Microsoft 365 Security Baseline Review Checklist Template

Phase 1 records the licence tier (Business Standard, Business Premium, E3, E5 or other) and whether Entra ID P2 is available. Those answers show or hide later tasks.

• Record the tenant, the reviewer and the baseline version used — for example your own baseline mapped to CIS v7.0.0
• Record Secure Score now and at the last review — open the history and note every recommendation that changed status
• Carry forward open actions and exceptions from the last review — expired exceptions are reviewed first
• List what changed since last quarter — new admins, new domains, new enterprise apps, new licences and policy edits from the audit log
• Run your configuration assessment if you use one — ScubaGear or another tool, with the report attached to this task

The PIM task appears only when Phase 1 records Entra ID P2 or E5. Without P2, the global admin and break-glass tasks carry the weight.

• Export every Conditional Access policy and compare it with the baseline — anything disabled, in report-only mode or with new exclusions is a finding
• Check MFA coverage — registration and enforcement for every enabled user, and phishing-resistant methods for admins
• Confirm legacy authentication is blocked — and check sign-in logs for any legacy attempts that still succeed
• Count global administrators — Microsoft recommends fewer than five and CIS asks for two to four; move the rest to least-privileged roles
• Check privileged roles are eligible, not permanent — in Privileged Identity Management, with activation requiring MFA and a reason
• Sign in with each break-glass account — confirm it works, that the sign-in alert fired and that the credentials are still where they should be

• Confirm user consent to apps is restricted — to verified publishers and low-risk permissions, or off, with an admin consent workflow
• Review enterprise apps added since last review — especially any granted mail, files or directory permissions across the whole tenant
• Check app registrations for expiring or long-lived secrets — and for owners who have left
• Review guest accounts — who invited them, last sign-in, and whether guest invitations are limited to named roles
• Remove or disable guests and apps nobody claims — recorded with the date

• Confirm automatic external forwarding is blocked — in the outbound spam policy, and check transport rules and mailbox forwarding for exceptions
• Check SPF, DKIM and DMARC for every sending domain — DKIM signing on, and DMARC progressing towards quarantine or reject
• Confirm Defender preset security policies are applied — Standard or Strict protection for anti-phishing, anti-spam, anti-malware and, where licensed, Safe Links and Safe Attachments
• Confirm mailbox auditing is on — and look for inbox rules that move, delete or forward mail to outside addresses
• Review accepted domains and connectors — anything nobody recognises is investigated before it is removed

• Check the tenant external sharing level for SharePoint and OneDrive — against the baseline, plus any sites set more permissively
• Check “Anyone” links — whether they are allowed, their expiry and the default link type offered to users
• Review Teams external access — open to all domains or limited to an allow list, and whether unmanaged Teams accounts can contact staff
• Review Teams guest access and who can create teams — aligned with the guest decisions in Phase 3
• Spot-check sites holding sensitive data — sharing, owners and membership on the five that matter most

The Intune and device tasks appear only when Phase 1 records Business Premium, E3 or E5. The audit tasks appear for every tenant.

• Review Intune compliance policies — encryption, supported OS versions, screen lock and endpoint protection, and how many devices are non-compliant
• Confirm Conditional Access requires a compliant or managed device — for the apps the baseline says need one
• Check endpoint protection onboarding — every enrolled device reporting to Defender, with stale devices removed
• Confirm Purview audit is on — and record the retention you have: 180 days by default for standard audit, longer with Audit (Premium) or a retention policy
• Check alert policies reach a monitored mailbox — admin role changes, new forwarding rules and unusual sign-ins

Sign-off is an approval task for the tenant owner: the IT manager in-house, or the client’s nominated contact for an MSP. The review is not complete until it is Approved.

• Record every difference from the baseline — fixed now, ticket raised with an owner and date, or accepted as an exception
• Update the exception register — setting, reason, compensating control, who accepted it and the expiry date
• Write the summary — Secure Score change, findings by area and the three actions that matter most
• Attach the evidence — policy exports, admin role list, sharing settings, the assessment report and screenshots
• Approve the review — and confirm the next quarterly review is scheduled