How to check Microsoft 365 security: 6 checks in an hour

You can check Microsoft 365 security yourself in about an hour: six checks in the Microsoft Entra, Exchange, SharePoint and Purview admin centers show whether logins are protected, who holds full rights, whether mail is leaking and whether there will be a trail if something happens. Each check below has a clear good and bad result, so you see at once what to fix first.

An IT administrator can run them, or an owner sitting next to one. For viewing, the Global Reader role (sees everything, changes nothing) is usually enough. Menu names follow Microsoft’s documentation as of October 2026. Microsoft renames items often, so if a path looks slightly different, type the section name into the admin center search.

In short

• MFA (a second login step: a code or a tap on the phone) must cover everyone, including admins and emergency accounts.
• Legacy login protocols cannot do MFA and let people in with a password alone, so they get blocked.
• Global Administrator (full rights over all of Microsoft 365) sits on fewer than five accounts, and you know the owner of each one.
• Automatic forwarding of mail to outside addresses is off, and someone can explain every forward that exists.
• Files are not spread through “anyone” links with no expiry.
• The audit log is on. On Business plans check it separately: there it is off by default.

The six checks at a glance

1. MFA for everyone, including admins and emergency accounts

Where to look. The Microsoft Entra admin center (entra.microsoft.com): Entra ID > Authentication methods > Activity, the Registration tab, then User registration details. Filter the MFA Capable column by Not capable.

Then check that MFA is actually required, not just set up for some people. One option: Entra ID > Overview > Properties > Manage security defaults, Microsoft’s baseline protection that requires MFA and blocks legacy protocols. ^[1] The other: Entra ID > Conditional Access > Policies (conditional access rules) with an enabled policy requiring MFA for all users and all apps.

Good result. No active person is in the Not capable list. There are two emergency accounts (break glass: a way in when other admins cannot sign in). Microsoft advises protecting them with a FIDO2 key or a certificate, separate from regular admins, and testing sign-in with them at least every 90 days. ^[2] Microsoft already requires MFA to sign in to its admin centers, so an emergency account without MFA may fail exactly when you need it. ^[3]

What a bad result means. An account without MFA opens with a password alone, and passwords leak through phishing and other people’s breached databases. If an admin has no MFA, the whole tenant is at risk, meaning your Microsoft 365 instance with all its mail and files.

2. Legacy login protocols are blocked

Legacy protocols (legacy authentication) are login methods that cannot do MFA: IMAP, POP, SMTP AUTH, old mail programs. Through them a password works even when MFA is on.

Where to look. Entra ID > Monitoring & health > Sign-in logs. Add the Client App column, then a Client App filter with all legacy protocols, and look at successful logins. ^[4] Then check that blocking exists: either Security defaults, or a Conditional Access policy with the Client apps condition (Exchange ActiveSync clients and Other clients) and the Block access control.

Good result. Blocking applies to all users, and the log shows no successful legacy logins over the last weeks.

What a bad result means. Successful logins over IMAP or SMTP mean someone gets in with a password alone. If it is a scanner or a program sending invoices, find a modern login method for it. If nobody recognises those logins, change the password and check the mailbox. Many failed attempts from different countries usually mean password guessing.

3. How many admins, and who has Global Admin

Where to look. Entra ID > Roles & admins, the Global Administrator role, its list of assignments. The same is visible in the Microsoft 365 admin center (admin.microsoft.com): Roles > Role assignments.

Good result. Microsoft recommends fewer than five Global Administrators. ^[5] For a small company a sensible setup is two named admins plus two emergency accounts. Every account has MFA, and its owner still works with you. Day to day work uses narrower roles: User Administrator, Exchange Administrator, Billing Administrator.

What a bad result means. Global Administrator held by a former employee, a contractor, a shared account like office@ or a director “just in case“. Each such account is a key to everything: mail, files and security settings. The more keys, the better the odds that one gets stolen.

4. Mail forwarding to outside addresses

After breaking into a mailbox, an attacker can add a rule that quietly forwards copies of mail to an outside address. The password has been changed, yet the mail keeps flowing. Microsoft names such forwarding a data leak risk directly. ^[6]

Where to look. The Microsoft Defender portal (security.microsoft.com): Email & collaboration > Policies & rules > Threat policies > Anti-spam, the Anti-spam outbound policy, the Automatic forwarding rules setting. Then in the new Exchange admin center (admin.exchange.microsoft.com) open the Auto forwarded messages report under Reports > Mail flow: it shows who forwards mail and where.

Good result. The setting is Off, or Automatic (System-controlled), which since 2021 also means off. ^[6] Needed exceptions sit in a separate policy for specific people. The report is empty, or someone can explain every forward.

What a bad result means. Forwarding is on for everyone, or the report shows private addresses nobody set up on purpose. Treat that mailbox as compromised until proven otherwise: change the password, end the sessions, delete the rule and review what was sent from it.

