Skip to content

Microsoft 365 configuration hardening security checks

Vendor-recommended secure defaults, patch levels and housekeeping settings that drift as tenants grow and admins change.

On Microsoft 365, Black Cat runs 50 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Microsoft 365 connector needs.

Checks (50)

severity: low Self-Service Subscriptions Enabled fix difficulty: easy #

Disable self-service trial and subscription purchases in M365

  1. Navigate to Microsoft 365 Admin Center > Settings > Org Settings > User Owned Apps and Services
  2. Disable self-service trial and subscription purchases
  3. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Risk-Based Consent Not Configured fix difficulty: medium #

Enable M365 risk-based step-up consent to block risky app consent requests

  1. Navigate to Microsoft Entra Admin Center > Enterprise Applications > Consent and Permissions
  2. Enable Risk-Based Step-Up Consent
  3. Configure the consent risk policy to block risky app consent requests
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-28.1 HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low Group Naming Convention Not Configured fix difficulty: easy #

Configure a group naming prefix or suffix policy in M365 Entra ID

  1. Navigate to Microsoft Entra Admin Center > Groups > Naming Policy
  2. Configure a group naming prefix/suffix policy
  3. Add blocked words if needed
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Customer Lockbox Not Enabled fix difficulty: medium #

Enable M365 Customer Lockbox to require admin approval before Microsoft accesses data

  1. Navigate to Microsoft 365 Admin Center > Settings > Org Settings > Security & Privacy
  2. Enable Customer Lockbox
  3. Assign Lockbox approver roles to designated administrators
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low Copilot License Assigned fix difficulty: easy #

Review M365 Copilot license assignments to ensure they align with data governance policies

  1. Navigate to Microsoft 365 Admin Center > Billing > Licenses
  2. Review users assigned Copilot licenses
  3. Verify each assignment aligns with business requirements and data governance policies

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-28.1 HIPAA (SaaS Security) HIPAA-314.a NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Unverified Domain fix difficulty: medium #

Complete domain verification for M365 unverified domains by adding the required DNS records

  1. Navigate to Microsoft 365 Admin Center > Settings > Domains
  2. Select the unverified domain
  3. Follow the verification steps to add the required DNS records
  4. Click Verify after DNS propagation completes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Unverified Federated Domain fix difficulty: hard #

Verify the federated M365 domain before establishing federation trust

  1. Navigate to Microsoft 365 Admin Center > Settings > Domains
  2. Select the unverified federated domain
  3. Complete domain verification before configuring federation
  4. Re-establish federation trust after verification

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium SPF Record Missing fix difficulty: easy #

Add an SPF TXT record to the M365 domain DNS to prevent email spoofing

  1. Navigate to your domain's DNS management portal
  2. 'Add a TXT record with the SPF value: v=spf1 include:spf.protection.outlook.com -all'
  3. Verify the record in Microsoft 365 Admin Center > Settings > Domains

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium DMARC Record Missing fix difficulty: medium #

Add a DMARC TXT record to the M365 domain DNS to prevent email spoofing

  1. Navigate to your domain's DNS management portal
  2. 'Add a TXT record for _dmarc with policy: v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com'
  3. Start with p=none for monitoring, then progress to p=quarantine or p=reject
  4. Verify the record propagation

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium DKIM Record Missing fix difficulty: medium #

Add DKIM CNAME records (selector1/selector2) for the M365 custom domain and enable DKIM signing in Defender for Office 365

  1. Navigate to your domain's DNS management portal
  2. Add the two DKIM CNAME records (selector1._domainkey and selector2._domainkey) provided by Microsoft 365
  3. Navigate to Microsoft Defender portal > Email & Collaboration > Policies & Rules > Threat Policies > Email Authentication Settings > DKIM
  4. Select the domain and toggle Sign messages for this domain with DKIM signatures to Enabled
  5. Verify the records propagate

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Multi-Tenant App Without Verified Publisher fix difficulty: hard #

Verify the publisher of multi-tenant M365 apps or restrict consent to verified publishers

  1. Navigate to Microsoft Entra Admin Center > App Registrations
  2. Select the multi-tenant app without a verified publisher
  3. Follow the publisher verification process in the Partner Center
  4. If not your app, consider restricting consent to verified publishers only

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-28.1 HIPAA (SaaS Security) HIPAA-314.a NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high SMTP Auth Not Disabled Globally fix difficulty: medium #

Disable SMTP client authentication globally in M365 Exchange Online

  1. Connect to Exchange Online PowerShell
  2. Run Set-TransportConfig -SmtpClientAuthenticationDisabled $true
  3. Verify with Get-TransportConfig | Select SmtpClientAuthenticationDisabled

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium External Recipient Mail Tips Disabled fix difficulty: easy #

