The Microsoft 365 security checklist: 179 checks, worst first

How to find users without MFA in Microsoft 365

Drive registration to 100% of enabled member accounts, then enforce it with Conditional Access.

NL-IDN-001

How to require MFA for every user with Conditional Access

Create an enabled Conditional Access policy requiring MFA for all users and all cloud apps, excluding only break-glass accounts.

NL-IDN-002

How to block legacy authentication in Microsoft 365

Create a Conditional Access policy blocking legacy authentication clients for all users.

NL-IDN-003

How to find administrators without MFA in Microsoft 365

Register strong authentication for every privileged account today, then enforce it with Conditional Access.

NL-ACC-001

How to require MFA for administrator roles in Entra ID

Create a Conditional Access policy for the administrator directory roles requiring MFA on all resources.

NL-IDN-115

Security defaults vs Conditional Access: which to use?

Either turn security defaults on, or build a Conditional Access baseline if the tenant is licensed for it.

NL-IDN-004

How to require phishing-resistant MFA for administrators

Require the "Phishing-resistant MFA" authentication strength for all privileged roles.

NL-IDN-006

How to set up user risk and sign-in risk policies

Deploy sign-in risk and user risk Conditional Access policies.

NL-IDN-007

How to stop users consenting to third-party apps in Entra ID

Restrict user consent to verified publishers and low-impact permissions, and enable the admin consent workflow.

NL-IDN-009

How to block device code sign-in with Conditional Access

Block the device code flow with Conditional Access, excluding only the accounts that genuinely need it.

NL-IDN-017

How to set up the user risk policy in Conditional Access

Create the user risk policy CIS describes: all users, all resources, user risk High, grant MFA and password change, sign-in frequency every time.

NL-IDN-117

How to set up the sign-in risk policy in Conditional Access

Create the sign-in risk policy CIS describes: all users, all resources, sign-in risk High and Medium, grant MFA, sign-in frequency every time.

NL-IDN-118

How to block sign-in to shared mailboxes

Block sign-in for every shared mailbox account.

NL-EXO-101

How to check modern authentication is on in Exchange Online

Turn on modern authentication for Exchange Online.

NL-EXO-121

How many Global Admins should a Microsoft 365 tenant have?

Reduce standing Global Administrators to two to four, and move the rest to least-privilege roles.

NL-ACC-002

Why admin accounts should be cloud-only in Microsoft 365

Move privileged roles onto cloud-only accounts that have no on-premises counterpart.

NL-ACC-003

How to use PIM for just-in-time admin roles

Convert standing privileged assignments to PIM-eligible with approval, justification and a maximum activation duration.

NL-ACC-004

How to set up break-glass accounts in Entra ID

Create two cloud-only emergency access accounts, exclude them from Conditional Access, and monitor their use.

NL-ACC-005

How to find apps with high-privilege Graph permissions

Review every high-privilege application grant, remove what is unused and scope the rest.

NL-ACC-007

How to review tenant-wide app consent grants in Entra ID

Review every tenant-wide grant with a high-risk scope and revoke the ones without a clear owner.

NL-ACC-009

How to find risky apps with access to Microsoft 365 data

Review each high-risk app with its owner, and block the ones nobody recognises.

NL-ACC-011

Require approval to activate Global Administrator in PIM

Require approval, with two or more approvers, to activate Global Administrator and Privileged Role Administrator.

NL-IDN-127

How to find inbox rules forwarding mail outside the company

Review each forwarding rule with the mailbox owner, remove any that are not approved, and block automatic external forwarding.

NL-EML-005

How to set up Intune compliance policies for every platform

Create compliance policies for every platform in use, then require compliance in Conditional Access.

NL-DEV-001

How to require a compliant device with Conditional Access

Require a compliant or hybrid-joined device for access to Microsoft 365 from desktop platforms.

NL-DEV-003

How to find devices on unsupported operating systems

Update each listed device to a supported release, or replace it where the hardware cannot be upgraded.

NL-DEV-008

How to require BitLocker, firewall and antivirus in Intune

Require BitLocker, firewall, antivirus and real-time protection in the Windows compliance policy, and assign it to all users or devices.

NL-DEV-009

SharePoint and OneDrive external sharing: the safe setting

Move tenant-wide sharing to "New and existing guests", which turns off Anyone links on every site.

