Employee access
Who can sign in, and from where?
- What We Do
- Enterprise Solutions
- Digital Transformation
- Business Applications
- Web Solutions
- Training
- Industries
- Insights
- About Us
- Talk to Us
Microsoft 365 · Professional services · Guide
Microsoft 365 Security Readiness Checklist
If an employee’s account is compromised, can your team contain the incident?
A practical Microsoft 365 security checklist for consulting, engineering and accounting firms. Connect access, devices, email and client information to named response owners.
Who notices?
An alert needs a monitored route and a person who can interpret it.
Who can act?
Authorised administrators need a tested containment process.
Who decides?
Business and data-protection owners need evidence for communication decisions.
Prepare before the alert
Client trust depends on an owned response.
Consider an illustrative scenario: a staff member approves an unexpected sign-in prompt. An unauthorised person accesses the mailbox and sends a request to change payment details. The business now needs to contain access, establish what happened and decide who must be informed.
Consulting, engineering and accounting teams work with confidential files, payment instructions and shared client workspaces. Reviewing the Microsoft 365 configuration is one part of readiness. The other is knowing who investigates, who has authority to act and how the business makes decisions during an incident.
This is a practical guide, not a client deployment report. Use it with your IT lead and an operations owner to identify gaps, assign responsibilities and plan validation.
Administrator permissions
Who can change the tenant?
Device protection
Can you trust the device?
Email security
Could a false payment request get through?
Sensitive data sharing
What can leave the firm?
Incident-response ownership
Who acts when an alert arrives?
Configuration + ownership + evidence
The Microsoft 365 security checklist.
Work through the six areas with the relevant owner. Record the control’s scope, exceptions, evidence and last test date. Product capabilities depend on your licences, supported platforms and agreed design.
AREA 01
Employee access
Microsoft Entra · Owner: Identity owner
- Require multifactor authentication for staff and prioritise phishing-resistant methods for administrators, partners and finance teams.
- Review legacy authentication and test policies before enforcement. Record justified exclusions, with separate safeguards for emergency access.
- Design Conditional Access around user roles, devices and client-data access; use report-only or pilot testing before deployment.
- Use risk-based controls where licensed. Tie joiner, mover and leaver access changes to an owned business process.
- Review guest access and document who approves continued access to client workspaces.
Evidence to reviewPolicy coverage, pilot results, an exception register and evidence of an access review.
AREA 02
Administrator permissions
Entra roles & PIM · Owner: Privileged-access owner
- Keep Global Administrator assignments to the minimum justified need; review each named assignment and delegated partner access.
- Separate administrative activity from everyday email and browsing. Use task-specific roles wherever practical.
- Consider time-bound role activation and approval through Privileged Identity Management, subject to entitlements.
- Maintain at least two cloud-only emergency accounts with phishing-resistant authentication, secure credential storage and monitored use.
- Test emergency access regularly. Design exclusions from blocking Conditional Access policies so that a policy failure does not prevent recovery.
Evidence to reviewRole inventory, activation records and a witnessed emergency-access test.
AREA 03
Device protection
Microsoft Intune & Defender · Owner: Endpoint owner
- Inventory firm devices and agree supported operating systems, patch windows, encryption and firewall requirements.
- Enrol supported managed devices in Intune and validate compliance policies with representative users.
- Deploy suitable Defender endpoint protection and verify alerts have an investigation owner.
- Define approved personal-device access and app-protection requirements. Confirm which actions remove organisational data and which affect a whole device.
- Restrict everyday local administrator rights and test lost-device response on the supported platforms.
Evidence to reviewDevice coverage, compliance exceptions, protection status and tested recovery actions.
AREA 04
Email security
Defender for Office 365 · Owner: Messaging owner
- Validate SPF and DKIM, then move DMARC towards enforcement through an owned rollout that checks legitimate senders.
- Use licensed phishing, impersonation, link and attachment protections appropriate to the firm’s exposure.
- Review external automatic forwarding and monitor suspicious mailbox rules and unexpected delegation changes.
- Give staff a clear route to report suspicious messages; confirm who monitors those reports.
- Verify changes to payment or bank details through a known, independent contact route rather than the email thread.
Evidence to reviewMail-authentication checks, protection scope, alert tests and payment-verification procedures.
AREA 05
Sensitive data sharing
Microsoft Purview & collaboration controls · Owner: Information owner
- Define meaningful information classes and sensitivity labels with the teams that own client data.
- Review anonymous links, guest permissions and sharing defaults in SharePoint, OneDrive and Teams.
- Pilot data loss prevention policies against relevant information types and business workflows before enforcement.
- Agree retention and investigation access with records, contractual and legal owners.
- Review oversharing before adopting Microsoft 365 Copilot; verify permissions and information-protection controls against the intended use cases.
Evidence to reviewAn approved sharing standard, label adoption, DLP tests and a documented permissions review.
AREA 06
Incident-response ownership
Named people & tested playbooks · Owner: Incident lead & deputy
- Name the incident lead, deputy, authorised administrators and out-of-hours escalation route.
- Prepare account-compromise, malicious mailbox-rule, app-consent and data-exposure playbooks.
- Verify the audit sources and retention available under the tenant’s licences, and test evidence collection.
- Keep legal, insurer, IT-partner and client communication contacts accessible during a Microsoft 365 outage.
- Exercise the response periodically, record timings and close the resulting actions. Agree monitoring hours and response authority explicitly.
Evidence to reviewAn approved contact tree, accessible playbooks, retained evidence and exercise records.
Review entitlements before rollout. Conditional Access generally requires Entra ID P1. Risk-based policies require Entra ID Protection capabilities associated with P2. PIM is available through Entra ID P2 or Entra ID Governance. Confirm the licences for Defender, Intune, Purview and audit capabilities separately.