Enable external recipient mail tips in M365 to warn users before sending to external addresses

  1. Connect to Exchange Online PowerShell
  2. Run Set-OrganizationConfig -MailTipsExternalRecipientsTipsEnabled $true
  3. Verify with Get-OrganizationConfig | Select MailTipsExternalRecipientsTipsEnabled

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a5 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low Mail Tips Not Fully Enabled fix difficulty: easy #

Enable all mail tip types in M365 Exchange Online including large audience thresholds

  1. Connect to Exchange Online PowerShell
  2. 'Enable all mail tips: MailTipsAllTipsEnabled, MailTipsGroupMetricsEnabled, MailTipsLargeAudienceThreshold'
  3. Run Set-OrganizationConfig with appropriate parameters
  4. Verify with Get-OrganizationConfig

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a5 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Mailbox SMTP Auth Not Disabled fix difficulty: easy #

Disable SMTP client authentication on M365 individual mailboxes that do not require it

  1. Connect to Exchange Online PowerShell
  2. Run Set-CASMailbox -Identity <user> -SmtpClientAuthenticationDisabled $true
  3. Verify with Get-CASMailbox | Select SmtpClientAuthenticationDisabled

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high OWA Clickjacking Protection Not Set fix difficulty: easy #

Configure X-Frame-Options SAMEORIGIN in M365 OWA to prevent clickjacking attacks

  1. Connect to Exchange Online PowerShell
  2. Run Set-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default -AllowedOrganizationAccountsForClickjacking @()
  3. Ensure X-Frame-Options is set to SAMEORIGIN
  4. Verify with Get-OwaMailboxPolicy

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium ActiveSync Integration Enabled for OWA fix difficulty: easy #

Disable ActiveSync integration in M365 OWA to reduce attack surface

  1. Connect to Exchange Online PowerShell
  2. Run Set-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default -ActiveSyncIntegrationEnabled $false
  3. Verify with Get-OwaMailboxPolicy | Select ActiveSyncIntegrationEnabled

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low On-Send Add-ins Enabled in OWA fix difficulty: easy #

Disable on-send add-ins in M365 OWA mailbox policy to prevent unauthorized processing

  1. Connect to Exchange Online PowerShell
  2. Run Set-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default -OnSendAddinsEnabled $false
  3. Verify with Get-OwaMailboxPolicy | Select OnSendAddinsEnabled

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium No File Types Blocked in OWA fix difficulty: easy #

Configure M365 OWA to block dangerous file types including .exe, .bat, .cmd, .vbs, and .ps1

  1. Connect to Exchange Online PowerShell
  2. 'Configure blocked file types: Set-OwaMailboxPolicy -BlockedFileTypes with common malicious extensions'
  3. 'Include at least: .exe, .bat, .cmd, .vbs, .js, .ps1, .msi'
  4. Verify with Get-OwaMailboxPolicy | Select BlockedFileTypes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium No MIME Types Blocked in OWA fix difficulty: easy #

Configure M365 OWA to block dangerous MIME types including executable application types

  1. Connect to Exchange Online PowerShell
  2. 'Configure blocked MIME types: Set-OwaMailboxPolicy -BlockedMimeTypes with dangerous types'
  3. 'Include at least: application/x-msdownload, application/x-msdos-program'
  4. Verify with Get-OwaMailboxPolicy | Select BlockedMimeTypes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Unknown File Types Not Blocked fix difficulty: easy #

Configure M365 OWA to block unknown file and MIME types instead of allowing them

  1. Connect to Exchange Online PowerShell
  2. Run Set-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default -ActionForUnknownFileAndMIMETypes Block
  3. Verify with Get-OwaMailboxPolicy | Select ActionForUnknownFileAndMIMETypes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Transport Rule Includes BCC fix difficulty: easy #

Review and remove M365 transport rules that include BCC to external recipients

  1. Navigate to Exchange Admin Center > Mail Flow > Rules
  2. Identify transport rules that include BCC to external recipients
  3. Review and modify or remove the BCC action if not business-justified
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Transport Rule Processes External Sender fix difficulty: medium #

Restrict M365 transport rules that process external sender addresses to internal senders only

  1. Navigate to Exchange Admin Center > Mail Flow > Rules
  2. Identify transport rules processing external sender addresses
  3. Review the rule logic and restrict scope to internal senders if appropriate
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Transport Rule Deletes Messages fix difficulty: medium #

Replace message-deleting M365 transport rules with quarantine or redirect actions

  1. Navigate to Exchange Admin Center > Mail Flow > Rules
  2. Identify transport rules that delete messages
  3. Replace the delete action with quarantine or redirect to a review mailbox
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low Transport Rule Disabled fix difficulty: easy #

Remove or re-enable disabled M365 transport rules to reduce configuration confusion

