Every Microsoft 365 security check, with how to fix it
The 179 checks ConfigCheckup runs on a Microsoft 365 tenant, across 8 areas. Each has its own page: what the setting is, why it matters, the fix step by step with the admin centre path and PowerShell where there is one, and the frameworks it maps to, from the 19 in the framework library.
The checks, by area
5 critical, 40 high, 95 medium and 39 low. 111 of the 179 have an approved fix in ConfigCheckup from the finding, with a dry run first, and 6 more are fixed from another page; the other 62 have a step-by-step fix guide.
Identity & Authentication34
How accounts prove who they are: MFA coverage, passwordless adoption, legacy protocols.
- CriticalHow to find users without MFA in Microsoft 365
- CriticalHow to require MFA for every user with Conditional Access
- CriticalHow to block legacy authentication in Microsoft 365
- HighSecurity defaults vs Conditional Access: which to use?
- HighHow to require phishing-resistant MFA for administrators
- HighHow to set up user risk and sign-in risk policies
- HighHow to stop users consenting to third-party apps in Entra ID
- HighHow to block device code sign-in with Conditional Access
- HighHow to set up the user risk policy in Conditional Access
- HighHow to set up the sign-in risk policy in Conditional Access
- HighHow to block sign-in to shared mailboxes
- HighHow to check modern authentication is on in Exchange Online
- MediumHow to set up self-service password reset for all users
- MediumConditional Access policies left in report-only mode
- MediumHow to stop users registering applications in Entra ID
- MediumHow to restrict what guests can see in Entra ID
- MediumHow to turn off self-service sign-up in Microsoft 365
- MediumHow to turn off text message and voice call MFA
- MediumMFA fatigue: show app name and location in Authenticator
- MediumHow to protect MFA registration with Conditional Access
- MediumHow to turn on the admin consent workflow in Entra ID
- MediumHow to stop group owners consenting to apps in Entra ID
- MediumHow to set an idle session timeout for Microsoft 365
- MediumHow to block medium and high-risk sign-ins
- MediumRequire a managed device to register MFA in Entra ID
- MediumEntra password protection for on-premises Active Directory
- MediumHow to turn on system-preferred MFA in Entra ID
- MediumHow to set up access reviews for guest users
- LowShould Microsoft 365 passwords expire? The current advice
- LowHow to require phishing-resistant MFA for every user
- LowHow to create a dynamic group of all guest users
- LowHow to stop users creating security groups in Entra ID
- LowHow to set up a custom banned password list in Entra ID
- LowHow to complete the authentication methods migration
Privileged Access21
Who holds administrative power, how it is granted, and whether it is time bound.
- CriticalHow to find administrators without MFA in Microsoft 365
- CriticalHow to require MFA for administrator roles in Entra ID
- HighHow many Global Admins should a Microsoft 365 tenant have?
- HighWhy admin accounts should be cloud-only in Microsoft 365
- HighHow to use PIM for just-in-time admin roles
- HighHow to set up break-glass accounts in Entra ID
- HighHow to find apps with high-privilege Graph permissions
- HighHow to review tenant-wide app consent grants in Entra ID
- HighHow to find risky apps with access to Microsoft 365 data
- HighRequire approval to activate Global Administrator in PIM
- MediumDisabled and dormant accounts that still hold admin roles
- MediumHow to find expiring app secrets and certificates in Entra
- MediumHow to find apps users have allowed to read mail and files
- MediumConditional Access for workload identities: how to set it up
- MediumWhy admin accounts should not have Microsoft 365 licences
- MediumHow to set sign-in frequency for administrators
- MediumHow to get alerts when admin roles are assigned in PIM
- MediumHow to set up access reviews for privileged roles
- MediumHow to block or limit client secrets on Entra ID apps
- LowHow to find unused apps that still hold permissions
- LowHow to limit application certificate lifetime in Entra ID
Data Protection14
Retention, sensitivity labelling, DLP coverage and external sharing of content.
- HighHow to find inbox rules forwarding mail outside the company
- MediumHow to switch a DLP policy from test mode to enforced
- MediumHow to turn on DLP for Microsoft Teams chats and channels
- MediumDLP across email, SharePoint, OneDrive, Teams and devices
- MediumHow to make DLP rules block sharing, not just report it
- MediumHow to publish sensitivity labels in Microsoft Purview
- MediumHow to turn on alert policies for compromised mailboxes
- MediumHow to keep email and files with Purview retention policies
- MediumHow to fix retention policies that were not applied
- MediumHow to create sensitivity labels for documents and email
- MediumHow to set up data loss prevention (DLP) in Microsoft 365
- LowHow to turn on DLP policy tips and user notifications
- LowHow to publish retention labels in Microsoft Purview
- LowHow to set up retention labels in Microsoft Purview
Device & Endpoint20
Enrolment, compliance, update rings and endpoint protection posture.
- HighHow to set up Intune compliance policies for every platform
- HighHow to require a compliant device with Conditional Access
- HighHow to find devices on unsupported operating systems
- HighHow to require BitLocker, firewall and antivirus in Intune
- MediumHow to raise your Intune device compliance rate
- MediumHow to find unmanaged devices in Entra ID
- MediumDevice end of life: find devices due for replacement
- MediumHow to find devices without disk encryption in Intune
- MediumMark devices with no compliance policy as not compliant
- MediumHow to block personal devices enrolling in Intune
- MediumHow to turn on Windows LAPS with Intune and Entra ID
- MediumHow to restrict who can join devices to Entra ID
- MediumStop Global Admins becoming local admins on joined devices
- MediumHow to stop users becoming local admin on devices they join
- MediumHow to turn on LAPS in Entra ID device settings
- MediumHow to require a managed device for every sign-in
- MediumIntune enrolment: require MFA and sign-in every time
- LowHow to clean up stale devices in Entra ID
- LowHow to limit the number of devices per user in Entra ID
- LowHow to stop users reading their own BitLocker recovery keys
Collaboration & Sharing36
Teams, SharePoint, OneDrive and guest access configuration.