Self-assessment
Score what you can demonstrate.
Use the total to support a discussion, never to certify that the firm is secure.
| Score | Evidence level |
|---|---|
| 1 | Not in place, or not known |
| 2 | Partly configured, with known exceptions |
| 3 | Configured for most users; ownership incomplete |
| 4 | Configured, owned and reviewed |
| 5 | Configured, owned and tested in an exercise |
Not yet assessed
Score all six areas to see the suggested planning priority.
| Total / 30 | Suggested action |
|---|---|
| 25–30 | Validate the evidence, continue exercising and review regularly. |
| 18–24 | Close gaps, starting with the lowest-scoring areas and critical dependencies. |
| Below 18 | Start a prioritised remediation plan, with access, admin rights and response ownership first. |
A score of 1 or 2 in employee access, administrator permissions or incident-response ownership takes priority whatever the total. These are indicative thresholds from this guide, not a Microsoft certification. Use Microsoft Secure Score as supporting configuration evidence alongside ownership and exercise records.
Prepare the first-hour playbook
Six response actions. Named owners.
Write actual names and trusted contact routes into the playbook. Containment and evidence collection need coordination; several actions may run in parallel. Session revocation and a password reset do not replace the investigation of persistence and data exposure.
Activate the response
Confirm the incident lead, deputy and a trusted communication route. Start a timed decision log.
Contain access
Authorised administrators block compromised access, revoke sessions and secure credentials using the approved playbook.
Preserve evidence
Collect relevant audit, sign-in and message evidence promptly. Record actions and respect retention and access limits.
Check persistence
Review suspicious forwarding, mailbox rules, delegated access, authentication methods and app consents.
Assess impact
Determine affected information, reporting duties and client communication decisions with the accountable owners.
Validate recovery
Restore access through an approved process, monitor for recurrence and close the identified control gaps.
Test the handover. An exercise should show who received the alert, who could take authorised action, what evidence was available and how the business made its decisions. Implementation alone does not establish 24/7 monitoring or response coverage.
UK · UAE · Singapore
Prepare for the obligations that apply to your firm.
Have the legal or data-protection owner confirm jurisdiction, controller or processor responsibilities, notification triggers and current deadlines. Record contractual, professional-body and insurer requirements alongside the applicable law. Preserve the evidence needed to explain the decision.
| Market | Planning reference | Readiness implication |
|---|---|---|
| United Kingdom | A notifiable personal data breach must be reported to the ICO without undue delay, and no later than 72 hours after awareness. | Prepare an evidence-based risk decision and document it, including decisions not to notify. |
| UAE federal regime | Identify the applicable PDPL provisions, current implementing requirements and any sector-specific rules. Do not assume DIFC or ADGM timelines apply. | Confirm the responsible regulator, trigger and current reporting process with the legal owner. |
| UAE — DIFC | Assess the applicable notification trigger; the DIFC guidance uses “as soon as practicable in the circumstances”. | Prepare a prompt assessment and reporting route rather than assuming a fixed 72-hour allowance. |
| UAE — ADGM | For a reportable breach, notify without undue delay and, where feasible, within 72 hours after awareness. | Document the risk assessment, timing and reasons for any delay. |
| Singapore | Once assessed as notifiable, notify the PDPC as soon as practicable, no later than three calendar days after the day of that assessment. | Assess expeditiously. Do not treat the assessment period as permission to defer investigation. |
This is a planning summary. The appointed legal or data-protection owner must confirm the requirements for the organisation and incident.
Common questions
Microsoft 365 security for professional services.
What is a Microsoft 365 security readiness assessment?
It reviews access, administrative privileges, devices, email, information sharing and response ownership. The output is a prioritised gap list, linked to business exposure and supported by configuration and operating evidence.
Is multifactor authentication enough on its own?
No. Combine appropriate authentication methods with device and access policies, monitoring and a tested response. Plan emergency-access safeguards separately so a blocking policy does not lock out the administrators needed for recovery.
Which Microsoft 365 licences do we need?
Review the exact controls and users in scope. Conditional Access generally requires Entra ID P1; risk-based policies require P2 capabilities. PIM can be licensed through Entra ID P2 or Entra ID Governance. Defender, Intune, Purview and audit features have their own requirements. Confirm current entitlements before recommending additions.
How quickly must we report a breach?
The trigger and deadline depend on the applicable jurisdiction, role and incident. Use the country notes above to prepare the decision process, then have the responsible legal or data-protection owner confirm the current requirements, client contracts and insurer conditions.
Can a small firm use this checklist without a security team?
Yes. Assign a business incident lead, an authorised IT contact and a deputy, then test the handover. Agree the IT partner’s investigation coverage, response authority and escalation commitments rather than assuming continuous monitoring is included.
Does a high readiness score guarantee protection?
No. This guide’s scorecard is a discussion aid, not a security certification or a prediction of breach risk. Evidence of control coverage, named ownership and tested response matters more than the total.
Should sharing be reviewed before enabling Copilot?
Yes. Review workspace permissions, external sharing, information classification and intended use cases before rollout. Copilot readiness should include a permissions review and validation of the information-protection controls available in your environment.
Source references
Ground the plan in current guidance.
Reviewed for this guide on 29 October 2026. Recheck product entitlements, published guidance and legal requirements when planning an engagement.
The MetaDynamic approach
Turn the checklist into an owned plan.
MetaDynamic helps assess exposure, prioritise Microsoft security controls and validate implementation with clear operational responsibilities. Share your current licences, team size, operating markets and security priorities to define a practical first phase.
Explore MetaDynamic Microsoft Cybersecurity Services
Contact MetaDynamic to discuss your project.