employee leaves, determine:

Who Receives Required Business Data?

How Long Is It Retained?

When Is User Access Removed?

How Are Existing Sharing Links Handled?

57 — Review Former Employee Sharing

Look for cases where:

Former Employee
      ↓
Previously Shared Data
      ↓
External Recipient

may remain accessible without current ownership.

58 — Build the External Sharing Inventory

Resource	Owner	External Recipient	Sensitivity	Expiration	Review
Project Site	PMO	Partner-A	Internal	Review
Finance File	Finance	External	High	None	Urgent

59 — Review Enterprise Applications

Inventory applications connected to the tenant.

Prioritize those with access to:

Directory

Mail

Files

Calendars

Teams

User Profiles

Administrative Operations

60 — Build the Application Matrix

Application	Owner	Permissions	Users	Business Need	Review
App-A	Finance	Limited	25	Yes	Current
App-B	Unknown	Broad	Tenant	Review	Urgent

61 — Review Application Ownership

Every significant application should have:

Business Owner

Technical Owner

Purpose

Permission Justification

Lifecycle

62 — Review Application Permissions

Ask:

What Can the Application Access?

Does It Need That Access?

Is Access Delegated or Application-Level?

Is the Scope Broader Than Necessary?

63 — Review Administrative Consent

High-impact permissions should receive appropriate governance.

Assess:

Who Can Grant Consent?

How Is It Approved?

How Is It Reviewed?

How Is It Revoked?

Finding Example

Finding:
Over-Privileged Enterprise Application

Observation:
A connected application has access to
Microsoft 365 data beyond the minimum
required for its documented function.

Risk:
Application compromise or misuse could
expose a larger portion of tenant data than
necessary.

Recommendation:
Reduce permissions to the minimum required
and establish periodic application-access
reviews.

64 — Review Application Credentials

For applications using credentials, assess:

Secret Ownership

Certificate Use

Credential Age

Expiration

Storage

Rotation

Avoid exposing actual secrets during assessment evidence collection.

65 — Review Unused Applications

Identify applications with:

No Current Owner

No Business Use

Old Projects

Unused Integrations

Unused integrations should not retain unnecessary access.

66 — Review Data Classification

Determine whether the organization distinguishes data such as:

Public

Internal

Confidential

Highly Confidential

67 — Review Sensitivity Protection

Where sensitivity-label capabilities are used, assess:

Label Definitions

User Understanding

Protected Data Types

External Sharing Behavior

Governance

68 — Review Data Loss Prevention

Assess whether sensitive information receives appropriate controls.

Examples:

Personal Information

Financial Information

Customer Data

Credentials

Intellectual Property

DLP Mental Model

SENSITIVE DATA
      ↓
USER ACTION
      ↓
POLICY EVALUATION
      ↓
ALLOW / WARN / RESTRICT

depending on the organization’s policy design.

69 — Review DLP Exceptions

Exceptions should be:

Documented

Owned

Justified

Time-Bounded Where Appropriate

Reviewed

70 — Review Retention

Assess:

Retention Requirements

Business Records

Legal Requirements

Deletion

Ownership

Remember:

Retention
≠
Backup

71 — Review Audit Capabilities

Audit records should help answer:

WHO?

DID WHAT?

TO WHAT?

WHEN?

FROM WHERE?

72 — Review Important Audit Activities

Prioritize:

Administrative Changes

User Changes

Role Changes

Mailbox Changes

Forwarding Changes

Sharing Changes

Application Changes

Security Policy Changes

73 — Review Audit Retention

Ask:

How Long Is Audit Data Available?

Does That Meet Investigation Requirements?

Does It Meet Compliance Requirements?

Is Important Data Exported Centrally?

74 — Review Central Security Monitoring

Determine whether Microsoft 365 telemetry reaches:

Security Operations

SIEM

XDR

Incident Management

as appropriate.

Monitoring Model

M365 ACTIVITY
      ↓
AUDIT / SECURITY TELEMETRY
      ↓
CENTRAL SECURITY PLATFORM
      ↓
DETECTION
      ↓
ANALYST
      ↓
RESPONSE

75 — Review Alert Ownership

For security alerts determine:

Who Receives Them?

Who Triages Them?

What Is the SLA?

How Are Incidents Escalated?