NL-COL-001

Teams external access: who your staff can chat with

Allow external access only to the domains of organisations you work with.

NL-TMS-103

How to block Teams chat with personal Microsoft accounts

Turn off communication with Teams users not managed by an organisation.

NL-TMS-104

How to stop personal Teams accounts messaging your staff

Stop unmanaged Teams accounts starting conversations with your people.

NL-TMS-105

How to investigate and remediate risky users in Entra ID

Triage every risky user: confirm compromise, reset credentials, revoke sessions, then dismiss or remediate the risk.

NL-THR-002

Defender for Office 365: check the protections are on

Apply the Standard or Strict preset security policy to all users, then review anything the preset does not cover.

NL-THR-005

The SPF record for Microsoft 365, and how to check it

Publish one SPF TXT record per domain, including Microsoft 365, ending in -all (or ~all with an enforcing DMARC policy).

NL-EML-001

How to set up and enforce DMARC for Microsoft 365

Publish DMARC with reporting, monitor, then move to p=quarantine and p=reject.

NL-EML-002

How to check the unified audit log is on in Microsoft 365

Turn on audit log recording in Microsoft Purview.

NL-THR-006

How to make sure mailbox auditing is on in Exchange Online

Make sure mailbox auditing is on by default for the organisation, and not bypassed for any mailbox.

NL-THR-008

How to block automatic email forwarding in Microsoft 365

Turn automatic forwarding off in the outbound spam policy, with exceptions only for mailboxes that need it.

NL-EML-011

How to set up Safe Links for email, Teams and Office apps

Create a Safe Links policy for all recipients with the CIS settings, at the highest priority.

NL-EXO-105

How to set up a Safe Attachments policy

Create a Safe Attachments policy for all recipients set to Block, with the AdminOnlyAccessPolicy quarantine policy.

NL-EXO-107

Safe Attachments for SharePoint, OneDrive and Teams

Turn on Defender for Office 365 for SharePoint, OneDrive and Teams, and Safe Documents without click-through.

NL-EXO-108

How to set up anti-phishing impersonation protection

Raise the default anti-phishing policy (or a policy for everyone) to the CIS settings.

NL-EXO-110

How to find accounts bypassing mailbox auditing

Turn off audit bypass for every account listed.

NL-EXO-118

How to find mail flow rules that skip spam filtering

Disable or delete mail flow rules that set SCL -1 for sender domains; use connectors or the Tenant Allow/Block List instead.

NL-EXO-119

Microsoft 365 offboarding checklist for leavers

Finish offboarding each listed leaver: remove admin roles, stop external forwarding, convert the mailbox to shared if it must be kept, then remove the paid licences.

NL-GOV-005

How to set up self-service password reset for all users

Enable SSPR for all users and require registration at next sign-in.

NL-IDN-005

Conditional Access policies left in report-only mode

Review each non-enforcing policy: promote it to On, or delete it.

NL-IDN-008

How to stop users registering applications in Entra ID

Set "Users can register applications" to No, and delegate the Application Developer role where it is genuinely needed.

NL-IDN-010

How to restrict what guests can see in Entra ID

Set guest user access to "restricted to properties and memberships of their own directory objects".

NL-IDN-012

How to turn off self-service sign-up in Microsoft 365

Turn off email-verified joining and self-service subscription sign-up, and buy or assign licences centrally.

NL-IDN-013

How to turn off text message and voice call MFA

Turn off text message, voice call and email codes once everyone has Microsoft Authenticator or a stronger method.

NL-IDN-015

MFA fatigue: show app name and location in Authenticator

Turn on "Show application name" and "Show geographic location" for Microsoft Authenticator.

NL-IDN-016

How to protect MFA registration with Conditional Access

Require MFA, or a trusted location, to register security info.

NL-IDN-018

How to turn on the admin consent workflow in Entra ID

Turn on admin consent requests, with administrators as reviewers.

NL-IDN-020

How to stop group owners consenting to apps in Entra ID

Do not allow group owner consent; send owners through the admin consent workflow instead.

NL-IDN-021

How to set an idle session timeout for Microsoft 365

Turn on the idle session timeout at three hours or less, and a Conditional Access policy using app-enforced restrictions.

NL-IDN-102

How to block medium and high-risk sign-ins

Create a Conditional Access policy blocking medium and high sign-in risk for all users.

