Read-only by design, and verifiable by anyone.

Admin work should happen on dedicated cloud-only accounts — no mailbox attached (no inbox to phish), no on-prem sync (no AD compromise = no tenant compromise). This is CIS M365 control 1.1.1.

Microsoft Authenticator with number matching, FIDO2 keys, and passkeys are phishing-resistant. SMS and voice are not — they're vulnerable to SIM swap and adversary-in-the-middle proxies (Evilginx, EvilProxy).

Microsoft recommends two cloud-only Global Administrator accounts excluded from Conditional Access, so a bad policy, an expired federation certificate or an MFA outage cannot lock every administrator out of the tenant at once. This is a resilience control: without it, recovery from a lockout runs through Microsoft support and takes days.

Administrative roles must always require MFA — they're the highest-value target in the tenant. A dedicated admin-targeted CA policy is best practice even when a tenant-wide MFA policy exists, for defense in depth.

Device code flow lets an attacker phish a working access token without a fake login page: the victim types a real code into a real Microsoft sign-in page, completes MFA themselves, and the resulting token goes to the attacker. Almost no organisation needs the flow, and Conditional Access can switch it off.

A Conditional Access policy only protects the people it applies to. Exclusion lists start as two break-glass accounts and grow — an exempt group here, a service account there — until the MFA policy the tenant believes is universal quietly isn't. This check reports who is exempt from the policies that enforce MFA and block legacy authentication.

Legacy auth protocols (POP, IMAP, SMTP AUTH, ActiveSync basic auth) cannot enforce MFA. Even with MFA registered, attackers password-spray legacy auth endpoints to bypass it entirely.

A baseline 'require MFA for all users on all apps' Conditional Access policy is the single most effective security control for an M365 tenant. Without one (and without Security Defaults), any user can sign in with just a password.

A Report-only Conditional Access policy is evaluated on every sign-in and then ignored — it writes a verdict to the log and lets the sign-in through regardless. Report-only is the correct place to START a policy, but a policy left there for months is protection the tenant believes it has and does not.

With Entra ID P2 you get Identity Protection — Microsoft scores every sign-in for risk (impossible travel, anonymous IP, leaked credentials, etc.). A CA policy that requires MFA or blocks high-risk sign-ins turns those signals into active defenses.

Microsoft recommends 2-4 Global Administrators per tenant. Too few = no recovery if one is locked out; too many = oversized blast radius from a single compromised credential.

If 'everyone' or 'all members' can invite guests, any compromised user can create an attacker-controlled guest account, then use it as a persistence mechanism even after the original account's password is reset.

Microsoft Entra ID Protection matches your users against credential dumps found on the dark web and in law-enforcement seizures. An account flagged here has a password an attacker can already look up — the most direct route into a tenant there is, and one that no amount of perimeter hardening closes.

Admin accounts with 'Password never expires' set will keep the same password forever — including any that may have been exposed in a third-party breach. Combined with no MFA, this is a credential-stuffing target.

Lists the privileged changes made in your tenant recently — apps granted access, new app secrets, and accounts given admin roles. These are the first things an attacker does after getting in, because each one survives a password reset. They are also normal administration, so the point is to confirm each one was you.

Tenants must have either Security Defaults enabled OR Conditional Access policies enforcing MFA. A tenant with neither is wide open to password spray and credential stuffing.

Admin accounts that haven't been used in 90+ days are likely former employees or unused service accounts. They hold privilege but receive no ongoing scrutiny — a near-perfect target for a patient attacker.

Guest accounts that haven't signed in for 90+ days are likely abandoned but still have access to whatever they were invited to. They're a common lateral-movement vector after a third-party breach.

Defender for Office's anti-phishing policy uses ML to detect spoofed and impersonating senders. By default impersonation protection of executives is OFF — every tenant should add their executives explicitly.

IPs in the connection filter allow list bypass Defender for Office's spam/phish/malware scanning entirely. Large ranges, stale entries, or Microsoft's bulk-sender 'SafeList' create permanent backdoors past your email security.

