A Microsoft 365 tenant hardening checklist: Secure Score, admin roles and risky defaults

A Microsoft 365 tenant works on day one, but several defaults and early decisions deserve a second look: who holds admin roles, which apps users can consent to, which legacy protocols still answer and what gets audited. In this checklist I'll use Microsoft Secure Score as the scoreboard, then work through the changes that matter most, each with a way to check it and what good looks like.

Prerequisites#

• Global Reader for the review, and the specific admin roles, activated just in time, for the changes.
• The Microsoft Graph PowerShell SDK and Exchange Online PowerShell V3 (see connecting with Exchange Online PowerShell V3).
• A pilot group and a short change notice for anything users will notice.

Step-by-step#

1. Take a Secure Score baseline#

In the Microsoft Defender portal, open Exposure management › Secure score (or go to https://security.microsoft.com/securescore). Recommended actions are grouped into Identity, Device, Apps and Data. Give each one a status (To address, Planned, Risk accepted, Resolved through third party or Resolved through alternate mitigation) and add a note explaining the decision. Risk accepted earns no points, and points take about 24 hours to update after a change. Record the starting score so you can show the trend:

Connect-MgGraph -Scopes "SecurityEvents.Read.All"
Get-MgSecuritySecureScore -Top 1 | Select-Object CreatedDateTime, CurrentScore, MaxScore

Treat the list as a prioritised to-do list, not a target. A high score doesn't prove the tenant is secure, and some high-point actions won't fit your organization.

2. Shrink and protect admin roles#

Keep Global Administrators to fewer than five, including two emergency access accounts. Give everyone else the narrowest role that does the job (Exchange, SharePoint, Teams, User or Helpdesk Administrator, Global Reader for auditors), use separate cloud-only admin accounts without mailboxes, and require phishing-resistant MFA for them. With Microsoft Entra ID P2 or Entra ID Governance, make roles eligible through Privileged Identity Management instead of permanent. List who holds Global Administrator today:

Connect-MgGraph -Scopes "RoleManagement.Read.Directory","Directory.Read.All"
$ga = "62e90394-69f5-4237-9190-012177145e10"   # Global Administrator role template ID

$active = Get-MgRoleManagementDirectoryRoleAssignment -All -Filter "roleDefinitionId eq '$ga'" |
    Select-Object PrincipalId, @{ n = 'Type'; e = { 'Active' } }
$eligible = Get-MgRoleManagementDirectoryRoleEligibilitySchedule -All |   # PIM only
    Where-Object RoleDefinitionId -eq $ga |
    Select-Object PrincipalId, @{ n = 'Type'; e = { 'Eligible' } }

@($active) + @($eligible) | ForEach-Object {
    $p = Get-MgDirectoryObject -DirectoryObjectId $_.PrincipalId
    [pscustomobject]@{ Type = $_.Type; Name = $p.AdditionalProperties.displayName }
} | Format-Table

Good looks like a short list where only the emergency access accounts are permanently active. Check that those accounts are set up as described in mandatory MFA, service accounts and break-glass accounts.

3. Lock down app consent#

In the Microsoft Entra admin center, go to Entra ID › Enterprise apps › Consent and permissions › User consent settings. Choose Do not allow user consent, or allow consent only for apps from verified publishers and for low-risk permissions you select. Microsoft has tightened its own default (Message center MC1097272) so users can't consent to third-party apps that want their files and sites, but check your setting rather than assume. Then turn on the admin consent workflow under Admin consent settings with named reviewers, so users have a way to ask. Review what's already granted:

Connect-MgGraph -Scopes "Policy.Read.All","Directory.Read.All"
$authz = Get-MgPolicyAuthorizationPolicy
$authz.DefaultUserRolePermissions |
    Format-List PermissionGrantPoliciesAssigned, AllowedToCreateApps, AllowedToCreateTenants
$authz | Format-List AllowedToSignUpEmailBasedSubscriptions

# Apps with the most user-granted (not admin-granted) delegated permissions
Get-MgOauth2PermissionGrant -All | Where-Object ConsentType -eq "Principal" |
    Group-Object ClientId | Sort-Object Count -Descending | Select-Object -First 20 |
    ForEach-Object { [pscustomobject]@{
        App    = (Get-MgServicePrincipal -ServicePrincipalId $_.Name).DisplayName
        Grants = $_.Count } }

Good looks like no ManagePermissionGrantsForSelf entry (user consent off) or only a built-in Microsoft policy such as microsoft-user-default-low or microsoft-user-default-recommended, and no unfamiliar apps in the grant list.

4. Block legacy authentication and SMTP AUTH#

Block legacy authentication with Conditional Access, as in a Conditional Access baseline, or with security defaults if you don't have Microsoft Entra ID P1. Exchange Online has already turned off Basic authentication for most protocols. SMTP AUTH is the common exception, and Microsoft has announced the retirement of Basic authentication for it too; check the Exchange Team Blog for the current schedule. Find out which devices and apps still use SMTP AUTH, then turn it off for the organization and allow it only on the mailboxes that need it:

Connect-ExchangeOnline
Set-TransportConfig -SmtpClientAuthenticationDisabled $true

# Mailboxes that override the organization setting and still allow SMTP AUTH
Get-CASMailbox -ResultSize Unlimited | Where-Object SmtpClientAuthenticationDisabled -eq $false |
    Select-Object PrimarySmtpAddress

Keep the exception list short and documented. For printers and apps, see SMTP AUTH, relay connectors and 5.7.57.

5. Close risky defaults#

6. Check auditing#

Run these in Exchange Online PowerShell; the expected values are in the comments:

Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled   # True
Get-OrganizationConfig | Format-List AuditDisabled                     # False (mailbox auditing on)

Audit (Standard) keeps records for 180 days; longer retention needs Audit (Premium) or an export to your SIEM. Microsoft Entra sign-in and audit logs are kept for 30 days with Entra ID P1 or P2, so stream them to Log Analytics if investigations need more history.

Verify#

• A day after each change, the matching recommended actions in Secure Score show as completed and the history chart moves.
• A standard user who tries to add an unfamiliar app sees a request-approval prompt, and the request reaches your reviewers.
• In the Entra sign-in logs, legacy client apps such as IMAP4 or Authenticated SMTP appear as failures blocked by Conditional Access.
• Rerun the scripts above and file the output with the date; it becomes your evidence for the next review.

Tips & gotchas#

• Don't chase points. Use Risk accepted with a written reason when an action doesn't fit, so the decision is visible.
• Some actions need licences you may not have, such as Entra ID P2 or Defender plans. Plan them rather than ignore them.
• Exclude emergency access accounts from policies that could lock you out, and alert on every sign-in they make.
• Give users a path before closing a door. The admin consent workflow and documented SMTP AUTH exceptions stop people finding riskier workarounds.
• Repeat quarterly. Microsoft adds recommended actions, and settings drift as admins come and go.

References#

• Assess your security posture with Microsoft Secure Score
• Configure how users consent to applications
• Manage app consent policies