Who Owns Remediation?

76 — Review High-Value Detection Scenarios

The security team should consider visibility for events such as:

Privileged Role Assignment

Suspicious Authentication

External Forwarding Creation

Unexpected Mailbox Rule

Sensitive Sharing Change

High-Impact Application Consent

Security Policy Change

Unusual Administrative Activity

77 — Review Business Email Compromise Readiness

The organization should be able to investigate:

Suspicious Sign-In

Mailbox Rules

Forwarding

Delegation

Sent Messages

Authentication Changes

Sessions

Related Recipients

BEC Investigation Model

ALERT
  ↓
IDENTITY
  ↓
SIGN-IN
  ↓
MAILBOX
  ↓
RULES
  ↓
FORWARDING
  ↓
MESSAGES
  ↓
SESSIONS
  ↓
IMPACT

78 — Review Phishing Response Readiness

Determine whether the organization can answer:

Who Received the Message?

Who Clicked?

Was an Attachment Opened?

Were Credentials Entered?

Did Authentication Change?

Did Similar Messages Reach Others?

79 — Review Compromised Identity Response

Validate documented procedures for:

Account Containment

Session Revocation

Credential Reset

Authentication Method Review

Role Review

Mailbox Review

Application Review

Impact Analysis

80 — Review External Sharing Incident Readiness

Security teams should be able to investigate:

Which File?

Who Shared It?

With Whom?

How?

When?

What Was the Data Sensitivity?

Was Access Used?

81 — Review Administrative Change Management

Sensitive tenant changes should follow:

REQUEST
  ↓
APPROVAL
  ↓
IMPLEMENT
  ↓
VALIDATE
  ↓
MONITOR
  ↓
DOCUMENT

82 — Review Security Exceptions

Create a central exception inventory.

Include:

Conditional Access Exclusions

Email Filtering Exceptions

External Sharing Exceptions

DLP Exceptions

Application Exceptions

Administrative Exceptions

Exception Principle

An exception should have:

OWNER
  +
REASON
  +
SCOPE
  +
EXPIRATION
  +
REVIEW

83 — Establish the Microsoft 365 Baseline

Example:

Area	Expected State
Privileged Roles	Minimum required
Admin Authentication	Strong
Conditional Access	Controlled
Guest Access	Reviewed
External Forwarding	Restricted
Email Authentication	Governed
Security Exceptions	Minimal
External Sharing	Controlled
Applications	Least privilege
Sensitive Data	Protected
Audit	Available
Monitoring	Operational

84 — Compare Baseline to Actual State

Example:

Control	Expected	Actual	Result
Privileged Roles	Minimal	Excessive	Fail
Admin MFA	Required	Enabled	Pass
Guest Reviews	Current	Stale guests	Fail
Forwarding	Restricted	External found	Fail
App Permissions	Minimum	Broad app	Fail
Audit	Available	Available	Pass

85 — Validate Every Finding

Before reporting:

VERIFY CONFIGURATION
       ↓
VERIFY BUSINESS CONTEXT
       ↓
VERIFY SCOPE
       ↓
VERIFY IMPACT
       ↓
CHECK COMPENSATING CONTROLS

Do not report assumptions as confirmed vulnerabilities.

86 — Classify Findings

Use the organization’s approved risk model.

A simplified approach:

Critical

High

Medium

Low

Informational

Consider:

Privilege

Exposure

Data Sensitivity

Likelihood

Business Impact

Detectability

Compensating Controls

87 — Finding Template

Use:

Finding ID:

Title:

Severity:

Affected Service:

Affected Scope:

Observation:

Evidence:

Security Risk:

Business Impact:

Recommendation:

Owner:

Target Date:

Validation Method:

88 — Finding Example — Excessive Administration

Finding ID:
M365-001

Title:
Excessive Tenant Administrative Privilege

Severity:
High

Observation:
Multiple identities retain broad tenant
administrative roles despite requiring only
service-specific access.

Risk:
Compromise of an unnecessarily privileged
identity may result in broad Microsoft 365
tenant impact.

Recommendation:
Reduce administrative assignments to the
minimum roles required and implement
recurring privileged-access reviews.