- HighSharePoint and OneDrive external sharing: the safe setting
- HighTeams external access: who your staff can chat with
- HighHow to block Teams chat with personal Microsoft accounts
- HighHow to stop personal Teams accounts messaging your staff
- MediumHow to stop guests resharing SharePoint files
- MediumHow to find Teams and groups with no owner
- MediumHow to review guest accounts in Microsoft 365
- MediumHow to restrict who can invite guests in Entra ID
- MediumHow to restrict OneDrive sync to managed devices
- MediumHow to find public Teams and groups open to everyone
- MediumHow to apply sensitivity labels to Teams, groups and sites
- MediumHow to limit SharePoint sharing to approved domains
- MediumHow to turn off third-party cloud storage in Teams
- MediumHow to block Teams contact with trial-only tenants
- MediumHow to control which Teams apps people can install
- MediumHow to stop anonymous users joining Teams meetings
- MediumStop anonymous and dial-in callers starting Teams meetings
- MediumTeams meeting lobby: who should bypass it
- MediumHow to stop external users controlling Teams screen shares
- MediumHow to let users report suspicious Teams messages
- MediumCross-tenant access settings: the safe defaults
- MediumSharePoint guests: require the invited account to accept
- MediumBlock legacy authentication to SharePoint and OneDrive
- LowHow to set a Microsoft 365 group expiration policy
- LowHow to turn off email into Teams channels
- LowHow to make dial-in callers wait in the Teams lobby
- LowHow to turn off Teams meeting chat for anonymous users
- LowWho can present in Teams meetings: the safe default
- LowTeams meeting chat with untrusted organisations
- LowHow to turn off Teams meeting recording by default
- LowTeams live events set to always record: how to change it
- LowBlock Dropbox and Google Drive in Microsoft 365 on the web
- LowHow to limit guest invitations to approved domains
- LowHow to turn off external calendar sharing in Microsoft 365
- LowHow to restrict who can create shared Bookings pages
- LowHow to block third-party storage in Outlook on the web
Threat Protection42
Defender coverage, alerting, risk detections and incident readiness.
- HighHow to investigate and remediate risky users in Entra ID
- HighDefender for Office 365: check the protections are on
- HighThe SPF record for Microsoft 365, and how to check it
- HighHow to set up and enforce DMARC for Microsoft 365
- HighHow to check the unified audit log is on in Microsoft 365
- HighHow to make sure mailbox auditing is on in Exchange Online
- HighHow to block automatic email forwarding in Microsoft 365
- HighHow to set up Safe Links for email, Teams and Office apps
- HighHow to set up a Safe Attachments policy
- HighSafe Attachments for SharePoint, OneDrive and Teams
- HighHow to set up anti-phishing impersonation protection
- HighHow to find accounts bypassing mailbox auditing
- HighHow to find mail flow rules that skip spam filtering
- MediumHow to improve Microsoft Secure Score
- MediumHow to deal with ageing Microsoft 365 security alerts
- MediumHow to set security notification contacts in Microsoft 365
- MediumHow to check DKIM keys are published for each mail domain
- MediumExchange Online hardening: the Secure Score settings
- MediumHow long does Microsoft 365 keep audit logs?
- MediumHow to turn off SMTP AUTH in Exchange Online
- MediumHow to tag external emails in Outlook
- MediumHow to limit Exchange calendar sharing with other domains
- MediumHow to empty the connection filter IP allow list
- MediumHow to block dangerous attachment types in Exchange Online
- MediumHow to turn on phishing protection in Microsoft Forms
- MediumHow to get alerted when an internal user sends malware
- MediumHow to get notified about outbound spam in Exchange Online
- MediumHow to turn on DKIM signing in Microsoft 365
- MediumComprehensive attachment filtering in Exchange Online
- MediumHow to remove allowed domains from anti-spam policies
- MediumHow to set outbound spam limits in Exchange Online
- MediumHow to protect priority accounts with the strict preset
- MediumHow to turn on zero-hour auto purge for Microsoft Teams
- MediumHow to configure mailbox audit actions in Exchange Online
- MediumHow to reject Direct Send in Exchange Online
- MediumHow to apply preset security policies to everyone
- MediumImpersonation protection in the preset security policies
- LowHow to set up MTA-STS for Microsoft 365
- LowHow to turn off POP and IMAP for new mailboxes
- LowHow to stop users installing Outlook add-ins
- LowHow to turn on MailTips in Exchange Online
- LowHow to move DMARC to p=reject, with report addresses
Licensing & Cost5
Entitlement use, unassigned seats, duplication and downgrade opportunities.
Governance & Operations7
Lifecycle, ownership, documentation, audit retention and change control.
- HighMicrosoft 365 offboarding checklist for leavers
- MediumHow to find inactive users in Microsoft 365
- MediumHow to check directory synchronisation is still running
- LowHow to set up named locations for Conditional Access
- LowHow to add and verify a custom domain in Microsoft 365
- LowHow to block the Office Store and self-service trials
- LowHow to turn on Customer Lockbox in Microsoft 365
Other ways to use the checks
Print the whole list, see which frameworks each check evidences, or search the catalogue by framework.
Run every check on every tenant.
ConfigCheckup runs all 179 checks on each tenant you connect: most with read-only consent, and the Exchange Online and Defender settings once you give it the Exchange role. Every finding gets its fix.
14 days of daily monitoring and alerts, every finding with its fix guide, and reports on up to 3 tenants, from your first connected tenant. No card. Then choose the plan that fits.