AlphaSec · Free M365 Security Audit · Sample Traffic-Light Report
Automated Microsoft Graph and public DNS inspection across 28 security controls identified 8 Red (Action Required) findings, 14 Amber (Worth Hardening) findings, and 6 Green controls, including 4 Cyber Essentials v3.3 blockers.
Every Red finding below can be remediated without disrupting legitimate staff work. Estimated total engineering time: half a day.
Deploy Alphabyte's 6-Policy Conditional Access Baseline (Require MFA for All Users, Require Phishing-Resistant MFA for Admins, Block Legacy Auth, Block High-Risk Countries, Require Compliant Device for Finance/Partner data).
Create an Entra Named Location for 'United Kingdom & Ireland' and block sign-ins from all other countries unless a user is temporarily added to the `M365-Travel-Approved` security group.
Convert the 2 former locum mailboxes to Shared Mailboxes, set `AccountEnabled = false` on all 4 dormant accounts, and remove £49/month in wasted licences.
Reduce Global Administrators to 2 dedicated admin accounts + 2 emergency break-glass accounts. Remove Global Admin from the external web developer immediately.
Create separate unlicensed `admin-name@` accounts with no mailbox for administrative tasks, and strip all admin roles from daily email accounts.
Set `AutoForwardEnabled = Off` in Defender Outbound Spam Policy and set `AutoForwardEnabled = $false` on the default Exchange Remote Domain (`*`).
Once DKIM is enabled, update `_dmarc.severngatelegal.co.uk` to `v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc@severngatelegal.co.uk;` for 14 days, then advance to `p=reject`.
Switch Entra Enterprise Applications → User Consent Settings to 'Do not allow user consent' and enable the Admin Consent Request workflow so staff can request approval with 1 click.
Any single mailbox without MFA can be compromised via password spraying or credential stuffing in minutes — and is an automatic fail under Cyber Essentials v3.3.
Migrate from legacy per-user MFA to Entra ID Conditional Access (or Security Defaults), require registration within 24 hours for the remaining 3 users, and revoke active refresh tokens.
Legacy authentication protocols cannot enforce MFA and are the #1 route attackers use to bypass MFA prompts.
Keep legacy auth blocked tenant-wide; migrate the single multifunction copier from SMTP Basic Auth to Microsoft Graph High Volume Email or an isolated SendGrid relay.
SMS codes are vulnerable to SIM-swap and real-time Adversary-in-the-Middle (EvilProxy) phishing links.
Enforce Microsoft Authenticator Push with Number Matching + Geo-Location display for all staff, register FIDO2 Passkeys for Partners/Admins, and disable SMS MFA once Authenticator enrolment is 100%.
Because Security Defaults is off and no baseline Conditional Access policy covers all users, new accounts created in the tenant have zero automatic MFA or risk enforcement.
Deploy Alphabyte's 6-Policy Conditional Access Baseline (Require MFA for All Users, Require Phishing-Resistant MFA for Admins, Block Legacy Auth, Block High-Risk Countries, Require Compliant Device for Finance/Partner data).
Without a Named Location country block, automated botnets can continuously probe user passwords and trigger MFA fatigue prompts from overseas.
Create an Entra Named Location for 'United Kingdom & Ireland' and block sign-ins from all other countries unless a user is temporarily added to the `M365-Travel-Approved` security group.
NCSC and Cyber Essentials v3.3 explicitly advise against periodic forced password expiry because it drives staff to choose predictable incremental passwords (`Autumn2026!`).
Set passwords to never expire (`Set-MgDomain -PasswordValidityPeriodInDays 2147483647`) while enforcing MFA + Entra Smart Lockout (10 attempts / 60s lockout) and custom banned password words (`Severn`, `Cardiff`, `Legal`).
Unmonitored ex-staff or contractor accounts are a prime target for quiet takeover and data exfiltration.
Convert the 2 former locum mailboxes to Shared Mailboxes, set `AccountEnabled = false` on all 4 dormant accounts, and remove £49/month in wasted licences.
If any one of those 6 accounts is phished, the attacker has total control to delete all OneDrive/SharePoint data, disable MFA, and lock the firm out.
Reduce Global Administrators to 2 dedicated admin accounts + 2 emergency break-glass accounts. Remove Global Admin from the external web developer immediately.
Using an account that receives external emails and browses the web while holding Global Admin rights is an automatic fail under Cyber Essentials v3.3.
Create separate unlicensed `admin-name@` accounts with no mailbox for administrative tasks, and strip all admin roles from daily email accounts.
If a Conditional Access policy misconfiguration or DNS/federation outage occurs, administrators can lock themselves out of the tenant completely.
Create two cloud-only `bg-admin-01@` and `bg-admin-02@*.onmicrosoft.com` accounts secured with 24+ character random passwords stored in dual-custody physical/1Password vaults and FIDO2 hardware keys, excluded from Conditional Access.
An unattended laptop or stolen session cookie keeps full Entra/Exchange Admin Center privileges alive for months.