89 — Finding Example — External Forwarding

Finding ID:
M365-002

Title:
Unapproved External Mail Forwarding

Severity:
High

Observation:
A mailbox forwards corporate email to an
external address without documented
business approval.

Risk:
Sensitive communications may leave the
managed enterprise environment.

Recommendation:
Remove unapproved forwarding and establish
controlled exception governance.

90 — Finding Example — Stale Guest

Finding ID:
M365-003

Title:
Stale External Guest Access

Severity:
Medium

Observation:
Guest identities associated with completed
business engagements remain enabled.

Risk:
Former collaborators may retain access to
corporate resources beyond the approved
business period.

Recommendation:
Remove stale guest access and establish
recurring sponsor-based access reviews.

91 — Finding Example — External Sharing

Finding ID:
M365-004

Title:
Excessive External File Sharing

Severity:
High

Observation:
Sensitive business information is shared
using access broader than required for the
approved collaboration scenario.

Risk:
Corporate information may remain available
to unintended recipients.

Recommendation:
Restrict sharing to explicitly approved
recipients and periodically review external
access.

92 — Finding Example — Application Access

Finding ID:
M365-005

Title:
Over-Privileged Enterprise Application

Severity:
High

Observation:
An enterprise application has access to
Microsoft 365 data beyond the permissions
required for its documented purpose.

Risk:
Application compromise could expose a
larger scope of enterprise data.

Recommendation:
Reduce application permissions and
implement recurring application-access
reviews.

93 — Finding Example — Monitoring

Finding ID:
M365-006

Title:
Insufficient Microsoft 365 Security
Monitoring

Severity:
Medium

Observation:
Security-relevant Microsoft 365 activity is
available but is not consistently reviewed
through the organization's security
operations process.

Risk:
Suspicious identity, administrative, email,
or sharing activity may not be detected in
a timely manner.

Recommendation:
Define monitoring requirements and
integrate required Microsoft 365 telemetry
with the security operations workflow.

94 — Build the Findings Summary

ID	Finding	Severity	Owner	Status
M365-001	Excessive Admin Privilege	High	IAM	Open
M365-002	External Forwarding	High	Messaging	Open
M365-003	Stale Guests	Medium	IAM	Open
M365-004	Broad Sharing	High	Collaboration	Open
M365-005	Application Access	High	App Team	Open

95 — Prioritize Remediation

Use:

RISK
  +
BUSINESS IMPACT
  +
REMEDIATION EFFORT
  +
DEPENDENCIES

96 — Immediate Actions

Examples:

Remove Confirmed Unauthorized Admin Access

Contain Confirmed Compromised Identities

Disable Malicious Forwarding

Remove Unauthorized Application Access

Restrict Confirmed Sensitive Data Exposure

97 — Short-Term Actions

Examples:

Reduce Standing Privilege

Review Guest Accounts

Review Mailbox Delegation

Remove Broad Email Exceptions

Review Sharing Links

Review Application Permissions

98 — Medium-Term Actions

Examples:

Improve Conditional Access

Strengthen Guest Governance

Improve Email Authentication

Improve Data Classification

Improve DLP

Centralize Security Monitoring

99 — Long-Term Improvements

Examples:

Automated Identity Governance

Time-Limited Privilege

Continuous Application Governance

Automated Data Protection

Continuous Configuration Assessment

Integrated Detection and Response

100 — Build the Remediation Matrix

Finding	Priority	Owner	Action	Target
M365-001	High	IAM	Reduce admin roles	14 days
M365-002	High	Messaging	Remove forwarding	Immediate
M365-003	Medium	IAM	Review guests	30 days
M365-004	High	Data Owner	Restrict sharing	14 days
M365-005	High	App Team	Reduce permissions	14 days

101 — Change Safely

For high-impact Microsoft 365 configuration changes use:

UNDERSTAND DEPENDENCY
       ↓
APPROVE
       ↓
TEST / PILOT
       ↓
IMPLEMENT
       ↓
VALIDATE
       ↓
MONITOR
       ↓
ROLL BACK IF REQUIRED

102 — Do Not Disable Access Blindly

Before removing:

Application Permission

Guest Access

Mail Connector

Forwarding

Administrative Role

Conditional Access Exception

validate the business dependency.