  1. Navigate to Exchange Admin Center > Mail Flow > Rules
  2. Identify disabled transport rules
  3. Either re-enable or remove disabled rules to reduce confusion
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Remote Domain Trusted Inbound Enabled fix difficulty: easy #

Disable trusted inbound mail setting for the M365 default remote domain

  1. Connect to Exchange Online PowerShell
  2. Run Set-RemoteDomain -Identity Default -TrustedMailInboundEnabled $false
  3. Verify with Get-RemoteDomain | Select TrustedMailInboundEnabled

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Remote Domain Trusted Outbound Enabled fix difficulty: easy #

Disable trusted outbound mail setting for the M365 default remote domain

  1. Connect to Exchange Online PowerShell
  2. Run Set-RemoteDomain -Identity Default -TrustedMailOutboundEnabled $false
  3. Verify with Get-RemoteDomain | Select TrustedMailOutboundEnabled

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low Remote Domain Auto-Reply Enabled fix difficulty: easy #

Disable auto-reply to external domains in M365 remote domain settings

  1. Connect to Exchange Online PowerShell
  2. Run Set-RemoteDomain -Identity Default -AutoReplyEnabled $false
  3. Verify with Get-RemoteDomain | Select AutoReplyEnabled

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low Remote Domain Delivery Reports Enabled fix difficulty: easy #

Disable external delivery reports in M365 remote domain settings

  1. Connect to Exchange Online PowerShell
  2. Run Set-RemoteDomain -Identity Default -DeliveryReportEnabled $false
  3. Verify with Get-RemoteDomain | Select DeliveryReportEnabled

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low Remote Domain NDR Enabled fix difficulty: easy #

Disable non-delivery reports to external domains in M365 remote domain settings

  1. Connect to Exchange Online PowerShell
  2. Run Set-RemoteDomain -Identity Default -NDREnabled $false
  3. Verify with Get-RemoteDomain | Select NDREnabled

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low Remote Domain TNEF Enabled fix difficulty: easy #

Disable TNEF encoding for M365 remote domain to improve compatibility and reduce attack surface

  1. Connect to Exchange Online PowerShell
  2. Run Set-RemoteDomain -Identity Default -TNEFEnabled $false
  3. Verify with Get-RemoteDomain | Select TNEFEnabled

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low Distribution List Hidden From GAL fix difficulty: easy #

Make hidden M365 distribution lists visible in the Global Address List

  1. Navigate to Exchange Admin Center > Recipients > Groups
  2. Select the distribution list hidden from GAL
  3. Edit general settings and uncheck Hide from Address Lists
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Mailbox Move Enabled for Org Relationships fix difficulty: easy #

Disable mailbox move for M365 organization relationships to prevent unauthorized migrations

  1. Connect to Exchange Online PowerShell
  2. Run Set-OrganizationRelationship -Identity <relationship> -MailboxMoveEnabled $false
  3. Verify with Get-OrganizationRelationship | Select MailboxMoveEnabled

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Common Attachment Types Filter Disabled fix difficulty: easy #

Enable the Common Attachment Types Filter in M365 Defender anti-malware policy

  1. Navigate to Microsoft 365 Defender > Policies > Anti-Malware
  2. Edit the default anti-malware policy
  3. Enable the Common Attachment Types Filter
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Common Attachment Types Missing fix difficulty: easy #

Add all recommended dangerous file types to the M365 Defender anti-malware block list

  1. Navigate to Microsoft 365 Defender > Policies > Anti-Malware
  2. Edit the default anti-malware policy
  3. Review and add all recommended dangerous file types to the block list
  4. Include .exe, .bat, .cmd, .vbs, .js, .ps1, .msi, .scr
  5. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Zero-Hour Auto Purge Disabled fix difficulty: easy #

Enable Zero-Hour Auto Purge in M365 Defender anti-malware, anti-spam, and anti-phishing policies

  1. Navigate to Microsoft 365 Defender > Policies > Anti-Malware
  2. Edit the policy and enable Zero-Hour Auto Purge (ZAP)
  3. Also enable ZAP in Anti-Spam and Anti-Phishing policies
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Admin Malware Notifications Disabled fix difficulty: easy #

Enable M365 Defender admin notifications for malware detections

  1. Navigate to Microsoft 365 Defender > Policies > Anti-Malware
  2. Edit the policy and enable admin notifications for malware detections
  3. Add the security team email address as the notification recipient
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-33.2 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low Blocked File Type Action Not Quarantine fix difficulty: easy #

Set M365 Defender blocked file type action to quarantine instead of delete

  1. Navigate to Microsoft 365 Defender > Policies > Anti-Malware
  2. Edit the policy
  3. Set the action for blocked file types to Quarantine
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Anti-Phishing Spoof Detection Weak fix difficulty: medium #