NL-IDN-119

Require a managed device to register MFA in Entra ID

Require a compliant or hybrid-joined device to register security information.

NL-IDN-121

Entra password protection for on-premises Active Directory

Install the Entra password protection agents and set the on-premises mode to Enforced.

NL-IDN-124

How to turn on system-preferred MFA in Entra ID

Turn on system-preferred multifactor authentication for all users.

NL-IDN-125

How to set up access reviews for guest users

Create a recurring monthly access review of guest users, removing access when reviewers do not respond.

NL-IDN-129

Disabled and dormant accounts that still hold admin roles

Remove privileged roles from disabled and dormant accounts, and add a quarterly access review.

NL-ACC-006

How to find expiring app secrets and certificates in Entra

Rotate credentials before expiry and delete the ones already expired.

NL-ACC-008

How to find apps users have allowed to read mail and files

Review the apps users have consented to, block what is not needed, and send future requests to an administrator.

NL-ACC-012

Conditional Access for workload identities: how to set it up

Create a Conditional Access policy for your high-privilege single-tenant service principals: allow sign-in only from known locations, and block risky service principals.

NL-ACC-010

Why admin accounts should not have Microsoft 365 licences

Give administrators a separate, unlicensed (or Entra ID P1/P2 only) account for admin work, and remove app licences from their admin accounts.

NL-IDN-101

How to set sign-in frequency for administrators

Create a Conditional Access policy for administrator roles with a sign-in frequency of four hours or less and persistent browser session set to never.

NL-IDN-116

How to get alerts when admin roles are assigned in PIM

In PIM, add a monitored mailbox to the assignment and activation notifications of each highly privileged role.

NL-IDN-128

How to set up access reviews for privileged roles

Create monthly PIM access reviews for each highly privileged role.

NL-IDN-130

How to block or limit client secrets on Entra ID apps

Turn on the app management policy, block password addition, or at least restrict password lifetime to 180 days.

NL-IDN-131

How to switch a DLP policy from test mode to enforced

Enforce a DLP policy for the sensitive data the business holds, after reviewing its matches in test mode.

NL-PVW-101

How to turn on DLP for Microsoft Teams chats and channels

Add Teams chat and channel messages to an enforced DLP policy.

NL-PVW-102

DLP across email, SharePoint, OneDrive, Teams and devices

Apply an enforced DLP policy to Exchange, SharePoint, OneDrive, Teams and devices, for all accounts and sites.

NL-PVW-103

How to make DLP rules block sharing, not just report it

Set each enforced DLP rule to block sharing with everyone, with an override for business need where appropriate.

NL-PVW-104

How to publish sensitivity labels in Microsoft Purview

Publish a small set of sensitivity labels (for example Public, Internal, Confidential) to everyone.

NL-PVW-106

How to turn on alert policies for compromised mailboxes

Switch the built-in alert policies back on and make sure their emails reach someone who acts on them.

NL-PVW-107

How to keep email and files with Purview retention policies

Create a retention policy that keeps Exchange email, SharePoint sites and OneDrive accounts for everyone, for as long as the business must keep its records.

NL-PVW-108

How to fix retention policies that were not applied

Retry the distribution of each retention policy in error, and fix what stops it if the retry fails again.

NL-PVW-109

How to create sensitivity labels for documents and email

Create a small set of sensitivity labels (for example Public, Internal, Confidential) and publish them to all users.

NL-COL-009

How to set up data loss prevention (DLP) in Microsoft 365

Start with Microsoft’s DLP templates for the data you hold (for example UK financial or personal data), in test mode, then turn them on.

NL-COL-010

How to raise your Intune device compliance rate

Work the non-compliant list down and fix the policies that no device can satisfy.

NL-DEV-002

How to find unmanaged devices in Entra ID

Enrol the devices into Intune, or block unmanaged devices with Conditional Access.

NL-DEV-005

Device end of life: find devices due for replacement

Replace end-of-life hardware, update operating systems that are merely out of date, and budget now for devices reaching end of life in the next twelve months.

NL-DEV-006

How to find devices without disk encryption in Intune

Require encryption in the device compliance policy and enforce BitLocker or FileVault with an endpoint security policy.

NL-DEV-007

Mark devices with no compliance policy as not compliant

Mark devices with no compliance policy assigned as not compliant.