Anti-malware policy blocks common malicious file types regardless of content (executables, scripts). Zero-hour Auto Purge (ZAP) retroactively removes mail from inboxes when Defender later identifies it as malware or phish — critical when threat signatures arrive minutes after delivery.

Safe Attachments detonates inbound attachments in a sandbox before delivery. Without it, malicious documents reach users immediately, relying on the recipient's endpoint AV — which often runs minutes after the user has already opened the file.

Safe Links rewrites URLs in email, Teams chats, and Office apps so Microsoft can check them at click time (after attackers' detonation evasion has fired). Default Safe Links policies are NOT enabled out of the box on most tenants — admins must explicitly create or accept the preset.

Each allow entry in the Tenant Allow/Block List bypasses Defender's spam, phish, and malware verdicts for the matching sender/URL/file. Permanent (no-expiration) and forgotten old entries become backdoors past your phishing protection.

DKIM cryptographically signs outbound mail so receivers can verify it wasn't altered or spoofed. Without DKIM, DMARC enforcement is effectively weaker since SPF alone is fragile under forwarding.

DMARC tells receiving mail servers what to do with email that fails SPF and DKIM. Without it (or with p=none), attackers can spoof your domain with impunity — a primary BEC technique.

Outlook's 'External' tag marks every inbound message from outside the tenant. It's a simple but highly effective UX defense against CEO impersonation and fake-IT phishing — users learn to scrutinize external messages that claim to be internal.

MTA-STS tells sending servers to require TLS when delivering mail to your domain, preventing on-path attackers from stripping encryption. TLS-RPT surfaces when delivery TLS is failing or being downgraded.

Inbox rules are the most common BEC persistence mechanism. Attackers create forwarding rules to exfiltrate mail in real time, or delete/move rules keyed on words like 'phish' or 'security' to hide their tracks. Microsoft's own incident reports consistently rank this as the #1 post-compromise action.

Publishing the MTA-STS DNS record is only half of it — sending servers also fetch a policy file over HTTPS. If that file is missing or malformed, they ignore your policy entirely and mail can still be downgraded to an unencrypted connection.

If the domain's MX record points somewhere other than M365, mail isn't flowing through Exchange Online Protection — meaning Defender for Office, anti-phish, Safe Links, and the rest of M365's mail filtering aren't actually inspecting inbound mail. Often unintentional after a migration.

If users can auto-forward email externally via inbox rules, an attacker who phishes one account silently exfiltrates ALL inbound mail to their own address — surviving password resets and session terminations.

Without sensible outbound rate limits, a compromised account can send tens of thousands of phishing emails (to internal users, to your customers) before Microsoft's tenant-level limits kick in. Tight per-user limits AND BlockUser action when the limit is hit contain the blast radius of any single account compromise.

SPF authorizes which mail servers may send for your domain. Missing, soft-fail (~all), or too-many-lookups SPF records let spoofed mail through.

By default, ANY user from ANY external Microsoft Entra tenant can be added as a guest in your tenant. Combined with permissive Teams settings, this lets attackers in any tenant DM and share files with your users — bypassing email security entirely.

B2B Direct Connect lets users from other tenants access your data without becoming guests in your directory. This bypasses guest-account lifecycle controls, access reviews, and many CA policies that target guests specifically. Should be enabled only with vetted partner tenants.

OneDrive external sharing is controlled by the tenant-wide external sharing setting and, per Microsoft, can only be equal to or more restrictive than SharePoint — never more permissive. This informational check surfaces OneDrive's effective ceiling; the tenant-wide level itself is graded by the SharePoint external sharing check. (The OneDrive-specific override is not exposed by the read-only Graph API.)

When SharePoint allows 'Anyone' links, any user can generate an unauthenticated URL that grants access to a file or folder — no sign-in required. These links leak via screenshots, forwarded emails, and search engines.

