Microsoft 365 security guidance

GSO Recommendations

Browse our Guided Security Operations (GSO) recommendations for hardening Microsoft 365, then use Overe to see which risks apply to your environment. From Conditional Access and MFA to OAuth apps, guest users, forwarding rules, devices and Defender incidents, Overe helps turn guidance into evidence and action.

Run a free Microsoft 365 assessment No agents. No heavy setup. Clear results in minutes.

macOS Firewall and Gatekeeper

macOS includes two complementary security controls that are often left at their defaults or disabled in enterprise environments: the application firewall

macOS FileVault Encryption

FileVault encrypts the entire macOS startup disk using AES-XTS 128-bit encryption. Without it, anyone with physical access to a Mac — whether through

Windows Firewall Configuration

Windows Firewall blocks unsolicited inbound network connections at the host level. When it is disabled or misconfigured, devices become reachable on any

Windows Defender Protection

Windows Defender is Microsoft's built-in endpoint protection platform, and on most managed Windows fleets it is the primary defence against malware and

Windows Local Admin Control: Privilege Escalation and Credential Reuse Risk

Local administrator rights on a Windows device give the account holder the ability to install software, modify system settings, disable security tools

Windows LAPS Configuration: Local Administrator Password Reuse Risk

LAPS automatically manages and rotates the local administrator account password on Windows devices, storing the result in Entra ID or Active Directory

Windows Attack Surface Reduction: Macro, Script and Credential Theft Protection

Attack Surface Reduction rules are Microsoft Defender controls that block specific attack techniques commonly used in malware, ransomware and credential theft

Windows BitLocker Encryption: Lost or Stolen Device Data Exposure

BitLocker encrypts the contents of a Windows device's hard drive so that, without the correct decryption key, the data is unreadable to anyone with access

Set Anonymous Link Expiration in SharePoint: Long-Lived External Sharing Risk

Anonymous sharing links in SharePoint and OneDrive allow anyone with the link to access the shared content without signing in or being a member of the tenant

Require Token Binding Protection: Token Theft and Replay Protection

Microsoft Entra issues access tokens and refresh tokens after successful authentication. These tokens authorise access to Microsoft 365 services and cloud apps

Disable Persistent Browser Sessions: Long-Lived Session Exposure Risk

When a user signs into Microsoft 365 and stays signed in via a persistent browser session, their authentication token remains valid beyond the browser close

Require MFA to Register Security Information: MFA Reset and Registration Abuse Risk

Security information registration is the process by which users set up their MFA methods. In environments without a Conditional Access policy governing this

Block High-Risk Users: Active Identity Compromise Protection

Entra ID Protection assigns a user risk level based on the pattern of risk detections associated with that account, including leaked credentials and anomalous sign-ins

Block High-Risk Sign-Ins: Compromised Sign-In Protection

Microsoft Entra ID Protection uses machine learning across billions of sign-in events to assign a risk level to each authentication attempt in your tenant

Require MFA for Azure Management: Cloud Control Plane Protection

The Azure portal, CLI, and management APIs represent the control plane for your cloud infrastructure. An attacker with access can reconfigure or destroy it

Require MFA for Administrators: Privileged Account Takeover Protection

Admin accounts are the highest-value target in any Microsoft 365 environment. A compromised Global Admin can reconfigure the entire tenant in minutes

Enable Admin Approval for App Consent: Safer App Access Review

Disabling user OAuth consent is the right first step, but without a way for users to legitimately request app access you either block real work or push shadow IT

Disable User OAuth App Consent: Unreviewed Third-Party App Access Risk

By default, Microsoft 365 allows users to consent to third-party applications accessing their account data directly, without any administrator review

Disable Legacy Authentication: Older Sign-In Methods Bypassing Modern Protection

Legacy authentication refers to older sign-in protocols designed before modern MFA. These protocols have no way to challenge users for a second factor

Disable Device Code Flow: Device Code Phishing Protection

Device code flow is a Microsoft OAuth mechanism designed for devices without keyboards or browsers. Attackers exploit it to bypass MFA via phishing

Phishing URL Clicked

When a user clicks a known phishing URL that Microsoft's threat intelligence has identified as malicious, they have likely been exposed to credential theft

Transport Rule Changed

Transport rules in Exchange Online are server-side rules that apply to all email passing through your organisation's mail flow and can redirect or copy mail

Mailbox Audit Bypass

Exchange Online logs mailbox access events through mailbox auditing. When audit bypass is enabled, an account can access mailboxes without leaving any trace

User Created and Made Admin

When a new user account is created and immediately assigned an administrative role, it may indicate an attacker is establishing a backdoor account in the tenant

OAuth Phishing via First-Party Microsoft Apps

OAuth phishing tricks users into authorising malicious applications to access their Microsoft 365 data, granting persistent access without needing credentials

New Federated Domain Added

Federation in Microsoft Entra ID delegates authentication to an external identity provider. A new federated domain added without approval is a critical signal