NL-INT-101

How to block personal devices enrolling in Intune

Block personally owned devices in the default enrolment restriction; give personal phones access through app protection policies instead.

NL-INT-102

How to turn on Windows LAPS with Intune and Entra ID

Turn on Windows LAPS in Entra ID and deploy an Intune LAPS policy that backs passwords up to Entra ID.

NL-DEV-010

How to restrict who can join devices to Entra ID

Allow only a selected group, such as IT, to join devices to Entra ID; use Autopilot for everyone else.

NL-IDN-108

Stop Global Admins becoming local admins on joined devices

Turn off "Global administrator role is added as local administrator on the device during Microsoft Entra join"; use Windows LAPS or a dedicated device administrator role instead.

NL-IDN-110

How to stop users becoming local admin on devices they join

Set "Registering user is added as local administrator on the device during Microsoft Entra join" to Selected or None.

NL-IDN-111

How to turn on LAPS in Entra ID device settings

Turn on "Enable Microsoft Entra Local Administrator Password Solution (LAPS)", then deploy a LAPS policy from Intune.

NL-IDN-112

How to require a managed device for every sign-in

Require a compliant or hybrid-joined device for all users on all resources.

NL-IDN-120

Intune enrolment: require MFA and sign-in every time

Create a Conditional Access policy for Microsoft Intune Enrollment requiring MFA with sign-in frequency every time.

NL-IDN-122

How to stop guests resharing SharePoint files

Disable resharing by external users.

NL-COL-002

How to find Teams and groups with no owner

Assign at least two owners to every group, and enable the ownerless group policy.

NL-COL-003

How to review guest accounts in Microsoft 365

Remove dormant guests and put a recurring access review in place.

NL-COL-004

How to restrict who can invite guests in Entra ID

Restrict invitations to members assigned the Guest Inviter role, or to administrators.

NL-COL-005

How to restrict OneDrive sync to managed devices

Restrict the sync client to Entra-joined or hybrid-joined devices.

NL-COL-007

How to find public Teams and groups open to everyone

Make groups Private unless they are meant for everyone, starting with the largest and most sensitive.

NL-COL-012

How to apply sensitivity labels to Teams, groups and sites

Enable sensitivity labels for groups and sites, and label every team, starting with those holding confidential material.

NL-COL-013

How to limit SharePoint sharing to approved domains

Limit external sharing to the domains of approved partners.

NL-SPO-101

How to turn off third-party cloud storage in Teams

Turn off every third-party storage provider the business has not approved.

NL-TMS-101

How to block Teams contact with trial-only tenants

Block external access with trial-only tenants.

NL-TMS-106

How to control which Teams apps people can install

Allow only approved third-party and custom apps; keep Microsoft apps allowed.

NL-TMS-107

How to stop anonymous users joining Teams meetings

Stop anonymous people joining meetings; invite guests or partners by their accounts instead.

NL-TMS-108

Stop anonymous and dial-in callers starting Teams meetings

Stop anonymous people and dial-in callers starting meetings.

NL-TMS-109

Teams meeting lobby: who should bypass it

Let only people in the organisation bypass the lobby.

NL-TMS-110

How to stop external users controlling Teams screen shares

Stop external participants giving or requesting control.

NL-TMS-114

How to let users report suspicious Teams messages

Let people report Teams messages, and send the reports to your reporting mailbox.

NL-TMS-118

Cross-tenant access settings: the safe defaults

Keep B2B direct connect blocked by default and allow it only for named partner organisations; trust inbound MFA from partners you work with.

NL-COL-008

SharePoint guests: require the invited account to accept

Require guests to accept with the account the invitation was sent to.

NL-COL-014

Block legacy authentication to SharePoint and OneDrive

Block apps that do not use modern authentication.

NL-COL-015

How to improve Microsoft Secure Score

Work the highest-value Secure Score improvement actions, starting with identity.

NL-THR-001

How to deal with ageing Microsoft 365 security alerts

Establish a triage rota with a target time to first response, and tune the noisy detections.

NL-THR-003

How to set security notification contacts in Microsoft 365

Set the technical and security notification addresses to monitored distribution lists, not individuals.

NL-THR-004

How to check DKIM keys are published for each mail domain

Enable DKIM signing for each custom domain in Microsoft Defender.