If Anyone links don't expire, a single leaked URL remains exploitable indefinitely. Forcing a max lifetime (≤30 days is industry standard) limits the damage window when a link inevitably ends up somewhere unintended.

When users click Share without changing options, the link defaults to this permission level. Edit-by-default means recipients can modify or delete content — including invoices, contracts, customer lists.

If guests can re-share, content fans out to people you never invited or audited. Each re-share is invisible to you and survives even if the original guest's access is revoked.

SharePoint has its own legacy-auth toggle separate from the tenant-wide Conditional Access block. When enabled, certain SharePoint-specific basic-auth and ACS-based flows bypass modern identity controls.

Without this restriction, users can sync OneDrive (and SharePoint libraries) to ANY device including personal laptops. A user keeping a synced copy on a personal device circumvents BitLocker, MDM remote wipe, and conditional access — all your tenant controls only apply while the data is in M365.

If anonymous users can join Teams meetings AND auto-bypass the lobby, attackers can silently join scheduled meetings using only the meeting link — which routinely leaks via calendar invites, support tickets, and screenshots. They can then record audio/video and read chat.

If users can install custom (sideloaded) Teams apps, an attacker who phishes a user can deliver an OAuth-grant attack via Teams — bypassing email security and the typical consent-attack UX users are trained on.

If enabled, any person with a free Microsoft account (Teams Personal) can DM and call your users. This is a primary Teams phishing vector — attackers spoof internal user display names and message employees with credential-harvesting links.

If you've restricted user consent (recommended), users need a way to request admin approval for legitimate apps. Without an admin consent workflow, users either go without the app or find workarounds.

App registration secrets that expire silently cause outages; secrets with multi-year validity are credential-stuffing magnets if leaked. Both worth knowing about.

OAuth grants users or admins consented on apps' behalf. A dangerous delegated scope (mail, files, directory) granted tenant-wide — or self-consented by phished users — gives the app silent, MFA-proof access to that data.

A redirect URI is the address Entra delivers sign-in tokens to. Wildcards, plain http, and leftover localhost entries widen that address from one host you control to a range someone else might occupy — turning your own app registration into a token delivery service for an attacker.

Enterprise apps granted broad Graph permissions (Mail.ReadWrite, Directory.ReadWrite.All) can read or modify ANY user's data in the tenant. Each such app is a single-point-of-compromise.

Passwords or certificates added to a service principal (not its app registration) let anyone holding them authenticate as the app. On a third-party app this is the classic persistent backdoor.

An app registration nobody has used in months, that still holds application permissions or a live secret, is a standing credential with no owner watching it. Nobody notices when it starts being used, and nobody would miss it if it were deleted — which is exactly what makes it attractive to an attacker.

Corporate Windows devices should be covered by Defender for Endpoint/Business (EDR, not just signature AV) with tamper protection enabled so malware can't switch Defender off. This reports the tenant's Defender licensing capability and per-device tamper-protection state — the signals readable via Microsoft Graph. (Per-device MDE onboarding status isn't exposed by Graph; it lives in the Defender portal's machines API.)

Defender XDR surfaces alerts from MDE, MDO, MDI, and MDA in a unified queue. High-severity alerts in 'New' or 'InProgress' status for >7 days are a strong indicator of either an unstaffed security function or an in-progress incident that's stalled.

App Protection Policies secure corp data inside Outlook/Teams/OneDrive on personal devices without enrolling the device. Without MAM, every BYOD employee phone is an unmanaged endpoint storing corp mail and files.

Without BitLocker, a stolen or lost Windows device exposes all cached data — OneDrive sync content, cached Outlook PSTs, saved attachments, Teams cache — to anyone who removes the disk and reads it. Encryption is the foundational endpoint control.

Compliance policies + enrolled devices only matter if a CA policy actually requires compliance before granting access. Without this grant, an attacker on a non-Intune device can sign in with valid credentials and access corp resources just as easily as a compliant managed device.

Without a compliance policy for a given OS, every device on that OS is in 'unknown' compliance state. CA policies that 'require compliant device' silently let those devices through (or block them all, depending on the rule design) because there's no compliance evaluation.

