Tenant hardening checklist

Before you start

• Global Reader for the review, and the specific admin roles, activated just in time, for the changes.
• The Microsoft Graph PowerShell SDK and Exchange Online PowerShell V3 (see connecting with Exchange Online PowerShell V3).
• A pilot group and a short change notice for anything users will notice.

Checklist

1. 1

   Take a Secure Score baseline

   In the Microsoft Defender portal, open Exposure management › Secure score (or go to https://security.microsoft.com/securescore). Recommended actions are grouped into Identity, Device, Apps and Data. Record the starting score so you can show the trend:

   powershell

   Connect-MgGraph -Scopes "SecurityEvents.Read.All"
   Get-MgSecuritySecureScore -Top 1 | Select-Object CreatedDateTime, CurrentScore, MaxScore

2. 2

   Shrink and protect admin roles

   Keep Global Administrators to fewer than five, including two emergency access accounts. Give everyone else the narrowest role that does the job (Exchange, SharePoint, Teams, User or Helpdesk Administrator, Global Reader for auditors), use separate cloud-only admin accounts without mailboxes, and require phishing-resistant MFA for them. List who holds Global Administrator today:

   See the full script in the source article.

3. 3

   Lock down app consent

   In the Microsoft Entra admin center, go to Entra ID › Enterprise apps › Consent and permissions › User consent settings. Choose Do not allow user consent, or allow consent only for apps from verified publishers and for low-risk permissions you select. Review what's already granted:

   powershell

   Connect-MgGraph -Scopes "Policy.Read.All","Directory.Read.All"
   $authz = Get-MgPolicyAuthorizationPolicy
   $authz.DefaultUserRolePermissions |
       Format-List PermissionGrantPoliciesAssigned, AllowedToCreateApps, AllowedToCreateTenants
   $authz | Format-List AllowedToSignUpEmailBasedSubscriptions
   
   # Apps with the most user-granted (not admin-granted) delegated permissions
   Get-MgOauth2PermissionGrant -All | Where-Object ConsentType -eq "Principal" |
       Group-Object ClientId | Sort-Object Count -Descending | Select-Object -First 20 |
       ForEach-Object { [pscustomobject]@{
           App    = (Get-MgServicePrincipal -ServicePrincipalId $_.Name).DisplayName
           Grants = $_.Count } }

4. 4

   Block legacy authentication and SMTP AUTH

   Block legacy authentication with Conditional Access, as in a Conditional Access baseline, or with security defaults if you don't have Microsoft Entra ID P1. Exchange Online has already turned off Basic authentication for most protocols. Find out which devices and apps still use SMTP AUTH, then turn it off for the organization and allow it only on the mailboxes that need it:

   powershell

   Connect-ExchangeOnline
   Set-TransportConfig -SmtpClientAuthenticationDisabled $true
   
   # Mailboxes that override the organization setting and still allow SMTP AUTH
   Get-CASMailbox -ResultSize Unlimited | Where-Object SmtpClientAuthenticationDisabled -eq $false |
       Select-Object PrimarySmtpAddress

5. 5

   Close risky defaults

   Setting	Where	Good looks like
   Non-admins creating tenants	Entra ID › Users › User settings	Restrict non-admin users from creating tenants: Yes
   Users registering apps	Entra ID › Users › User settings	Users can register applications: No; give developers the Application Developer role
   Email-verified self-service sign-up	AllowedToSignUpEmailBasedSubscriptions	False
   Self-service trials and purchases	Microsoft 365 admin center › Settings › Org settings	Off, or limited to approved products
   Automatic external forwarding	Outbound anti-spam policy in the Defender portal	Off; see NDR 550 5.7.520
   External sharing	SharePoint, OneDrive and Teams	Specific people as the default link, reviewed guests; see SharePoint sharing and Teams external access

6. 6

   Check auditing

   Run these in Exchange Online PowerShell; the expected values are in the comments:

   powershell

   Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled   # True
   Get-OrganizationConfig | Format-List AuditDisabled                     # False (mailbox auditing on)

Verify

• A day after each change, the matching recommended actions in Secure Score show as completed and the history chart moves.
• A standard user who tries to add an unfamiliar app sees a request-approval prompt, and the request reaches your reviewers.
• In the Entra sign-in logs, legacy client apps such as IMAP4 or Authenticated SMTP appear as failures blocked by Conditional Access.
• Rerun the scripts above and file the output with the date; it becomes your evidence for the next review.

Tips & gotchas

• Don't chase points. Use Risk accepted with a written reason when an action doesn't fit, so the decision is visible.
• Some actions need licences you may not have, such as Entra ID P2 or Defender plans. Plan them rather than ignore them.
• Exclude emergency access accounts from policies that could lock you out, and alert on every sign-in they make.
• Give users a path before closing a door. The admin consent workflow and documented SMTP AUTH exceptions stop people finding riskier workarounds.
• Repeat quarterly. Microsoft adds recommended actions, and settings drift as admins come and go.