NL-EML-003

Exchange Online hardening: the Secure Score settings

Work through the Exchange Online improvement actions in Secure Score.

NL-EML-006

How long does Microsoft 365 keep audit logs?

Keep at least 12 months of audit history: license Audit (Premium) for the users who need it, or export the audit log to a SIEM or log store.

NL-THR-007

How to turn off SMTP AUTH in Exchange Online

Turn SMTP AUTH off for the organisation and give the scanner or app that needs it its own exception.

NL-EML-007

How to tag external emails in Outlook

Turn on the External tag in Outlook.

NL-EML-008

How to limit Exchange calendar sharing with other domains

Share only free/busy times with other organisations, and no contacts.

NL-EML-009

How to empty the connection filter IP allow list

Empty the IP allow list and turn off the safe list; set up the senders that need it with SPF or a connector.

NL-EML-010

How to block dangerous attachment types in Exchange Online

Turn on the common attachments filter in the default anti-malware policy.

NL-EML-012

How to turn on phishing protection in Microsoft Forms

Turn on internal phishing protection for Microsoft Forms.

NL-IDN-105

How to get alerted when an internal user sends malware

Turn on "Notify an admin about undelivered messages from internal senders" in the default anti-malware policy, with a monitored address.

NL-EXO-106

How to get notified about outbound spam in Exchange Online

Turn on the copy of suspicious outbound messages and the notification of blocked senders, both to a monitored mailbox.

NL-EXO-109

How to turn on DKIM signing in Microsoft 365

Turn on DKIM signing for each custom domain in Microsoft Defender.

NL-EXO-111

Comprehensive attachment filtering in Exchange Online

Add the CIS list of file types to the default anti-malware policy’s common attachments filter.

NL-EXO-112

How to remove allowed domains from anti-spam policies

Remove every allowed domain from the inbound anti-spam policies; use the Tenant Allow/Block List for genuine false positives.

NL-EXO-113

How to set outbound spam limits in Exchange Online

Set the outbound limits to 500 external, 1,000 internal and 1,000 daily, and restrict the sender when they are reached.

NL-EXO-114

How to protect priority accounts with the strict preset

Tag the senior and finance accounts as priority accounts, and apply the strict preset security policy to them.

NL-EXO-115

How to turn on zero-hour auto purge for Microsoft Teams

Turn on zero-hour auto purge in Microsoft Teams protection.

NL-EXO-116

How to configure mailbox audit actions in Exchange Online

Add the missing audit actions to every user mailbox.

NL-EXO-117

How to reject Direct Send in Exchange Online

Move devices and apps that send by Direct Send to an authenticated connector, then reject Direct Send.

NL-EXO-124

How to apply preset security policies to everyone

Turn on the standard and strict preset security policies and apply standard (at least) to all recipients.

NL-EXO-125

Impersonation protection in the preset security policies

In both preset policies, add the sensitive accounts as users to protect, the organisation’s domains, and the key partners’ domains.

NL-EXO-126

How to find unassigned Microsoft 365 licences

Reduce seat counts at the next billing anniversary, or reassign the spare seats.

NL-LIC-001

How to find licences on disabled accounts in Microsoft 365

Reclaim licences from disabled accounts, converting mailboxes to shared where the data must stay reachable.

NL-LIC-002

How to find inactive users in Microsoft 365

Disable dormant accounts, reclaim their licences, and connect the joiner-mover-leaver process to the directory.

NL-GOV-001

How to check directory synchronisation is still running

Investigate and restore directory synchronisation, and alert on future failures.

NL-GOV-003

Should Microsoft 365 passwords expire? The current advice

Set the password validity period to "never expires" and lean on MFA and risk detection instead.

NL-IDN-011

How to require phishing-resistant MFA for every user

Roll out passkeys or Windows Hello for Business, then require the "Phishing-resistant MFA" authentication strength for everyone.

NL-IDN-019

How to create a dynamic group of all guest users

Create a dynamic security group with the rule (user.userType -eq "Guest").

NL-IDN-106

How to stop users creating security groups in Entra ID

Set "Users can create security groups in Azure portals, API or PowerShell" to No.

NL-IDN-107

How to set up a custom banned password list in Entra ID

Turn on "Enforce custom list" and add the organisation’s own words.

NL-IDN-123

How to complete the authentication methods migration

Finish the migration and set Manage migration to "Migration Complete".

