Sample report for a fictional company
Microsoft 365 security review for Sample & Co
- People
- 12
- Licences
- Microsoft 365 Business Premium
- Findings
- 3 high, 4 medium, 2 low
Summary
Sample & Co's Microsoft 365 works well day to day, but three settings leave it open to the attacks small firms see most often: stolen passwords and phishing. All three can be fixed in about half a day without disrupting anyone's work.
Findings, most urgent first
- 01High prioritySign-in
4 of the 12 people can sign in with just a password.
- Why it matters
- Most account takeovers start with a stolen or guessed password. Multi-factor authentication stops a password on its own from being enough.
- What to do
- Turn on security defaults, or a Conditional Access policy that requires multi-factor authentication for everyone, and help the four people set up the Microsoft Authenticator app.
- Effort
- 1 to 2 hours, plus 10 minutes per person
- 02High priorityAdmin accounts
Both directors use their everyday accounts as Global Administrators.
- Why it matters
- If either everyday account is caught by a phishing email, the attacker controls the whole of Microsoft 365, including every mailbox and file.
- What to do
- Create separate admin accounts used only for admin work, protected by the strongest sign-in method available. Keep two to four Global Administrators in total, including one emergency account stored safely.
- Effort
- About 1 hour
- 03High priorityEmail
Authenticated SMTP is switched on for every mailbox, but only the office scanner needs it.
- Why it matters
- Older mail apps and devices can use it to send email in ways that may not be covered by multi-factor authentication.
- What to do
- Switch it off for the organisation and turn it on only for the scanner's mailbox, or send scans through a mail relay instead.
- Effort
- About 30 minutes
- 04Medium prioritySharing
Files can be shared with "Anyone with the link", and those links never expire.
- Why it matters
- Links get forwarded. Anyone holding one can open the file without signing in, long after the work is finished.
- What to do
- Make "Specific people" the default link type, and set "Anyone" links to expire after 30 days or turn them off.
- Effort
- About 30 minutes
- 05Medium priorityEmail
The company domain has no DMARC record, and DKIM signing is off.
- Why it matters
- Criminals can send email that appears to come from your domain, and your own email is more likely to land in spam.
- What to do
- Turn on DKIM for the domain in Microsoft Defender, publish a DMARC record starting at p=none, then move to quarantine once the reports look clean.
- Effort
- 1 hour, then a check after two weeks
- 06Medium priorityDevices
Business Premium includes Intune, but none of the 12 laptops are enrolled.
- Why it matters
- Nobody can see whether laptops are encrypted, updated or locked, or remove company data from a lost or stolen one.
- What to do
- Enrol the laptops in Intune and require disk encryption, a screen lock and up-to-date software before they can open company data.
- Effort
- About half a day
- 07Medium priorityLeavers
Someone who left five months ago still has an active, licensed account.
- Why it matters
- An unused account with a working password is an easy target, and the licence is still being paid for every month.
- What to do
- Block sign-in, convert the mailbox to a shared mailbox if you still need its email, and remove the licence.
- Effort
- About 15 minutes
- 08Low priorityAlerts
Security alerts are sent to a mailbox that nobody reads.
- Why it matters
- Warnings about suspicious sign-ins or unusual downloads go unseen.
- What to do
- Send alerts to an address someone checks, and agree who looks at them.
- Effort
- About 15 minutes
- 09Low priorityBackup
There is no backup beyond Microsoft's built-in retention.
- Why it matters
- Deleted or encrypted files can only be recovered for a limited time, and some losses are not noticed until after that.
- What to do
- Decide how far back you need to be able to recover, then set retention policies or add a Microsoft 365 backup service.
- Effort
- 1 to 2 hours, plus any backup subscription
Already in good shape
- Audit logging is on, so activity can be investigated if something goes wrong
- Automatic forwarding of email to outside addresses is blocked
- Guests in Teams are limited to people someone has invited
- Microsoft Defender's standard anti-phishing protection is on
Suggested order of work
- This weekthe 3 high-priority findings
- This monththe 4 medium-priority findings
- When convenientthe 2 low-priority findings
You can make the changes yourselves using the steps above, or ask us to quote a fixed price for them.