Report created for Acestara on Monday 09 June 2025 at 1:30 PM
Microsoft 365 Security Report
 Dashboard
 Admins
 Users
 Licenses
 Mailbox Access
 Devices
 Mobile Devices
 Contacts
 Resources
 Groups
 Forwarding
 Transport Rules
 Inbox Rules
 Conditional Access
 Action Points
 Glossary of Terms
Company Information  
 
Tenant wide options  
Authentication Methods  
 
MFA conditional access policies  
 
Global Administrators  
Domains  
 
Azure AD registered applications  
 
Enterprise AD registered applications  
 
Users with Strong Password Enforcement Disabled  
Users with password expiry policy disabled  
Role Assignments  
Role Assignments Chart  
Microsoft 365 Users  
Licensed and Unlicensed users chart  
Microsoft 365 User MFA Status  
Microsoft 365 Mailbox Types  
 
Microsoft 365 Licenses  
Microsoft 365 Licenses and Users  
Microsoft 365 Licensing Charts  
Microsoft 365 delegated access to mailboxes  
Microsoft 365 devices  
Microsoft 365 mobile device access  
Mobile device types  
 
Microsoft 365 contacts  
Microsoft 365 Mail Users  
 
Microsoft 365 Room Mailboxes  
Microsoft 365 Equipment Mailboxes  
 
Microsoft 365 Groups  
Microsoft 365 mail enabled Groups with external members  
Microsoft 365 Groups chart  
 
All Forwarding on mailboxes  
External Forwarding on mailboxes  
 
All Transport Rules currently in the exchange  
Transport Rules that forward externally  
 
All inbox rules currently in the exchange  
Inbox Rules that forward externally  
All Conditional Access Policies detail  

Action Points

The below summarises recommended important points to act upon, taken from the entire security report. Where possible you should aim to make as many of the items below show as a green thumbs up. If due to required legacy compatibilty you are unable to fully address all points then you should tightly control and document anything that can't be changed for compliancy purposes. Action points are colour / icon coded for ease of use. A green thumbs up requires no action on your part. A red thumbs down represents a significant security / misconfiguration issue and should be addressed. An amber pointing finger should still be addresed but may be of less significance in comparison to a thumbs down. A blue 'info' icon is not necesarily a concern but is something that you need to be aware of.

Unified Audit Log

The Unified Audit log is enabled

No action needs to be taken

Password Expiry Policy

The organisation password expiry policy is set to Never Expire

For increased security it is recommended that passwords are changed in line with an organisational policy. While Microsoft currently recommends to set a secure password and not to change it, because this can lead to weak password when users get idle. It is clearly better to change the password on schedule and keep it strong! This should be done if possible! You can use the 'Organisation Password Policy' tool in the Security tools section of MicroMonty to configure a suitable password expiry policy

OAuth2

OAuth2 (Modern Authentication) is enabled in the tenant

No action needs to be taken

Active Sync

Active Sync is enabled for at least one account in the tenant

Check the 'Users' tab for more detail. Active Sync is a legacy protocol that is used to access Exchange servers. It does not fully support MFA so ideally should not be used. However, most mobile devices use Active Sync to access emails, blocking active sync will stop mobile devices retrieving email when using most email apps. You can use the connection protocols tool in MicroMonty to control this

POP

No accounts in the tenant are using POP to access email

No action needs to be taken

IMAP

No accounts in the tenant are using IMAP to access email

No action needs to be taken

MAPI

MAPI is enabled for at least one account in the tenant

Check the 'Users' tab for more detail. MAPI is a legacy protocol that is used to access email accounts. Disabling MAPI could increase security. However, disabling MAPI will prevent the use of Outlook to access email in Exchange mode, this is generally not recommended. You can use the connection protocols tool in MicroMonty to control this

SMTP

SMTP is enabled for at least one account in the tenant

Check the 'Users' tab for more detail. SMTP is a legacy protocol that is used to send email. SMTP does not support MFA. If SMTP is enabled MFA can be bypassed to send email from your accounts. For maximum security, and to prevent your accounts being spoofed, it is recommended to block the use of SMTP in Microsoft 365. You can use the connection protocols tool in MicroMonty to control this

MFA Conditional Access Policy

All configured conditional access policies that enforce MFA are enabled

No action needs to be taken

MFA Conditional Access Policy Exceptions

A conditional access policy has exceptions

Check the 'Dashboard' tab for more detail. A conditional access policy that enforces MFA has exceptions defined. This could mean that accounts falling under the scope of the policy no longer have MFA enabled if they are specified or contained within the exceptions listed.