Configure M365 Defender anti-phishing policy to enable strict spoof intelligence and DMARC enforcement

  1. Navigate to Microsoft 365 Defender > Policies > Anti-Phishing
  2. Edit the default anti-phishing policy
  3. Enable Spoof Intelligence and set action to Quarantine
  4. Enable Mailbox Intelligence and Impersonation Protection
  5. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a5 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low Anti-Phishing First Contact Tip Disabled fix difficulty: easy #

Enable first contact safety tip in M365 Defender anti-phishing policies

  1. Navigate to Microsoft 365 Defender > Policies > Anti-Phishing
  2. Edit the default anti-phishing policy
  3. Enable Show First Contact Safety Tip
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a5 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Outbound Spam Thresholds Not Configured fix difficulty: easy #

Configure M365 Defender outbound spam thresholds to limit bulk email

  1. Navigate to Microsoft 365 Defender > Policies > Anti-Spam > Outbound
  2. Edit the outbound spam policy
  3. 'Configure recipient limits: per-hour, per-day, and external limits'
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Inbound Spam Bulk Threshold Too High fix difficulty: easy #

Lower the M365 Defender inbound spam bulk complaint level threshold to 6 or less

  1. Navigate to Microsoft 365 Defender > Policies > Anti-Spam > Inbound
  2. Edit the inbound spam policy
  3. Set the Bulk Complaint Level threshold to 5 or lower
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium SPF Hard Fail Not Enabled fix difficulty: easy #

Configure M365 Defender anti-spam to mark SPF hard fail messages as spam

  1. Navigate to Microsoft 365 Defender > Policies > Anti-Spam > Inbound
  2. Edit the inbound spam policy
  3. 'Enable SPF record: hard fail mark as spam'
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low High Confidence Spam Not Quarantined fix difficulty: easy #

Configure M365 Defender to quarantine high-confidence spam instead of delivering it

  1. Navigate to Microsoft 365 Defender > Policies > Anti-Spam > Inbound
  2. Edit the inbound spam policy
  3. Set High Confidence Spam action to Quarantine Message
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low Connection Filter Not Configured fix difficulty: easy #

Configure the M365 Defender connection filter IP allow/deny list to block known malicious senders

  1. Navigate to Microsoft 365 Defender > Policies > Anti-Spam > Connection Filter
  2. Configure the IP Allow and Block lists
  3. Add known malicious IPs to the block list
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low Outbound Spam Notification Disabled fix difficulty: easy #

Enable M365 Defender outbound spam notifications to alert security team of sending account issues

  1. Navigate to Microsoft 365 Defender > Policies > Anti-Spam > Outbound
  2. Edit the outbound spam policy
  3. Enable notification for suspicious outbound email and add admin email
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-33.2 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low Suspicious Outbound Copy Not Enabled fix difficulty: easy #

Enable suspicious outbound email copy in M365 Defender to monitor potential data exfiltration

  1. Navigate to Microsoft 365 Defender > Policies > Anti-Spam > Outbound
  2. Edit the outbound spam policy
  3. Enable Send a Copy of Suspicious Outbound Messages and configure a BCC address
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-33.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low Comprehensive Spam Marking Disabled fix difficulty: easy #

Enable all M365 Defender spam marking options for improved phishing and spoofing detection

  1. Navigate to Microsoft 365 Defender > Policies > Anti-Spam > Inbound
  2. Edit the inbound spam policy
  3. Enable all advanced spam marking options (image links, IP links, etc.)
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Sensitivity Labels Not Configured fix difficulty: hard #

Configure M365 sensitivity labels and publish them to classify and protect organizational data

  1. Navigate to Microsoft Purview Compliance Portal > Information Protection > Labels
  2. Create sensitivity labels (e.g., Public, Internal, Confidential, Highly Confidential)
  3. Publish labels via a label policy to all users
  4. Configure auto-labeling rules for sensitive content

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Copilot Inventory Degraded fix difficulty: medium #

This agent's inventory record is missing core fields (owner, authentication, orchestration, or channels); other Copilot policy findings for it may be incomplete until the record is complete

  1. Open Power Platform Admin Center > Copilot Studio
  2. Open the agent and confirm it is published with an assigned owner, authentication, orchestration, and at least one channel configured
  3. Re-run the scan and verify properties_incomplete is no longer set for this agent

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

More Microsoft 365 checks

The information on this page is provided for general informational purposes and is believed to be accurate as of its most recent update. Product names, logos, and trademarks are the property of their respective owners and are used for identification purposes only; their use does not imply any affiliation with or endorsement by those owners. Descriptions of third-party applications and of compliance frameworks are based on publicly available documentation and may change over time.

See these checks run on your stack

Start a free 14-day trial — no credit card required.

Start Free Trial