103 — Retest Findings

A finding should not be considered closed simply because:

Configuration Changed

Perform:

RETEST

104 — Retest Administrative Roles

Verify:

Unnecessary Role Removed

Required Administration Still Works

Privileged Account Protected

Monitoring Remains Active

105 — Retest Conditional Access

Use authorized test identities.

Validate:

Expected User Allowed

Restricted User Blocked

Administrator Receives Required Control

Approved Exception Still Works

106 — Retest External Forwarding

Confirm:

Unauthorized Forwarding Removed

Approved Mail Flow Still Functions

Security Monitoring Detects Relevant Changes

107 — Retest Guest Access

Verify:

Stale Guest Removed

Required Guest Retained

Business Owner Confirmed

Resource Access Correct

108 — Retest External Sharing

Confirm:

Broad Link Removed

Approved Recipient Retains Access

Unauthorized Recipient Cannot Access

Owner Still Has Required Collaboration

109 — Retest Application Permissions

Validate:

Excess Permission Removed

Application Still Functions

Required Permission Retained

Owner Confirmed

110 — Retest Monitoring

Generate an approved benign administrative change in the test environment.

Confirm:

Activity Logged

Event Searchable

Detection Works Where Expected

SOC Can Investigate

111 — Closure Criteria

Close findings only when:

Remediation Implemented

Technical Validation Complete

Evidence Captured

Business Owner Confirmed

Residual Risk Documented

112 — Risk Acceptance

If remediation cannot be completed, document:

Finding

Business Reason

Risk Owner

Compensating Controls

Review Date

Expiration Date

Risk acceptance should always have an owner.

113 — Final Microsoft 365 Security Report

Recommended structure:

01 Executive Summary

02 Scope

03 Tenant Overview

04 Assessment Methodology

05 Administrative Security

06 Identity Security

07 Exchange Online

08 Email Security

09 Mailbox Security

10 Teams

11 SharePoint

12 OneDrive

13 External Sharing

14 Applications

15 Data Protection

16 Audit and Monitoring

17 Incident Readiness

18 Findings

19 Remediation Roadmap

20 Retest Plan

114 — Executive Summary

Write for:

CISO

CIO

IT Leadership

Risk Management

Business Owners

Focus on:

What Is the Risk?

Why Does It Matter?

What Should Be Fixed First?

Example:

The Microsoft 365 security review identified
opportunities to strengthen administrative
access, external collaboration, mailbox
security, application governance, and
security monitoring.

The highest-priority actions are to reduce
unnecessary privileged access, remove
unapproved external forwarding, restrict
sensitive external sharing, and reduce
over-privileged application permissions.

115 — Assessment Methodology

Document activities such as:

Stakeholder Interviews

Configuration Review

Administrative Role Review

Identity Review

Email Security Review

Collaboration Review

Application Review

Data Protection Review

Audit Review

Evidence Validation

116 — Management Action Plan

Use an understandable timeline:

0–14 Days
Immediate privilege, exposure, and
mail-security issues

15–30 Days
Guest, sharing, application, and
configuration cleanup

31–90 Days
Governance, data protection, and
monitoring improvements

90+ Days
Automation and security maturity
improvements

117 — Microsoft 365 Review Checklist

Authorization

• Written authorization confirmed
• Tenant confirmed
• Services in scope documented
• Exclusions documented
• Evidence requirements documented

Tenant

• Tenant architecture reviewed
• Domains reviewed
• Service inventory created
• Business owners identified

Administration

• Administrative roles reviewed
• Privileged identities reviewed
• Least privilege assessed
• Standing privilege reviewed
• Emergency access reviewed
• Administrative account separation reviewed

Identity

• MFA reviewed
• Authentication methods reviewed
• Conditional Access reviewed
• Policy exclusions reviewed
• Guest identities reviewed
• Identity-risk visibility reviewed

Exchange

• Accepted domains reviewed
• Mail-flow rules reviewed
• Connectors reviewed
• External forwarding reviewed
• Mailbox delegation reviewed
• Shared mailboxes reviewed
• Inbox rules reviewed

Email Security

• SPF reviewed
• DKIM reviewed
• DMARC reviewed
• Anti-phishing reviewed
• Link protection reviewed where available
• Attachment protection reviewed where available
• Security exceptions reviewed
• Quarantine governance reviewed
• User phishing reporting reviewed