Devices in 'noncompliant', 'conflict', or 'error' state have failed their compliance policy. With a CA policy requiring compliant devices, they're blocked from corp resources. Without one, they're still accessing data despite failing the controls you've defined.

Activity Log alerts notify on high-risk operations (role assignment changes, NSG edits, security-solution deletions) in near-realtime. Catching these as they happen beats finding them in a quarterly review.

Without an Activity Log → Log Analytics diagnostic setting, control-plane events (role changes, NSG edits, resource deletes) only retain 90 days natively. Most security investigations need year-plus retention.

WAF disabled, or in Detection mode, doesn't block attacks. Production App Gateways should run WAF in Prevention mode (blocks + logs).

App Services serving the public internet without 'Easy Auth' rely on in-app authentication, which is harder to audit and bypassable through forgotten endpoints. Easy Auth integrates Entra SSO without code changes.

App Services should have httpsOnly=true so HTTP traffic is auto-redirected. Avoids credentials and cookies traveling in cleartext during the initial request.

App Service siteConfig.minTlsVersion below 1.2 lets clients negotiate TLS 1.0 / 1.1 and breaks PCI-DSS / FedRAMP / most enterprise baselines.

Every virtual machine should be protected by Azure Backup with a healthy, recent recovery point. Unbacked-up VMs are unrecoverable after ransomware, accidental deletion, or a failed change — the restore simply does not exist.

Recovery Services and Backup vaults should have soft delete enabled so that backup data deleted by a compromised or mistaken administrator is retained and recoverable rather than destroyed immediately.

DDoS Protection Standard mitigates volumetric attacks against public IPs. Only VNets containing public-IP attached workloads are evaluated — pure internal VNets don't need it.

Auto-provisioning deploys the Log Analytics agent / MDE extension to new VMs automatically. Without it, new VMs silently fall out of MDE coverage as they're created.

Defender for Cloud's per-workload plans (Servers, Storage, SQL, etc.) provide threat-detection signal on each workload type. Subscriptions on the Free tier only get configuration recommendations — no runtime threat protection.

Per-subscription roll-up of the top 5 unhealthy high-severity Defender for Cloud recommendations. Informational — drives the 'what Defender thinks' dashboard panel. Never fails on its own.

Per-resource diagnostic settings forward data-plane logs (storage requests, KV accesses, SQL audits, NSG flow logs) to Log Analytics. Coverage <80% across critical resource types indicates substantial blind spots for forensic investigation.

Front Door WAF is opt-in per frontend. Frontends without an attached WAF policy are unprotected against OWASP attacks and bot traffic.

Custom roles whose actions include `*`, `*/*`, or `Microsoft.Authorization/*` grant near-Owner privileges and bypass least-privilege. Microsoft.Authorization/* in particular is a privilege-escalation primitive (holder can grant themselves Owner).

External B2B guest accounts with RBAC role assignments expand the trust boundary. Their authentication posture is controlled by their home tenant. Prefer Entra access reviews or per-resource sharing.

Managed identities eliminate stored credentials for service-to-service auth. Coverage <50% suggests significant credential-rotation debt; <80% is a hygiene target worth working toward.

Role assignments referencing deleted Entra principals can't be exploited but clutter audits and signal missed access-review hygiene. Microsoft surfaces these without a resolvable principalDisplayName / principalUpn.

PIM lets users hold privileged Azure roles as eligible rather than active, requesting just-in-time activation. Substantially reduces standing-access blast radius. Requires Entra ID P2.

Service principals holding Owner or Contributor at subscription level have authority across every resource in the subscription. Scope them down to the specific resource groups they need.

Service principal secrets and certificates should be rotated yearly or sooner. Long-lived credentials accumulate exposure surface (logs, configs, source control).

Microsoft recommends ≤2 Owners per subscription. Each Owner is a tenant-wide compromise risk; reducing the count reduces the blast radius of a phished credential.

