Skip to main content

Pro audit program · v1.0

Microsoft 365 Security Posture

Audit your M365 tenant for the controls that actually matter: identity, mail flow, sharing, audit logging and admin separation.

  • General target area
  • CIS M365 framework
  • 7 controls in this program
  • Cyentrix Cyentrix Trusted Author
Sign in to run → Back to library

About this program

Audit your M365 tenant for the controls that actually matter: identity, mail flow, sharing, audit logging and admin separation.

Risks addressed

  • High External users invited without governance
  • High Inbox rules created by attacker to silently exfiltrate
  • High Audit logs not retained long enough for investigation

Controls (7)

  1. MFA enforced on every user (incl. admins)

    Critical

    Multi-factor authentication (MFA) is required for every user account with access to organizational systems, including administrators, standard users, service accounts with interactive login capability, and privileged accounts. This control enforces at least two independent authentication factors (something you know, something…

    How to test + evidence

    Testing procedure: Pull MFA enrolment report; 100% of active users + 100% on Privileged Roles.

    Evidence to collect: M365 MFA report.

  2. Security defaults / CA baseline applied

    High

    Security defaults and Conditional Access (CA) baseline policies enforce minimum authentication and authorization standards across identity platforms, typically within Microsoft Entra ID (Azure AD) or similar identity providers. These defaults automatically enable multi-factor authentication for privileged accounts, block legacy authentication…

    How to test + evidence

    Testing procedure: Either Security Defaults on, or CA baseline policies enforced.

    Evidence to collect: CA / Security Defaults config.

  3. External sharing scoped to known domains

    High

    This control restricts external file and folder sharing in collaboration platforms (e.g., Microsoft 365, Google Workspace, Box) to pre-approved domains only, preventing users from sharing sensitive data with arbitrary external email addresses. Organizations maintain an allowlist of trusted partner and…

    How to test + evidence

    Testing procedure: SharePoint / OneDrive sharing restricted to allowed domain list.

    Evidence to collect: Sharing policy export.

  4. Block legacy authentication

    High

    This control enforces the disabling or blocking of legacy authentication protocols (such as basic authentication, SMTP AUTH, POP3, IMAP without modern authentication, and legacy Office protocols) that do not support multi-factor authentication or modern security features. Legacy authentication protocols transmit…

    How to test + evidence

    Testing procedure: Legacy auth protocols (POP/IMAP/SMTP basic) disabled tenant-wide.

    Evidence to collect: CA policy export.

  5. Mailbox auditing enabled

    High

    Mailbox auditing is a logging capability that records access and modification events for user mailboxes, including mailbox sign-ins, message reads, moves, deletions, and permission changes. When enabled, it generates audit logs capturing who accessed what content, when, and from which…

    How to test + evidence

    Testing procedure: Mailbox audit logging on for all mailboxes; retention >= 90 days.

    Evidence to collect: Audit log config.

  6. Unified audit log enabled + streamed to SIEM

    High

    This control ensures that the unified audit log in Microsoft 365 (or equivalent cloud tenant logging service) is enabled and configured to capture user, admin, and system activities across all services. Logs must be streamed in near real-time to a…

    How to test + evidence

    Testing procedure: Tenant unified audit log on; logs forwarded to SIEM.

    Evidence to collect: SIEM source + sample query.

  7. Restrict who can register apps + consent to apps

    Medium

    This control restricts which users or groups within an identity platform (typically Azure AD / Entra ID, Google Workspace, or Okta) can register new OAuth/OIDC applications and grant consent for applications to access organizational resources. It prevents unauthorized users from…

    How to test + evidence

    Testing procedure: Only admins (or named delegate) can register / consent. User consent disabled.

    Evidence to collect: Tenant settings screenshot.