Microsoft 365 email security: the Exchange Online security audit
What we check to secure Exchange Online: authentication of your domains, anti-phishing, Defender for Office 365, legacy access, forwarding and traceability.
Why audit email first
Email is the attackers' favourite channel: phishing to steal credentials, spoofing your domain to deceive your customers, payment fraud, malicious attachments. A single compromised mailbox is often enough to move on to the rest of the tenant.
That is why Exchange Online accounts for 45% of the protection score calculated by Sentinel Audit365, ahead of Entra ID (37%). Poorly protected email lowers the overall score, even if everything else is in order: the details are explained in our calculation method.
SPF, DKIM and DMARC: stop your domain being spoofed
These three DNS records prevent a third party from sending emails while pretending to be you.
- SPF (Sender Policy Framework) lists the servers allowed to send emails for your domain. There must be only one, and it must end with
-all, or with~allif DMARC is set to reject. - DKIM (DomainKeys Identified Mail) signs each outgoing email. In Microsoft 365, it is enabled domain by domain, with two records,
selector1andselector2. - DMARC tells recipients what to do with an email that fails SPF and DKIM: let it through (
p=none), quarantine it or reject it (p=reject). It also lets you receive reports on who is sending on your behalf.
The goal is DMARC at p=reject on every domain, including those that do not send email. The audit checks all three records for every domain in the tenant CIS 2.1.8CIS 2.1.9CIS 2.1.10ANSSI n°24.
These three points are public: anyone can read them. Test your domain for free, in a few seconds.
Anti-phishing, anti-spam and anti-malware
Exchange Online Protection filters every incoming email. But its policies still have to be set at the right level. Among other things, the audit checks:
- Anti-phishing sensitivity threshold CIS 2.1.7ANSSI n°24
- Impersonation protection for targeted users and domains CIS 2.1.7
- Mailbox intelligence and safety tips CIS 2.1.7
- Filter for dangerous attachment types CIS 2.1.2ANSSI n°24
- Administrator notifications (internal malware, outbound spam) CIS 2.1.3CIS 2.1.6
- Allowed IP address and domain lists that bypass filtering CIS 2.1.12CIS 2.1.14
Defender for Office 365: Safe Links and Safe Attachments
Microsoft Defender for Office 365, included in Microsoft 365 Business Premium, adds two valuable protections: Safe Links checks links at the time of click, and Safe Attachments opens attachments in an isolated environment before delivering them.
- Presence and scope of Safe Links rules (email, Office, Teams) CIS 2.1.1ANSSI n°24
- URL scanning at click time, click-through blocked after the warning CIS 2.1.1
- Safe Attachments action and protection for SharePoint, OneDrive and Teams CIS 2.1.4CIS 2.1.5
- Priority account protection CIS 2.4.1
Legacy authentication, SMTP AUTH and mailbox access
Older protocols (IMAP, POP3, SMTP AUTH, EWS with basic authentication) do not support MFA. They remain the favourite target of password spraying attacks.
- Modern authentication enabled CIS 6.5.1ANSSI n°21
- SMTP AUTH disabled at organisation level CIS 6.5.4ANSSI n°21
- Accounts still using legacy authentication CIS 5.2.2.3
- Direct sign-in to shared mailboxes CIS 1.2.2
- Third-party storage providers in Outlook on the web CIS 6.5.3
Forwarding and transport rules
A rule that automatically forwards a mailbox's emails to an external address is a classic after a compromise: the attacker reads everything, quietly. Transport rules that exempt certain domains from filtering, for their part, leave the door wide open to phishing.
- Automatic forwarding to external addresses CIS 6.2.1ANSSI n°24
- Transport rules with allow-listed domains CIS 6.2.2
- External email tagging in Outlook CIS 6.2.3
Logging and mailbox auditing
If an incident occurs, you need to be able to reconstruct what happened. The audit checks that logging is enabled everywhere and that no mailbox escapes it.
- Microsoft 365 unified audit log CIS 3.1.1ANSSI n°36
- Auditing enabled on all mailboxes CIS 6.1.1CIS 6.1.2
- Audit bypass on some mailboxes CIS 6.1.3
Quotas, shared mailboxes and distribution lists
On the governance side, the audit identifies mailboxes close to their quota (80% threshold), shared mailboxes that needlessly consume a licence, obsolete distribution lists and the retention period for deleted items. These points do not count towards the score, but they improve hygiene and costs.
Secure Exchange Online: where to start
- Publish SPF, DKIM and DMARC on all your domains, then move DMARC up to
p=reject. - Disable SMTP AUTH and legacy authentication, handling exceptions one by one.
- Block automatic forwarding to external addresses.
- Strengthen anti-phishing: protection against impersonation of your executives and your domains.
- Check logging, so you are ready on the day you need to investigate.
Frequently asked questions about email security
What is DMARC?
DMARC is a DNS record that tells receiving servers what to do with an email that claims to come from your domain but fails the SPF and DKIM checks: let it through (p=none), quarantine it (p=quarantine) or reject it (p=reject).
Is a DMARC p=none policy enough?
No. p=none is for monitoring: spoofing attempts are reported but not blocked. It is a starting step, which should move to p=quarantine and then p=reject once legitimate senders have been identified.
Should SMTP AUTH be disabled in Exchange Online?
Yes, at organisation level, unless there is a justified application need (printer, business application). SMTP AUTH relies on a password and does not support MFA. Exceptions are handled mailbox by mailbox.
Is Defender for Office 365 necessary?
It provides Safe Links and Safe Attachments, which scan links at the time of click and attachments before delivery. It is included in Microsoft 365 Business Premium and available as an add-on. The audit checks its configuration when it is present, and reports its absence otherwise.
Ready to see what your tenant is hiding? First report within 48 h.
A subscription, an automatic audit every month, nothing to launch. A first conversation is enough to get started. We work in New Caledonia, French Polynesia and France.
- New Caledonia+687 24 23 22
- French Polynesia+689 40 42 90 79
- France+33 2 96 47 48 05