How secure is your Microsoft 365 tenant?
Work through 22 yes or no questions about identity, devices, email, data and monitoring. For every gap you find, the checklist gives the exact Microsoft setting to change and where to find it, in the order to fix them. Built for small and mid-sized businesses by IT Rapid Support in Vaughan.
Print it and fill it in by hand, or work through it on screen. Want a second opinion on your answers? Call or send us a message and we will go through them with you.
The 22 checks
This page does not connect to your tenant, does not ask for an email address and has nothing to submit. Work through it on screen or print it.
Answer what you know. Not sure is a fine answer. Each check: Yes / No / Not sure. Questions you skip count as Not sure.
| # | Area | Check |
|---|---|---|
1 | Identity | Is every user required to sign in with multifactor authentication, not just offered it? |
2 | Identity | Do administrator accounts have to complete multifactor authentication every time they sign in? |
3 | Identity | Is legacy authentication (older IMAP, POP3 and SMTP clients and pre-modern Office apps) blocked? |
4 | Identity | Is the Global Administrator role held by fewer than five people, each using a separate admin account rather than their everyday email account? |
5 | Identity | Do you have two cloud-only emergency access ("break glass") accounts, stored safely and excluded from your sign-in policies? |
6 | Identity | Are staff prevented from granting third-party apps access to company data on their own? |
7 | Identity | If you have Entra ID P2 (for example Microsoft 365 E5), are sign-in risk and user risk policies turned on in Conditional Access? |
8 | Devices | Is every company laptop and desktop onboarded to Microsoft Defender for Business or Defender for Endpoint? |
9 | Devices | Do you have Intune device compliance policies, with devices that have no policy marked as not compliant? |
10 | Devices | Does Conditional Access require a compliant device before anyone opens company email and files? |
11 | Devices | Are Windows laptops encrypted with BitLocker through a managed policy, with recovery keys held by the company? |
12 | Email | Is automatic forwarding of mail to outside addresses turned off? |
13 | Email | Are the Standard or Strict preset security policies applied to your users? |
14 | Email | Is DKIM signing turned on for every custom domain you send mail from? |
15 | Email | Does your domain publish SPF and a DMARC record set to quarantine or reject, not only p=none? |
16 | Data | Is SharePoint and OneDrive external sharing limited to people who sign in, rather than Anyone links that work for whoever holds the link? |
17 | Data | If you do allow Anyone links, do they expire automatically and default to view only? |
18 | Data | Do you have at least one Microsoft Purview data loss prevention policy, for example for credit card numbers or sensitive files shared outside? |
19 | Monitoring | Is the unified audit log recording user and admin activity? |
20 | Monitoring | Has anyone confirmed that mailbox auditing on by default has not been turned off in your tenant? |
21 | Monitoring | Do Microsoft 365 security alerts (suspicious outbound mail, restricted users, risky sign-ins) go to a mailbox someone reads every day? |
22 | Monitoring | Does someone review Microsoft Secure Score and its recommended actions at least monthly? |
Reading your answers
Treat every No or Not sure as a gap. The weights (3 to 10 per check) show which gaps attackers use most, so fix the heaviest first, using the Microsoft setting and Microsoft Learn page listed for each.
What this check is, and what it is not
This is a self-assessment. It scores the answers you give, not your actual tenant, and it cannot see a setting you believe is on but is not. Microsoft Secure Score in the Microsoft Defender portal is the authoritative view, because Microsoft calculates it from your real configuration across identity, devices, apps and data. Reading that score automatically would require an administrator in your organization to grant consent to a connected app. This page deliberately does not do that, so there is nothing to approve and nothing to revoke.
Every setting name and menu path on this page was checked against Microsoft Learn in September 2026, and each recommendation links to the Microsoft page it came from.
Want a reviewer to do this? See our Microsoft 365 security assessment.
Related help
- Microsoft 365 managed services for businesses that want these settings looked after every month.
- Microsoft 365 and Azure migration if you are moving in and want the tenant set up securely from day one.
- Email spoofing check to read your domain’s SPF, DKIM and DMARC records in seconds.
- SPF, DKIM and DMARC explained and how to stop phishing attacks.
- Microsoft 365 security best practices for 2026.
- Contact IT Rapid Support with a question about any check.
Frequently asked questions
No. It is a self-assessment: you answer the questions yourself and nothing is sent to IT Rapid Support or anyone else. Reading your real Secure Score would need an administrator in your tenant to grant consent to an app, and this page deliberately does not ask for that.
Each of the 22 checks carries a weight from 3 to 10 based on how often that gap is how attackers get in, for a total of 121 points. A No or a Not sure should be treated as missing until someone checks, because a control you cannot confirm is not protecting you.
No. Microsoft Secure Score is calculated by Microsoft from your actual tenant settings and covers far more recommendations. This checklist picks the controls that matter most for a small or mid-sized business and explains each one in plain words, with the exact setting to change. Use both: this page to understand the gaps, Secure Score to confirm them.
Security defaults need no extra licence. Conditional Access needs at least Microsoft Entra ID P1, and the sign-in risk and user risk policies need Entra ID P2. Device compliance and disk encryption policies need Intune. Safe Links, Safe Attachments and impersonation protection need Microsoft Defender for Office 365, which comes with Microsoft 365 E5 or as an add-on. Data loss prevention licensing varies by plan. Check your own plan before you buy anything new.
Work top down through the gaps. It is sorted by weight, with a definite No ahead of a Not sure at the same weight. For most businesses the first three are multifactor authentication for everyone, blocking legacy authentication and turning off automatic forwarding to outside addresses.
Yes. As part of an IT health check, an engineer can review these controls with you and give you a written list of findings that is yours to keep, whether or not you ever work with us.
Related.
- ServiceMicrosoft 365 Managed Services for Canadian BusinessesMicrosoft 365 needs active management after setup or migration.
- ServiceMicrosoft 365 Migration Services in Toronto and the GTAMicrosoft 365 migration services move your email, calendars, files and user accounts from an old server, Google Workspace or another tenant into Microsoft 365 on a…
- ToolEmail Spoofing Check for Canadian Business DomainsHow to check the three DNS records that stop someone sending email in your name: SPF, DKIM and DMARC, using free public lookup tools or a call with us.
- ArticleIs Your Company Email Easy to Spoof? SPF, DKIM & DMARC ExplainedMost small businesses have never checked whether criminals can send email as their domain. A plain-English guide to SPF, DKIM, and DMARC, and how to close the gap.
- ToolIT Health Check for Your BusinessA conversation about where your backups, security and Microsoft 365 setup actually stand, followed by a short written report on what we would fix first.
Want this handled for your business?
Tell us your users, devices and sites. We are staffed 24/7 and reply with next steps. Quotes are built from your environment, not a price list. Active incident? Call (289) 582-9930, 24/7.