There is another way into mail without a password: third party apps allowed to read messages. How to find them and remove the ones you do not need is covered in the worksheet Who has access to your Microsoft 365 mail?

5. External file sharing in SharePoint and OneDrive

Where to look. The SharePoint admin center: Policies > Sharing. It holds the external sharing levels for SharePoint and OneDrive: Anyone (the link works without signing in), New and existing guests, Existing guests, Only people in your organization. ^[7] The same page sets the default link type and the expiry of Anyone links.

Good result. Anyone is off, or allowed only for viewing and with a short expiry. The default link is Specific people, meaning access only for named people. Guests come in by invitation, and someone reviews the guest list.

What a bad result means. Anyone links with no expiry and with edit rights, “anyone” as the default link. Such a file opens for whoever the link was forwarded to, and you will not know who. That is how contracts, payroll sheets and passport scans end up in the open.

6. Logs: audit is on and someone reviews logins

The audit log (records of what users and admins did). The Microsoft Purview portal (purview.microsoft.com): the Audit card under Solutions. If auditing is off, a banner at the top offers to start recording activity. The exact check in Exchange Online PowerShell: Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled, which should be True. ^[8] Important: on Business Basic, Business Standard and Business Premium, auditing is not on by default. Once it is on, records are kept for 180 days.

The login log. Entra ID > Monitoring & health > Sign-in logs, the Location column. Look for impossible travel: a login from Kyiv and, half an hour later, one from another continent. Entra ID Protection spots these automatically, but only with an Entra ID P2 licence or with Defender for Cloud Apps. ^[9] On simpler plans, look yourself. Sign-in logs are kept for 7 days in the free Entra ID and 30 days in P1 and P2, so review them every week. ^[10]

Good result. Audit is on. Once a week someone reviews admin logins, failed attempts and logins from unusual countries.

What a bad result means. Without audit, nobody can say after an incident what was read and what was taken. A successful login from a country where you have nobody, especially if mail rules changed after it, is a reason to change the password and end all sessions right away.

What to fix first

1. Admins without MFA: the shortest path to the whole tenant.
2. Unknown mail forwarding: a leak may already be under way.
3. Audit turned off: it takes minutes to turn on and starts recording at once.
4. Legacy protocols: first find who uses them, then block.
5. Anyone links and extra admins: clean up step by step, warning people first.

These six checks do not cover devices, backups, third party apps or how access is granted. We look at those in a Security Assessment. The website, customer area or API that runs next to Microsoft 365 is tested by a penetration test.

One hour checklist

• All active users have MFA, admins included.
• There are two emergency accounts with a FIDO2 key or a certificate, and logging in with them has been tested.
• Legacy login protocols are blocked, with no successful logins through them in the log.
• Fewer than five Global Administrators, all accounts named and known.
• Automatic forwarding to outside addresses is off, the forwarding report is empty or explained.
• Anyone links are off or have an expiry and view only rights.
• The audit log is on, UnifiedAuditLogIngestionEnabled is True.
• Someone reviews the login log every week.

Download the preparation checklist (PDF)PDF · A4

FAQ

How long do these checks take?

For a company of up to a few dozen people, about an hour if the admin knows the admin centers. Fixes take longer: each change should be agreed first and tried on a few people.

What rights do I need for the checks?

The Global Reader role shows almost all settings without the right to change anything. The PowerShell command for audit status may need an extra role in Exchange Online.

Will blocking legacy protocols break anything?

It can stop old scanners, printers or programs that send mail over SMTP. So first look at the login log, find who uses them, and run the Conditional Access policy in Report-only mode for a week.

What if we find a forward nobody set up?

Treat the mailbox as compromised: change the password, end all sessions, delete the rule, check the MFA methods (the attacker may have added their own phone) and the audit log for that mailbox. If invoices or bank details could have gone out through it, warn accounting and your partners.

Does this replace a security assessment?

No, it is a basic self check of settings. A Security Assessment looks wider: access, third party apps, devices, processes. Your own websites and apps are covered by a penetration test.

References

1. Microsoft Learn: Configure Security Defaults for Microsoft Entra ID learn.microsoft.com
2. Microsoft Learn: Manage emergency access admin accounts learn.microsoft.com
3. Microsoft Learn: Plan for mandatory Microsoft Entra multifactor authentication learn.microsoft.com
4. Microsoft Learn: Block legacy authentication with Conditional Access learn.microsoft.com
5. Microsoft Learn: Best practices for Microsoft Entra roles learn.microsoft.com
6. Microsoft Learn: Control external email forwarding learn.microsoft.com
7. Microsoft Learn: Manage sharing settings for SharePoint and OneDrive learn.microsoft.com
8. Microsoft Learn: Turn auditing on or off learn.microsoft.com
9. Microsoft Learn: What are risk detections? (Microsoft Entra ID Protection) learn.microsoft.com
10. Microsoft Learn: Microsoft Entra data retention learn.microsoft.com