Domain Verification

All registered domains are verified in Microsoft 365

No action needs to be taken

DKIM Status

All registered domains have DKIM enabled.

No action needs to be taken

Azure AD App creation

Azure applications are registered in your Azure AD

Look at the 'Dashboard' tab for more info. Carefully review existing azure AD applications. Detailed information about operations and permissions granted to the app are viewable in the Azure portal. Look under Azure Active Directory and then App Registrations. Illicit registered Azure applications can potentially perform devastating operations within your tenant. It is recommended that you enable the scanning service in MSP Easy Tools to alert you when a new app is created.

Strong Password Requirement

No users found with strong password enforcement disabled

No action needs to be taken

No password expiry

Users found with Password expiry disabled but MFA enabled

Check the 'Dashboard' tab for more information. For security, If possible enable password expiry for all users. However, these users do have MFA enabled. You can use the Password tools in the security section of Micromonty to help you do this

Global Admins

Multiple global admins detected

It is recommended that the number of Global Admins is kept to a minimum for security. Please check the 'Admins' tab for more detail. Attackers can create a new admin to compromise your systems. Remember also that an internal user has 'Access all areas' if they are a global admin. The pro version of the tools can alert you when a new admin is detected and also help to remove unwanted admins. MircroMonty can help you to configure different admin privileges for any account

Admin Multifactor Authentication

All Admins are using MFA

No action needs to be taken

User Multifactor Authentication

All users are using MFA

No action needs to be taken

Blocked users

No blocked users in the tenant

No action needs to be taken

License allocation

Licenses are allocated that are not present in the tenant

Some users are allocated licenses that do not exist in the tenant. Check the 'Licenses'. tab for more detail. The license may have expired or has been cancelled. This should be remedied to avoid disruption to services and possible data loss. You can use the license tool in MicroMonty to help you fix this issue, but you may need to purchase additional licenses first

License usage

There are unused licenses in the tenant

Unused licenses can incur a cost that is unnecessary. Check the 'Licenses'. tab for more detail. These licenses should be allocated to users or cancelled if not needed. You can use the license tool in MicroMonty to assign licenses. Excess licenses must be cancelled with your provider

Delegated mailbox access

There are users with delegated mailboxes in the tenant

When a mailbox is delegated the delegate can fully access the content of the mailbox. Check the 'Licenses'. tab for more detail. Please check to confirm these delegations are as they should be. You can use the Mailbox tools in MicroMonty to change mailbox permissions.

Microsoft 365 Mail Users

Microsoft 365 Mail Users exist in the tenant

A Microsoft 365 mail user is an external user that has been given access to some (or all) of the content in your Microsoft 365 tenant. This usually means that a user has shared some content with this person. Check the 'Contacts' tab for more detail. Microsoft 365 mail users are not recommended, especially long term, these users can access part or even all of your sharepoint / onedrive data. You can use MicroMonty to help you remove 'Mail Users'

Groups with external members

Mail enabled groups exist with external members

A mail enabled group with an external member can be used to forward mail external to the organisation. Check the 'Groups' tab for more detail. If possible you should remove external members from your mail enabled groups. You can use MicroMonty to create and delete mail enabled groups. New MicroMonty tool to configure existing group members soon. The pro version of MSP Easy tools can automatically alert you when a new external group member is found.

External Forwarding

Users with external forwarders exist in the tenant

External forwarders are a common way attackers forward mail to an address outside the company. These forwarders can sometimes be invisible in the office portal, dependent on how they were set. Check the 'Forwarding' tab for more detail. If possible you should remove all external forwarders on every account. You can use MicroMonty to control forwarders on an account. The pro version of MSP Easy tools can automatically alert you when a new external forwarder is found. The counterpart tool on the launcher will help you to remove unwanted forwarders

External Transport Rules

Externally forwarding transport rules were found

External transport rules can be used to forward emails automatically to a recipient outside the tenant. Check the 'Transport Rules' tab for more detail. If possible you should remove all external Transport rules. The pro version of MSP Easy tools can automatically alert you when a new external transport rule is found. The counterpart tool on the launcher will help you to remove unwanted rules

External inbox Rules

No externally forwarding inbox rules were found.

No action needs to be taken

Conditional Access Policies

Enabled conditional access policies were found.

No action needs to be taken. Check the conditional access tab of the report for more detail.

Conditional Access Policies

Disabled conditional access policies were found

Check the conditional access tab of the report for more detail. Disabled conditional access policies are not operational.
Explanation of terms used in the report