Guide
Microsoft 365 Security Checklist for Financial Firms
Microsoft 365 holds your client email, files and conversations. These are the settings that keep it secure and support your compliance program.
Key takeaways
- Multi-factor authentication for every account, including administrators, is the single most important setting.
- Blocking legacy sign-in methods closes a common way around multi-factor authentication.
- Stopping automatic forwarding to outside addresses limits the damage of a compromised mailbox.
- Audit logs, alerts and a separate backup let you investigate and recover after an incident.
Identity
Sign-ins and accounts
- Require multi-factor authentication for every user, with conditional access policies or security defaults.
- Block legacy authentication protocols that cannot use multi-factor authentication.
- Use separate administrator accounts, keep them to a minimum and protect them with phishing-resistant sign-in methods where possible.
- Set conditional access rules by device compliance and location, for example allowing access only from managed devices.
- Remove access the day someone leaves and review guest accounts regularly.
Email protection
- Turn on Microsoft Defender for Office 365 protections for links, attachments and impersonation of your executives and domain.
- Tag external email so staff can see when a message comes from outside the firm.
- Block automatic forwarding of mail to outside addresses, a common step in business email compromise.
- Publish SPF, DKIM and DMARC records so others cannot easily send email that pretends to be from your domain.
- Use message encryption for client information sent by email.
Data
Files, data and devices
- Limit external sharing in SharePoint and OneDrive, and set sharing links to expire.
- Create data loss prevention policies for account numbers, Social Security numbers and other sensitive client data.
- Apply sensitivity labels to confidential documents and email.
- Manage devices with Intune: encryption, screen lock and the ability to wipe firm data from lost phones and laptops.
- Set retention policies that match your firm’s record-keeping requirements.
Monitoring
Monitoring and recovery
- Keep audit logging on and retain logs long enough to investigate an incident.
- Turn on alert policies for risky sign-ins, new forwarding rules and mass downloads.
- Review Microsoft Secure Score regularly and work through its recommendations.
- Back up Microsoft 365 with a dedicated backup, because built-in recovery windows are limited.
Our Microsoft 365 managed services set up and maintain each of these controls, and our managed cybersecurity services watch for threats around the clock. See also our IT compliance services.
This guide is general information about IT and cybersecurity practices, not legal advice. Your compliance officer or counsel should confirm how each rule applies to your firm.
FAQ
Microsoft 365 security questions
Is Microsoft 365 secure by default for a financial firm?
Not completely. Microsoft provides strong security features, but many must be turned on and configured, such as conditional access, legacy authentication blocking, data loss prevention and external sharing limits.
Why block automatic email forwarding?
Attackers who take over a mailbox often create a rule that forwards mail to an outside address so they can watch conversations and plan wire fraud. Blocking external forwarding stops that quietly happening.
Do we need a separate backup for Microsoft 365?
For most financial firms, yes. Microsoft keeps deleted items only for limited periods, while a dedicated backup lets you restore mailboxes, files and sites to a point in time after ransomware, a mistake or a departing employee.
Lock down your Microsoft 365 tenant
Talk with us about a Microsoft 365 security review for your firm.