NL-IDN-126

How to find unused apps that still hold permissions

Block unused apps, then delete them once nobody has asked for them back.

NL-ACC-013

How to limit application certificate lifetime in Entra ID

Restrict the maximum certificate lifetime to 365 days.

NL-IDN-132

How to turn on DLP policy tips and user notifications

Turn on user notifications and policy tips in each enforced DLP rule.

NL-PVW-105

How to publish retention labels in Microsoft Purview

Create retention labels for the records the business must keep, and publish them to the places those records live.

NL-PVW-110

How to set up retention labels in Microsoft Purview

Define retention labels for the record types the business must keep, and publish or auto-apply them.

NL-COL-011

How to clean up stale devices in Entra ID

Clean up device records that have not checked in, and automate it going forward.

NL-DEV-004

How to limit the number of devices per user in Entra ID

Set "Maximum number of devices per user" to 20 or fewer.

NL-IDN-109

How to stop users reading their own BitLocker recovery keys

Set "Restrict users from recovering the BitLocker key(s) for their owned devices" to Yes.

NL-IDN-113

How to set a Microsoft 365 group expiration policy

Enable the Microsoft 365 group expiration policy with owner renewal.

NL-COL-006

How to turn off email into Teams channels

Turn off email into channels.

NL-TMS-102

How to make dial-in callers wait in the Teams lobby

Make dial-in callers wait in the lobby.

NL-TMS-111

How to turn off Teams meeting chat for anonymous users

Turn meeting chat on for everyone except anonymous people.

NL-TMS-112

Who can present in Teams meetings: the safe default

Make "Only organisers and co-organisers" the default for who can present.

NL-TMS-113

Teams meeting chat with untrusted organisations

Turn off chat in meetings hosted by untrusted organisations.

NL-TMS-115

How to turn off Teams meeting recording by default

Turn cloud recording off in the Global meeting policy and give it, through a custom policy, to those who need it.

NL-TMS-116

Teams live events set to always record: how to change it

Let the organiser decide whether a live event is recorded.

NL-TMS-117

Block Dropbox and Google Drive in Microsoft 365 on the web

Turn off "Let users open files stored in third-party storage services in Microsoft 365 on the web".

NL-IDN-103

How to limit guest invitations to approved domains

Allow invitations only to the domains of approved partners.

NL-IDN-114

How to turn off external calendar sharing in Microsoft 365

Turn off "Let your users share their calendars with people outside of your organization".

NL-EXO-102

How to restrict who can create shared Bookings pages

Allow only selected users to create shared Bookings pages.

NL-EXO-104

How to block third-party storage in Outlook on the web

Turn off additional storage providers in every Outlook on the web policy.

NL-EXO-123

How to set up MTA-STS for Microsoft 365

Publish an MTA-STS policy for each receiving domain, starting in testing mode.

NL-EML-004

How to turn off POP and IMAP for new mailboxes

Turn POP and IMAP off in every mailbox plan, and on existing mailboxes that do not use them.

NL-EML-013

How to stop users installing Outlook add-ins

Remove the add-in roles from every role assignment policy, and deploy needed add-ins centrally.

NL-EXO-120

How to turn on MailTips in Exchange Online

Turn on all MailTips, the external recipients tip and group metrics.

NL-EXO-122

How to move DMARC to p=reject, with report addresses

Move each domain to p=reject once reports show only genuine senders pass, and add rua and ruf addresses.

NL-EXO-127

How to find licences on dormant Microsoft 365 accounts

Review dormant licensed accounts with the business, then reclaim or downgrade the licence.

NL-LIC-003

How to find overlapping Microsoft 365 subscriptions

Cancel standalone add-ons that are already covered by a suite the organisation holds.

NL-LIC-004

How to set a usage location on Microsoft 365 accounts

Set a usage location on every account, ideally from the HR source of truth.

NL-LIC-005

How to set up named locations for Conditional Access

Define the organisation's egress IP ranges as trusted named locations.

NL-GOV-002

How to add and verify a custom domain in Microsoft 365

Add and verify the organisation's domain, then make it the default.

NL-GOV-004

How to block the Office Store and self-service trials

Turn off access to the Office Store and self-service trials for users.

NL-IDN-104

How to turn on Customer Lockbox in Microsoft 365

Turn on "Require approval for all data access requests".

NL-EXO-103