Excessive Authentication Failures

A high volume of failed authentication attempts against one or more accounts is one of the most reliable indicators of an active credential attack in progress

Session Hijack via Unusual IP Change

Modern Microsoft 365 authentication issues tokens that allow users to stay signed in without re-entering credentials. Session hijack abuses these tokens

PST Export & eDiscovery Abuse

eDiscovery searches and PST exports allow large volumes of email data to be extracted into a portable file, creating a significant data exfiltration risk

Power Automate Flow Created: Automation Abuse & Data Exfiltration Risk

Power Automate is Microsoft's workflow automation platform integrated with Microsoft 365. It allows users to create flows connecting services and moving data

Files Shared Externally: Data Exposure via Anonymous Links & Guest Access

External file sharing via anonymous links or guest invitations is routine in Microsoft 365. It is also one of the most common routes for unintended data exposure

Anomalous Delete Sequence: Ransomware Preparation & Data Destruction Risk

Ransomware and destructive attacks frequently begin with large-scale deletion of files before encryption or exfiltration. Overe detects this sequence early

Suspicious Inbox Rules: Mail Hiding, Deletion & Persistence Risk

Inbox rules used to conceal activity hide incoming mail, delete replies, or move messages to obscure folders to prevent detection of an active compromise

Mailbox Delegation Risk: Unauthorised Access & Impersonation Exposure

Mailbox delegation permissions allow one user or account to access, read, and send email on behalf of another. Misconfigured delegation enables impersonation

Inactive Guest Users: Forgotten External Access Risk

Inactive guest users are external identities invited into the tenant for a specific project or engagement that have since gone dormant but retain access

Guest Users with Risky Access: External Identity Exposure Risk

Guest users are external identities invited into your Microsoft 365 tenant. When they hold risky permissions or stale access, they create an external attack surface

Break-Glass Accounts: Emergency Access Without Monitoring or Guardrails

Break-glass accounts exist to ensure administrators can recover access during a lockout. Without monitoring and guardrails, they are a standing security risk

Legacy Authentication Exposure: Older Protocols Bypassing Modern Sign-In Protection

Legacy authentication protocols do not support modern MFA challenges. Any account reachable via IMAP, POP, or SMTP AUTH can be compromised with credentials alone

Unprotected Admin Portals: Privileged Access Without Strong Controls

Admin portals are the control plane for your Microsoft 365 environment. Without strong access controls, a compromised admin account can reconfigure everything

Conditional Access Exclusions: Intended Exceptions Creating Long-Term Bypass Risk

Conditional Access exclusions are sometimes necessary but are one of the most common sources of long-term security drift in Microsoft 365 environments

Conditional Access MFA Bypass Paths: Users Can Access Without Expected MFA

Most Microsoft 365 environments have a Conditional Access policy that enforces MFA. But having a policy is not the same as having MFA enforced for every user

Intune Policy Coverage Gaps: Device Configuration & Compliance Blind Spots

Intune policies only protect the devices and users they are assigned to. When users or devices fall outside policy scope, gaps create unmanaged entry points

Devices Overview: Unmanaged & Stale Device Exposure Risk

Every device that accesses Microsoft 365 data is a potential entry point. Unmanaged, stale, or non-compliant devices bypass security controls silently

Open Defender Incidents: Active Threat Investigation & Response Risk

Microsoft Defender creates incidents when it detects correlated signals across identities, email, devices, and applications. Open incidents require investigation

Dormant Apps: Forgotten Application Access & Credential Exposure Risk

Every application registered in your Microsoft 365 tenant retains its permissions until explicitly removed. Dormant apps are a persistent and invisible risk

Apps with Admin Roles: Privileged Service Principal Abuse Risk

When an application is assigned a privileged Entra ID role such as Global Administrator, it can act with full tenant permissions without user interaction

Apps with Risky Permissions: OAuth Data Access & Persistence Risk

Every OAuth application connected to your Microsoft 365 tenant has been granted permissions to access data or perform actions on behalf of users. Review them

Risky Inbox Forwarding Rules: Data Exfiltration & Post-Compromise Persistence

Inbox forwarding rules are one of the most reliable post-compromise persistence techniques. Once created, they silently exfiltrate every incoming email

Dormant Users: Stale Account Access & Persistence Risk

Dormant user accounts are identities that have not signed in for an extended period but still hold access to Microsoft 365 resources and data

Users with Risky MFA Settings: Account Compromise & Lateral Movement Risk

User accounts with weak or missing MFA are consistently the entry point for business email compromise, ransomware delivery, and data theft in Microsoft 365

Admins with Risky MFA Settings: Privileged Account Takeover Risk

Admin accounts are the highest-value targets in Microsoft 365. When a privileged user has risky MFA settings, the entire tenant is exposed to takeover

External Email Forwarding Rules: Data Exfiltration & Persistence Risk

External email forwarding rules are a common technique used after account compromise to exfiltrate data and maintain persistence without detection