Most Microsoft 365 tenants were created in an afternoon and never revisited. These are the settings we check before anything else.
- Security defaults or Conditional Access with MFA for all users
- Legacy authentication blocked
- Admin accounts separated from daily accounts
- Mail forwarding rules audited
- Sharing defaults reviewed
- Audit log retention confirmed