Key Vaults with publicNetworkAccess=Enabled expose the management endpoint to the internet. Disable and configure private endpoints for the applications that need vault access.

RBAC authorization integrates Key Vault with PIM, conditional access, and central RBAC auditing. Legacy Access Policies are vault-local and can't be governed centrally.

Soft delete retains deleted vaults/keys for 90 days; purge protection blocks force-delete during that window. Together they protect against scenarios where attackers delete keys to lock out the owner.

Workspace retention <90 days truncates data before most breach investigation windows. CIS recommends ≥90 days; PCI-DSS and HIPAA require at least 1 year of accessible logs.

MCSB is Microsoft's canonical Azure security baseline. Assigning it at the subscription or management-group root gives continuous compliance scoring in Defender for Cloud.

MySQL Single Server: sslEnforcement should be Enabled. Flexible Server: require_secure_transport server parameter should be ON. Without these, clients can connect in plaintext.

Database ports (1433, 3306, 5432, 27017, 6379) open to *, Internet, or 0.0.0.0/0 expose databases to credential-stuffing, unauthenticated access (Redis default), and data exfiltration.

Any-protocol, any-source, any-port Allow rules defeat the principle of least connectivity and provide lateral-movement paths even when not directly internet-exposed.

TCP/3389 open to *, Internet, or 0.0.0.0/0 exposes Windows RDP to the internet. Public RDP is a primary initial-access vector for ransomware.

TCP/22 open to *, Internet, or 0.0.0.0/0 lets the world brute-force SSH. Use Bastion / VPN / IP allowlists instead.

Managed disks in the Unattached state are billed at full provisioned capacity while serving no workload, and still contain a complete readable copy of whatever the deleted VM held.

Network interfaces attached to no VM, public IPs attached to no resource, and network security groups attached to no subnet or NIC. Billed or reserved for nothing, and — in the NSG case — usually a rule set someone believes is in force.

Postgres Single Server: sslEnforcement should be Enabled. Flexible Server: require_secure_transport server parameter should be ON. Without these, clients can connect in plaintext.

Catalogs every public IP in scope and what resource it's attached to. Never fails — purely informational. These IPs are also fed into the external attack surface (Shodan/crt.sh) as seed inputs.

SQL Servers without an AAD admin force clients onto local SQL auth, which doesn't support MFA / conditional access / centralized governance.

Firewall rules permitting 0.0.0.0 → 255.255.255.255 (all IPv4) or 0.0.0.0 → 0.0.0.0 (all Azure services) expose the SQL Server to anything on the internet or the entire Azure fleet.

TDE encrypts data at rest with negligible perf impact. On by default for new databases; older ones may still have it off.

Defender for SQL detects SQL injection attempts, brute force, and anomalous access patterns. Requires Defender for Cloud's SQL plan.

A container with publicAccess set to Blob or Container is anonymously readable from the internet. Worse than the account-level toggle: this represents an explicit per-container intent to make data public.

Blob soft delete protects against accidental and malicious deletion. Microsoft recommends ≥7-day retention; longer is better for ransomware recovery.

networkAcls.defaultAction = Allow means the storage firewall is open to any network. Set Deny with explicit allowlists or private endpoints.

minimumTlsVersion below TLS 1.2 lets clients negotiate weaker cipher suites and breaks PCI-DSS / FedRAMP / most enterprise compliance baselines.

Private endpoints let storage accounts be reached only over the VNet, eliminating public network exposure. Coverage <50% indicates substantial public-surface storage; ≥80% is a hygiene target worth pursuing.

When allowBlobPublicAccess is true, individual containers can opt into anonymous internet access. Disabling at the account level enforces the secure default across every container.

Storage accounts with supportsHttpsTrafficOnly=false accept plaintext HTTP requests. Forces all REST API calls to use TLS when enabled.

VM disks should be encrypted via encryptionAtHost (preferred) or Azure Disk Encryption (legacy). Default platform encryption protects only the underlying storage; per-VM controls protect against escape scenarios.

