402InfoSec
Synthetic sampleMicrosoft 365 Security Review
A hypothetical small-tenant review showing how configuration evidence could inform risk decisions, owners, and a practical remediation sequence.
Review boundary
The tenant works, but too much recovery and administrative risk depends on a few people.
Under these assumptions, priorities would include administrator access, emergency recovery, MFA coverage, external sharing, and evidence ownership. The register illustrates three high-priority findings and four medium-priority findings; a real review would establish their existence, scope, and rating from evidence.
High priority
Emergency access is not independently recoverable, privileged roles are broader than needed, and one service account is outside the normal MFA path.
Medium priority
External sharing, mailbox forwarding, guest review, and audit ownership need clearer restrictions and recurring review.
How findings are prioritized
| Rating | Meaning | Expected treatment |
|---|---|---|
| High | A plausible failure could materially affect access, email, data, recovery, or business operations. | Assign an owner immediately and address or formally accept the risk within the first remediation window. |
| Medium | The control is incomplete, inconsistently applied, or difficult to prove. | Plan and complete within the agreed roadmap unless a business dependency changes the order. |
| Low | Hardening, documentation, or operational improvement with limited immediate exposure. | Bundle into normal administration and verify during a future review. |
Prioritized findings
| ID | Finding | Rating | Evidence example | Owner | Target |
|---|---|---|---|---|---|
| M365-01 | No tested cloud-only emergency access path independent of the primary administrator. | High | Administrator interview; emergency-account inventory empty. | Business owner + IT provider | 7 days |
| M365-02 | Three standing Global Administrator assignments exceed the documented operating need. | High | Role assignment export; no approved role matrix. | IT provider | 14 days |
| M365-03 | A legacy service account does not use the normal MFA or conditional access path. | High | Sign-in review; application dependency not documented. | Application owner | 14 days |
| M365-04 | External sharing defaults allow broader use than the stated business need. | Medium | SharePoint sharing configuration and sample site review. | Operations | 30 days |
| M365-05 | Automatic forwarding is not centrally reviewed and two exceptions lack owners. | Medium | Mail flow and mailbox rule export. | IT provider | 30 days |
| M365-06 | Guest accounts have no recurring owner attestation or removal cadence. | Medium | Guest inventory; no review record. | Department owners | 45 days |
| M365-07 | Audit-search responsibility and retention expectations are not documented. | Medium | Administrator interview; policy and evidence review. | Security owner | 45 days |
M365-01: Emergency access is not independently recoverable
Observation
The illustrative tenant relies on the normal administrator accounts and the same mobile authentication dependency used day to day. No separate cloud-only emergency account has been created and tested.
Why it matters
A conditional access mistake, identity-provider outage, device loss, or administrator lockout could prevent the business and its provider from recovering the tenant when access matters most.
Recommended action
Create two controlled emergency access accounts, use an authentication method independent of the normal path, protect credentials, alert on use, document authorized access, and test the accounts on a recurring schedule.
Validation
Record the account identifiers, role assignments, authentication methods, alert rule, storage owner, test date, test result, and next test date. Do not place credentials in the report.
First 30 days
Days 0 to 7
- Assign one accountable business owner and one technical implementer.
- Create, secure, alert on, and validate emergency access.
- Inventory privileged accounts, service accounts, and recovery dependencies.
Days 8 to 14
- Reduce standing privileged roles to the approved need.
- Document and remediate the service-account authentication exception.
- Confirm MFA coverage and exception ownership.
Days 15 to 30
- Set external sharing and forwarding boundaries.
- Create a guest and exception review cadence.
- Document audit-search ownership and evidence retention.
After 30 days
- Validate completed changes against the finding register.
- Record accepted risks and unresolved dependencies.
- Set the next review date and evidence owner.
Evidence and ownership record
| Control area | Evidence retained | System of record | Owner | Review cadence |
|---|---|---|---|---|
| Privileged roles | Role export, approved role matrix, exception record | Restricted security workspace | Security owner | Quarterly |
| Emergency access | Account record, alert test, recovery test record | Restricted continuity record | Business owner | Every 90 days |
| External sharing | Tenant setting export, approved exceptions | IT administration record | Operations | Quarterly |
| Guests | Guest inventory and owner attestation | Access review record | Department owners | Quarterly |