Cloud Security Checklist for Microsoft 365 and Azure

A cloud security checklist for Microsoft 365 and Azure covers the parts Microsoft leaves to you: identities and sign-in, administrator roles, access policies, configuration, logging, backups and data protection. Microsoft's shared responsibility model states that you always keep responsibility for your data, endpoints, accounts and access management, whichever cloud service you use. Work through the checklist below in order, then measure progress with Microsoft Secure Score for Microsoft 365, the Defender for Cloud secure score for Azure and CISA's SCuBA baselines.

If you would rather have it checked for you, our cloud security posture audit starts with what exists across your subscriptions, then examines configuration, identity, data exposure and logging.

What does Microsoft secure, and what stays with you?

Microsoft's article on shared responsibility in the cloud sets out the split. Microsoft secures the physical datacenters, network and hosts and the hypervisor, and in PaaS and SaaS it also manages operating systems, runtimes and middleware. For every cloud deployment type, you own your data and identities.

The article lists four responsibilities you always keep:

• Data: classification, data protection, encryption decisions and data governance.
• Endpoints: the laptops, desktops and mobile devices that access your cloud services.
• Accounts: creating, managing and removing user access.
• Access management: role-based access control, multifactor authentication and Conditional Access policies.

The same article's responsibility matrix gives configurations and settings to the customer in SaaS, PaaS and IaaS alike. Microsoft 365 is SaaS, so its security settings are yours to choose. Azure virtual machines are IaaS, where you also manage the operating systems and applications and configure all network security, including firewalls and segmentation.

Which identity controls come first?

• MFA for everyone, and legacy authentication blocked. Microsoft's security defaults require all users to register for MFA, require MFA for administrators and block legacy authentication protocols. Microsoft also says that organisations with Microsoft Entra ID P1 or P2 licences will probably find security defaults are not right for them, and that organisations with complex security requirements should consider Conditional Access.
• Conditional Access built from your own rules. Decide who may sign in, from which devices and to which apps, then express that as policy. Our zero trust implementation plan sets out the order to do it in.
• Two emergency access accounts. Microsoft recommends two cloud-only emergency access accounts permanently assigned the Global Administrator role, used only when normal administrator accounts cannot sign in.

For the rollout itself, including the people who will push back, see our MFA rollout playbook.

How many administrators should you have?

Microsoft's guidance for Microsoft Entra roles sets clear limits:

• Fewer than five Global Administrators. They can read and modify almost every administrative setting, so each one is a target.
• Fewer than ten privileged role assignments. Above ten, Entra shows a warning on the Roles and administrators page.
• Least privilege. The specific role, at the specific scope, for the specific period it is needed. Privileged Identity Management (PIM) lets an administrator activate a role for a limited time, and the access is removed automatically when that time expires.
• MFA on every administrator account, plus recurring access reviews to remove role assignments nobody needs any more.
• Cloud-only accounts for admin roles. Microsoft advises against giving Entra roles to accounts synced from on-premises, because a compromised on-premises account can then compromise your Entra resources.

Apply the same discipline to Azure. Role-based access control sits on the list of access controls you remain responsible for, so review who holds broad roles on each subscription as part of the same exercise.

How do you check your configuration against a recognised baseline?

Use three yardsticks, and treat each as a list of recommendations to work through rather than a pass mark.

• Microsoft Secure Score measures your Microsoft 365 posture in the Microsoft Defender portal, and a higher number means more recommended actions taken. Its recommendations cover products including Microsoft Entra ID, Exchange Online, SharePoint Online, Microsoft Teams and Defender for Office. Microsoft notes that the recommendations do not cover every attack surface and that not every recommendation will suit your environment, so write down the reason whenever you accept a risk instead.
• The Defender for Cloud secure score covers Azure. When you turn on Defender for Cloud in a subscription, the Microsoft cloud security benchmark is applied by default and your resources are assessed against it. Defender for Cloud now offers two secure score models with different calculations and values: a risk-based Cloud Secure Score in the Defender portal and the classic score in the Azure portal. Track one of them consistently rather than comparing the two numbers.
• CISA's SCuBA baselines are secure configuration baselines for Microsoft 365. SCuBA's primary goal is to help secure US federal civilian agency information in the cloud, but CISA says all organisations can use it to strengthen SaaS security. Its ScubaGear tool checks a Microsoft 365 tenant against the baselines and produces a report of where to improve.

For Azure workloads, our Microsoft Defender for Cloud page explains secure score, the benchmark and the separate workload protection plans.

Are your logs kept long enough to investigate an incident?

Check before you need them, because the defaults are short.

• Microsoft 365 audit log. Audit (Standard) records generated on or after 17 October 2023 are kept for 180 days by default. Keeping them for up to a year requires the user who generates each record to hold an Office 365 or Microsoft 365 E5 licence or a qualifying add-on, and ten years needs a further retention add-on.
• Azure activity log. Azure keeps activity log events for 90 days and then deletes them. To keep them longer, create a diagnostic setting that sends them to a Log Analytics workspace or a storage account.

Decide how far back you need to be able to look, write it down, and set retention to match. Then check that someone is alerted to the events that matter, such as new administrator role assignments, new mailbox forwarding rules and sign-ins from unexpected places. Our Microsoft 365 security audit establishes what your tenant can actually prove.

What should the checklist say about backups and data protection?

Data is the first item on Microsoft's list of responsibilities you always keep, including decisions on classification, protection and encryption. In practice:

• List the mailboxes, sites and Azure resources you must be able to restore, and how quickly each one needs to be back.
• Confirm how each one is backed up or recovered, and test a real restore on a schedule rather than assuming it works.
• Keep backup and recovery accounts separate from everyday admin accounts, so one compromised account cannot delete both the data and its copies.
• Label your most sensitive documents and control external sharing. Our list of Microsoft 365 security settings businesses leave open covers sharing links, app consent and DLP.

How often should you repeat the checklist?

Your posture changes every time someone adds a user, a guest, an app or a subscription. Secure Score updates in real time and syncs system data daily, and Defender for Cloud recalculates each security control every eight hours, so both are current enough for a monthly review. A simple rhythm:

• Monthly: review score changes and new recommendations, and confirm every accepted risk still has a reason.
• Quarterly: review Global Administrator and privileged role assignments, emergency access accounts and app permissions.
• Yearly, and after any merger, new subscription or major project: re-check every item on this list against the baselines.

A score only describes the tenant or subscriptions it is looking at, so first confirm which tenants and subscriptions you actually have. That is why a posture review starts with an inventory. To talk through your Microsoft 365 and Azure setup, contact our team.