Defender for Endpoint provides EDR on the guest OS. Coverage below 80% indicates onboarding debt; below 50% means significant attack surface is unmonitored. Defender for Cloud auto-provisioning handles most.

VMs with a directly attached public IP expose the host to the internet. Prefer Azure Bastion (for admin access) or App Gateway / LB with WAF (for app traffic) rather than direct public IP exposure.

Logs are useful only if someone reads them. Microsoft Defender ships high-value alerts (new forwarding rule, admin role elevation, suspicious forwarding activity) that go to nobody by default unless an admin sets email recipients. Untriaged alerts are equivalent to no detection.

Mailbox auditing is the foundation for ALL post-incident investigation of an account compromise. Without it, you cannot tell what an attacker did inside a mailbox — when they signed in, what mail they read, what rules they created, what they deleted. Critical actions like UpdateInboxRules must be in the default owner audit set.

Microsoft sends service-health incidents, security advisories, and license/billing notifications to addresses on file in the tenant. If these default to the original signup contact (often a personal email of a long-departed admin), important messages — including Microsoft's own breach notifications to your tenant — get lost.

Roll-up of every domain, IP, and exposed service Tenant Strike discovered from the outside-in view. Verify each entry corresponds to a known business system — anything unrecognized is a shadow-IT or decommissioned-but-still-on asset that warrants investigation.

Shodan flags each service with CVEs that match its detected product and version. Any CVE on a public-facing service is exploitable by the same automated scanners that found it — patch windows have shrunk to days, not weeks.

DNSSEC signs your DNS records so resolvers can detect tampering; CAA records restrict which certificate authorities may issue certificates for your domain. Both limit attacks that impersonate your domain.

An expired domain takes email and your website offline at the same time, and lets someone else register it and receive your mail. A registrar transfer lock is a free setting that blocks one leg of a domain hijack.

Web admin interfaces (phpMyAdmin, cPanel, Jenkins, Kibana, vCenter, etc.) should be accessible only from a trusted network or behind an identity-aware proxy. Public exposure invites credential stuffing and exploitation of the steady stream of CVEs these products ship.

Databases should always be private — behind a VPC/VNET, accessible only from the application tier. Public exposure represents either a misconfigured cloud instance or a legacy server that was never moved behind a firewall. Many database engines (Mongo, ES, Redis) ship with no authentication by default.

Remote-management protocols (RDP, SMB, WinRM, VNC), hosting control panels (cPanel, WHM, Webmin) and cleartext file transfer (FTP) should be reachable only through a VPN or zero-trust gateway. Direct internet exposure of these is the leading initial-access vector for ransomware and remote-access breaches.

Attackers register domains that resemble yours (character swaps, extra words, alternate TLDs) to send phishing and business-email-compromise mail that looks like it's from you. A lookalike with an MX record is infrastructure ready to send.

abuse.ch publishes blocklists of hostnames serving malware (URLhaus) and botnet command-and-control IPs (Feodo Tracker). If one of your own assets is listed, it has been compromised and is being used against others — and it will also get your mail and traffic blocked.

Security response headers (HSTS, X-Frame-Options / CSP, X-Content-Type-Options) harden your public web login pages against SSL-stripping, clickjacking, and MIME-confusion attacks.

A small text file at /.well-known/security.txt tells anyone who finds a security problem in your systems exactly how to reach you. Without one, reports go to a general inbox and often get missed.

Shodan labels indexed hosts with tags such as compromised, malware, database, or ics. A flag on one of your own hosts is an independent signal that it's breached or exposing something it shouldn't.

A subdomain whose CNAME points at a deleted cloud resource (S3 bucket, Azure web app, GitHub Pages site, etc.) can be re-registered by anyone, who then serves content — with valid TLS — on your own domain. Prime phishing and cookie-theft infrastructure.

TLS certificates that are expired, near-expiry, self-signed, or signed with weak algorithms cause user-facing errors or outages and erode trust.