Teams

• Guest access reviewed
• External access reviewed
• Team ownership reviewed
• Sensitive memberships reviewed
• Meeting policies reviewed
• Teams applications reviewed

SharePoint

• Critical sites inventoried
• Site ownership reviewed
• Membership reviewed
• External sharing reviewed
• Broad sharing links reviewed
• Sensitive sites reviewed

OneDrive

• External sharing reviewed
• Sensitive data reviewed
• Offboarding reviewed
• Former employee access reviewed
• Ownership transfer reviewed

Applications

• Enterprise applications inventoried
• Owners identified
• Permissions reviewed
• Administrative consent reviewed
• Application credentials reviewed
• Unused applications identified

Data Protection

• Classification reviewed
• Sensitivity protection reviewed
• DLP reviewed
• DLP exceptions reviewed
• Retention reviewed
• External data handling reviewed

Audit and Monitoring

• Audit capabilities reviewed
• Audit retention reviewed
• Administrative changes reviewed
• Mailbox changes reviewed
• Sharing changes reviewed
• Application changes reviewed
• Central monitoring reviewed
• Alert ownership reviewed

Incident Readiness

• BEC procedure reviewed
• Phishing response reviewed
• Identity containment reviewed
• Session response reviewed
• External sharing response reviewed
• Escalation process reviewed

Findings

• Findings technically validated
• Business context confirmed
• Severity justified
• Evidence captured
• Recommendations actionable
• Owners assigned

Remediation

• Immediate actions defined
• Short-term actions defined
• Medium-term improvements defined
• Long-term roadmap defined

Retesting

• Remediation technically retested
• Required business functionality validated
• Evidence collected
• Residual risk documented
• Findings formally closed

Common Microsoft 365 Review Mistakes

Avoid:

Reviewing Only Exchange Online

Ignoring Identity

Ignoring Guest Accounts

Ignoring Conditional Access Exclusions

Ignoring Mailbox Forwarding

Ignoring Inbox Rules

Ignoring Third-Party Applications

Ignoring Application Consent

Ignoring SharePoint Sharing Links

Treating Every Guest as a Security Problem

Treating Every Alert as a Confirmed Incident

Treating Audit Logging as Active Monitoring

Changing DMARC Without Understanding
Mail Sources

Removing Application Permissions Without
Dependency Testing

Disabling Business Collaboration Without
Understanding the Requirement

Reporting Missing Licensed Features as
Automatic Vulnerabilities

Microsoft 365 Security Maturity Model

Level 1 — Basic

MFA

Basic Email Security

Basic Administration

Basic Audit

Level 2 — Controlled

Least Privilege

Conditional Access

Guest Governance

Controlled External Sharing

Email Authentication

Level 3 — Managed

Privileged Access Governance

Application Governance

Data Classification

DLP

Central Security Monitoring

Level 4 — Mature

Time-Limited Privilege

Automated Identity Governance

Continuous Application Review

Adaptive Access

Integrated XDR / SIEM

Automated Data Protection

Continuous Security Validation

Professional Interview Scenarios

Scenario 01

You discover several users with broad tenant administrative roles. What do you do?

Use:

Identify
  ↓
Validate Business Requirement
  ↓
Map Administrative Tasks
  ↓
Select Minimum Role
  ↓
Plan Change
  ↓
Retest

Do not blindly remove access.

Scenario 02

You discover external forwarding on the CFO’s mailbox. What should happen next?

Determine:

Destination

Business Approval

Creation Time

Mailbox Rules

Recent Sign-Ins

Authentication Changes

Related Activity

If unauthorized, treat it as a potential security incident rather than only a configuration issue.

Scenario 03

You find 500 guest accounts. Is that automatically a finding?

No.

Determine:

Ownership

Business Purpose

Resource Access

Age

Review Status

Current Requirement

The problem is unmanaged or unnecessary access, not simply the existence of guests.

Scenario 04

Why are enterprise applications important during a Microsoft 365 review?

Because applications may have access to:

Directory Data

Mail

Files

Calendars

Users

Tenant Resources

and may operate independently of an interactive human session.

Scenario 05

Why should external sharing be reviewed continuously?