Configure a Conditional Access Session Control policy requiring Sign-In Frequency of 8 hours and `Persistent Browser Session = Never` for all directory admin roles.
In Business Email Compromise (BEC) attacks, criminals set up a hidden auto-forward rule so they can monitor conveyancing/invoice threads for weeks even after a password reset.
Set `AutoForwardEnabled = Off` in Defender Outbound Spam Policy and set `AutoForwardEnabled = $false` on the default Exchange Remote Domain (`*`).
Forwarding firm financial emails to personal consumer mailboxes leaks client data outside M365 governance and mimics BEC persistence rules.
Review and remove the `@btinternet.com` forwarding rule with the staff member, and enable Defender alerting on creation of new inbox forwarding/redirect rules.
Missing or overly permissive SPF records allow external servers to spoof emails from your domain.
No change required — SPF is properly hardened with `-all`.
Without custom-domain DKIM signing, DMARC alignment fails when emails are forwarded and major receivers (Gmail, Yahoo, enterprise gateways) downgrade deliverability.
Publish the `selector1` and `selector2` CNAME records in DNS and enable 2048-bit DKIM signing in the Defender Portal for `severngatelegal.co.uk`.
`p=none` is monitoring-only: anyone on the internet can send a fake payment-redirection or invoice email pretending to be `@severngatelegal.co.uk` and receiving mail servers are instructed not to block it.
Once DKIM is enabled, update `_dmarc.severngatelegal.co.uk` to `v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc@severngatelegal.co.uk;` for 14 days, then advance to `p=reject`.
Without external tagging, staff cannot easily spot display-name spoofing where an attacker sets their display name to a Managing Partner's name.
Keep `Set-ExternalInOutlook -Enabled $true` active and add the firm's trusted sister domains to the allow list if needed.
Shared mailboxes should only be accessed via delegated permissions from a named user's MFA-protected account. Leaving direct sign-in enabled creates backdoor accounts.
Set `AccountEnabled = $false` on all 7 shared mailboxes in Entra ID (this does not affect delegated mailbox access or email delivery).
Modern phishing emails use delayed weaponized links (clean at delivery, malicious 20 minutes later when clicked) and display-name impersonation of Senior Partners asking Accounts to pay an urgent supplier.
Enable the Defender 'Standard/Strict Preset Security Policy' with User Impersonation protection for all Partners + Accounts staff (either via Business Premium upgrade or a £1.60/user Defender for Office 365 Plan 1 add-on).
Consent phishing ('Illicit Consent Grant') tricks a user into clicking 'Accept' on a fake Microsoft 365 app prompt, giving attackers persistent API access to read emails and files without needing the user's password or MFA.
Switch Entra Enterprise Applications → User Consent Settings to 'Do not allow user consent' and enable the Admin Consent Request workflow so staff can request approval with 1 click.
An 'Anyone with the link' URL created 2 years ago remains open forever and can be forwarded to unintended recipients without authentication.
Change default sharing link type from 'Anyone' to 'Specific People (Authenticated OTP)', or enforce a mandatory 14-day expiry and view-only default on all external links.
Any junior member of staff — or Microsoft 365 Copilot if enabled — can search and surface confidential HR, payroll, and partner financial documents.
Remove `Everyone except external users` from the 3 restricted SharePoint sites and lock access down to role-based security groups (`SG-Partners`, `SG-HR-Finance`).
Unreviewed guest accounts accumulate over time and retain access to shared Teams channels and folders.
Keep guest invitations restricted to Member/Admin roles and review the 6 external guests every 6 months.
Without Unified Audit Logging enabled prior to an incident, forensic investigators cannot see which emails or files were accessed during a breach (and ICO reporting becomes far harder).
No change required — 180-day Unified Audit Log is active and recording.
Microsoft's Shared Responsibility Model covers infrastructure uptime, not accidental mass deletion, malicious insider purging, or ransomware encryption synced via OneDrive.
Enable immutable daily cloud-to-cloud backup for all 26 Exchange mailboxes, OneDrive accounts, and SharePoint sites (~£3/user/month).
Misconfigured tenant regions can store UK client personal data outside the UK/EEA in breach of client engagement terms.
Record the UK data-at-rest verification screenshot in the firm's GDPR / Law Society compliance folder.
If a laptop is lost or stolen on a train and you cannot prove via central escrow that BitLocker encryption was active at the time of loss, the ICO treats it as a reportable data breach.
Escrow all 26 BitLocker recovery keys into Entra ID immediately (supported even on Entra-joined devices) and consider full Intune compliance policies for remote wipe.
Client files downloaded onto an unmanaged home computer infected with info-stealer malware bypass all office firewall controls.
Block full file downloads on unmanaged browser sessions (allow web-only preview) and enforce Outlook Mobile App Protection policies on iOS/Android phones.
We connect in read-only mode, test all 28 controls across your tenant and public DNS records, and provide your complete Red, Amber & Green audit sheet with exact recommendations and actions.
Cardiff office: 029 2240 4615 · Direct mobile: 07885 972 512 · ross@alphabyte.it