Microsoft 365 Security Assessment

Answer what you know. Anything left as Not sure is excluded from the score rather than counted against you, and the report says which areas that applies to.

Identity and access

Does everyone, including anyone with administrator rights, need a second step to sign in?

A code, an app prompt or a security key — anything beyond a password. Administrator rights means Global Administrator, Exchange Administrator, or any other privileged role. Answer Partly if some people have it, or if it applies to some applications and not others.

Yes Partly No Not sure

Email security

Do messages from outside your organisation carry a visible warning?

A banner or an [External] tag at the top of the message. It is the cheapest control on this page and it is the one that catches invoice fraud.

Yes No Not sure

Data protection

When somebody shares a SharePoint or OneDrive file, who can they share it with by default?

The organisation-wide default, not what a careful person chooses. Microsoft's own four settings are below.

Device and endpoint

How many of the devices used to reach company data are centrally managed?

Managed means you can see the device, require it to be encrypted, and wipe it if it goes missing. Count personal phones that collect work email.

Backup and recovery

Is your Microsoft 365 data backed up somewhere outside Microsoft 365?

The recycle bin and retention policies are not backups. Neither survives a deletion that is deliberate, malicious, or simply older than the window. If you pay for Microsoft 365 Backup, Microsoft's own backup add-on, answer Yes.

Yes No Not sure

About your organisation

How many people use Microsoft 365 in your organisation?

An approximate number is fine.

Where should the report go?

Email me my results, and contact me about them. CyberShield Advisory LLC will use my answers and my email address for that and nothing else. I can unsubscribe from any message, and ask for my record to be deleted at any time. How we handle your data.