How to check your Microsoft 365 security: a practical 28-point checklist for UK firms

Direct answer: Out of the box, Microsoft 365 is configured so a new business can get up and running quickly — not to withstand modern invoice fraud or pass a Cyber Essentials assessment. Across the small and mid-sized professional firms we audit in Cardiff and South Wales, the average unhardened Microsoft 365 tenant passes only 6 to 10 of the 28 core security controls below. Here is how to check all 28 in your own tenant — or have us run the check for you, read-only and free of charge.

Why Microsoft Secure Score only tells half the story

If you open the Microsoft Defender portal (security.microsoft.com), you will see a percentage called Microsoft Secure Score. While it is a useful rough barometer, relying on Secure Score alone leaves blind spots that attackers and Cyber Essentials assessors look for straight away:

• It doesn’t know who still works for you: Secure Score won’t flag two former contractors or a leaver whose account still has Sign-in allowed enabled six months later.
• It doesn’t flag everyday Global Admins: If a company director or partner reads their daily email using an account that also holds Global Administrator privileges, that is an automatic fail under Cyber Essentials — and turns a single phished link into a total firm lockout.
• It doesn’t inspect your SharePoint folder permissions before you turn on AI: If your Management & HR or Partner Accounts SharePoint site accidentally includes the default Everyone except external users group, any staff member using Microsoft 365 Copilot can surface confidential payroll or partner drawings in seconds.

The 28-point Microsoft 365 security checklist

Whether you check these yourself in Entra ID, Exchange Online and SharePoint Admin, or ask your IT provider to confirm them, we group the 28 essential controls into six clear areas. Controls marked Cyber Essentials are mandatory blockers for passing Cyber Essentials v3.3.

1. Identity & Sign-In (7 checks)

Check these in the Microsoft Entra admin center (entra.microsoft.com) under Protection → Authentication methods and Conditional Access:

2. Privileged & Admin Access (4 checks)

Check these under Entra ID → Roles & administrators → Global Administrator:

3. Email & Anti-Phishing (8 checks)

Check these in the Exchange admin center (admin.exchange.microsoft.com), the Defender portal, and your public domain DNS records (or run our DMARC & email security check):

4. SharePoint, OneDrive & OAuth App Consent (4 checks)

Check these in Entra ID → Enterprise applications → Consent and permissions and the SharePoint admin center:

5. Audit Logging, Backup & UK Data Residency (3 checks)

6. Devices & Endpoint Compliance (2 checks)

Why this matters for law firms, accountants and commercial insurance

If you run a solicitors’ practice or an accountancy firm, your professional indemnity and cyber insurance renewal questionnaires now routinely ask four specific questions:

1. Is multi-factor authentication enforced on all remote access and cloud email accounts?
2. Are privileged administrator accounts separated from everyday email accounts?
3. Do you maintain offline or immutable backups separate from your primary cloud tenant?
4. Are SPF, DKIM and DMARC enforced to prevent email spoofing?

Ticking "Yes" on an insurance proposal form when two former contractors still have un-MFA'd mailboxes or Global Admin rights are attached to a partner's daily email can give an underwriter grounds to dispute a claim. Running a read-only 28-point check gives you documented proof of where you stand — and a clear list of fixes that usually take a day or two to complete.

Common questions