Sentinel Audit365 by SF2i
Request an audit FR
Menu

Secure Microsoft 365: the 5 domains to audit

Identity, email, collaboration, documents and files: what to check to secure the Microsoft 365 tenant of a small or medium-sized business, domain by domain, with CIS and ANSSI references.

Why Microsoft 365 security is not automatic

Microsoft 365 relies on a shared responsibility model. Microsoft protects its data centres, its network and its applications. How your tenant is configured, who can sign in, how, with which rights, and what can be shared externally, is up to you.

Yet the default settings favour ease of use. A tenant created a few years ago keeps legacy settings, and every new feature arrives with its own options. Without regular checks, the gap widens between the actual configuration and the recommendations of the frameworks.

That is what a Microsoft 365 security audit measures: whether each setting complies with the CIS Microsoft 365, ANSSI and Microsoft Security Baseline frameworks. Sentinel Audit365 checks more than 180 of them, grouped into five domains.

Entra ID: lock down identities

Entra ID (formerly Azure Active Directory) manages accounts, authentication and Conditional Access. A compromised account gives access to email, files and sometimes to the administration of the tenant: it is the first target of attackers. In our model, Entra ID weighs 37% of the overall score, and the audit runs more than 50 checks on it.

  • MFA for all accounts, administrators first CIS 5.2.2.1CIS 5.2.2.2ANSSI n°13
  • Legacy authentication blocked through Conditional Access CIS 5.2.2.3ANSSI n°21
  • Number of global administrators (2 to 5 recommended) CIS 1.1.3ANSSI n°9
  • Cloud-only administrator accounts, not synchronised CIS 1.1.1ANSSI n°9
  • Emergency access (break-glass) accounts CIS 1.1.2
  • Weak MFA methods (SMS, voice call) CIS 5.2.3.5ANSSI n°13
  • User consent to third-party applications CIS 5.1.5.1
  • Guest account role and invitation rights CIS 5.1.6.2CIS 5.1.6.3

The audit also analyses sign-ins by country and the applications registered in the tenant, to identify those with overly broad permissions or that are no longer used. If a feature is not included in your licences, the report says so.

Exchange Online: protect email

Email remains the most used entry point: phishing, domain spoofing, malicious attachments, CEO fraud. Exchange Online weighs 45% of the score, and the audit devotes more than 70 checks to it.

  • SPF, DKIM and DMARC for every domain CIS 2.1.8 to 2.1.10ANSSI n°24
  • Anti-phishing, anti-spam and anti-malware policies CIS 2.1.7CIS 2.1.2
  • Safe Links and Safe Attachments (Defender for Office 365) CIS 2.1.1CIS 2.1.4
  • SMTP AUTH disabled at organisation level CIS 6.5.4ANSSI n°21
  • Automatic forwarding to external addresses CIS 6.2.1
  • Mailbox auditing CIS 6.1.1ANSSI n°36

These checks are detailed on the Microsoft 365 email security page. You can also test SPF, DKIM and DMARC for free on your domain.

Teams: control external access

Teams concentrates meetings, conversations and sharing with the outside world. Poorly configured, it lets strangers join a meeting unchecked, or lets third-party applications access conversations. Teams weighs 6% of the score.

  • Anonymous participants starting meetings CIS 8.5.2
  • Control given to external participants CIS 8.5.7
  • Default presenter role CIS 8.5.6
  • Allowed third-party applications CIS 8.4.1
  • Sending emails to channels CIS 8.1.2
  • Teams with no owner or inactive for more than 6 months Governance

SharePoint and OneDrive: control sharing

Your documents live in SharePoint and OneDrive. The key question: how far can they travel outside the organisation? An "Anyone" link created by default can expose a sensitive file to anybody. Together, SharePoint and OneDrive weigh 12% of the score.

  • Allowed level of external sharing CIS 7.2.3
  • Default link type and permission CIS 7.2.7CIS 7.2.11
  • Resharing by guests CIS 7.2.5
  • Guest access expiry and reauthentication CIS 7.2.9CIS 7.2.10
  • Legacy authentication protocols CIS 7.2.1ANSSI n°21
  • OneDrive sync restricted to company devices CIS 7.3.2

Governance and licences: the hidden debt

Some gaps are not vulnerabilities, but they are costly or make security harder: licences assigned to inactive accounts, vacant seats, expired subscriptions, guests holding licences, abandoned sites and teams. These optimisation checks do not count towards the score, but the report puts a figure on the possible savings, in CFP francs (XPF) or in euros.

Governance also covers traceability: unified audit log enabled, log retention period, data location.

The 10 settings to check first

If you could only start with ten items, this is the order we recommend. It follows the impact on risk, not ease of implementation.

  1. Enforce MFA on all accounts, starting with administrators.
  2. Block legacy authentication (IMAP, POP3, SMTP AUTH, etc.), which bypasses MFA.
  3. Limit global administrators to 2 to 5 named, cloud-only accounts.
  4. Set up two emergency access accounts, excluded from Conditional Access and monitored.
  5. Publish SPF, DKIM and DMARC for every sending domain, with a DMARC policy that ends at reject.
  6. Disable SMTP AUTH at organisation level, unless there is a justified application need.
  7. Block automatic forwarding of mailboxes to external addresses.
  8. Govern consent to third-party applications with an admin consent workflow.
  9. Restrict external sharing in SharePoint and OneDrive, with expiry of guest access.
  10. Enable and retain the unified audit log, so you can investigate if an incident occurs.

Why a monthly audit rather than a one-off audit

A one-off audit gives you a snapshot. The following month, a temporary administrator is added, a forwarding rule is created, a site is shared with a partner: the snapshot is already out of date.

Sentinel Audit365 runs all the checks again every month. You see what has changed, what has improved and what has regressed, with a score history. New gaps are detected within weeks, not years.

What Sentinel Audit365 does. SF2i sets up Sentinel Audit365, which then runs on its own every month, read-only, on a platform hosted by SF2i, and produces a prioritised report with the concrete actions to take. Find out what the report contains and how the score is calculated.

Ready to see what your tenant is hiding? First report within 48 h.

A subscription, an automatic audit every month, nothing to launch. A first conversation is enough to get started. We work in New Caledonia, French Polynesia and France.

Request an audit Test my email security