Because:

Business Relationships Change

Projects End

Employees Leave

Data Sensitivity Changes

Sharing Links Remain

40 Microsoft 365 Security Review Interview Questions

1. What is the purpose of a Microsoft 365 security review?
2. What should be confirmed before beginning the review?
3. What is the Microsoft cloud shared-responsibility model?
4. Why should administrative roles be reviewed?
5. What is least privilege?
6. Why should privileged accounts be separated from normal accounts?
7. What is standing privilege?
8. What is emergency access?
9. Why is MFA important for administrators?
10. What is Conditional Access?
11. Why should Conditional Access exclusions be reviewed?
12. What is guest access?
13. Why are stale guests a security concern?
14. What is Exchange Online?
15. Why should mail-flow rules be reviewed?
16. Why should mail connectors be reviewed?
17. Why is external forwarding security sensitive?
18. What is mailbox delegation?
19. Why should inbox rules be investigated?
20. What is SPF?
21. What is DKIM?
22. What is DMARC?
23. Why are email-security exceptions risky?
24. What is the difference between Teams guest access and external access?
25. Why should Teams applications be reviewed?
26. Why is SharePoint site ownership important?
27. Why are broad sharing links risky?
28. What should be reviewed in OneDrive offboarding?
29. What is an enterprise application?
30. Why are application permissions important?
31. What is administrative consent?
32. Why should unused applications be removed?
33. What is data classification?
34. What is DLP?
35. What is retention?
36. What Microsoft 365 activities should be audited?
37. What is the difference between logging and monitoring?
38. How would you investigate a suspected mailbox compromise?
39. Why must remediation be retested?
40. What should a Microsoft 365 security assessment report contain?

Final Microsoft 365 Assessment Mental Model

Remember:

UNDERSTAND THE TENANT
        ↓
IDENTIFY ADMINISTRATORS
        ↓
PROTECT IDENTITY
        ↓
CONTROL PRIVILEGE
        ↓
SECURE EMAIL
        ↓
REVIEW MAILBOXES
        ↓
CONTROL COLLABORATION
        ↓
CONTROL EXTERNAL SHARING
        ↓
GOVERN APPLICATIONS
        ↓
PROTECT DATA
        ↓
AUDIT IMPORTANT ACTIVITY
        ↓
MONITOR SECURITY EVENTS
        ↓
PREPARE FOR INCIDENTS
        ↓
VALIDATE FINDINGS
        ↓
REMEDIATE
        ↓
RETEST

The key assessment question is not:

Is Microsoft 365 Enabled?

It is:

Can the Organization
Control and Monitor
Who Can Access
Which Microsoft 365 Resources,
From Where,
Using What Privilege,
and What Happens to the Data?

Runbook Complete

You now have a repeatable professional methodology for reviewing:

Microsoft 365 Tenant Security

Administrative Access

Privileged Identity

Conditional Access

Guest Access

Exchange Online

Mailbox Security

Email Protection

Microsoft Teams

SharePoint Online

OneDrive

External Sharing

Enterprise Applications

Data Protection

Audit

Monitoring

Incident Readiness

Remediation

Retesting

This moves the assessment beyond:

Checking Microsoft 365 Settings

toward:

Evaluating Enterprise
Identity + Collaboration + Data Risk

What’s Next?

➡️ Runbook 03 — Windows Security Assessment

In the final Microsoft security runbook, you will convert the Windows Security Lab into a repeatable enterprise endpoint and server assessment methodology.

You will work through:

Assessment Preparation
      ↓
Windows Asset Context
      ↓
Operating System Security
      ↓
Local Accounts
      ↓
Administrative Privilege
      ↓
Authentication
      ↓
Security Policy
      ↓
Microsoft Defender
      ↓
Windows Firewall
      ↓
Disk Encryption
      ↓
Applications
      ↓
Services
      ↓
Scheduled Tasks
      ↓
Persistence Review
      ↓
PowerShell Security
      ↓
Audit Policy
      ↓
Security Logs
      ↓
Network Exposure
      ↓
Security Findings
      ↓
Remediation
      ↓
Retesting
      ↓
Final Security Report

Your Microsoft security runbook sequence is now:

Runbook 01 — Active Directory Assessment
        ↓
Runbook 02 — Microsoft 365 Security Review
        ↓
Runbook 03 — Windows Security Assessment