Acme Holdings — Production M365
Primary Domain: acmeholdings.com · External ID: 72f988bf-86f1-41af-91ab-2d7cd011db47 · Last evaluated 2026-11-14T19:45:00Z
Posture Score
MFA Registration Coverage
97.2%
Global / Super Admins
6
High-Risk OAuth Apps
3
Require phishing-resistant MFA for all privileged administrator roles
Configuration matches CIS and SOC 2 hardened baseline.
Administrator accounts hold keys to every mailbox, SharePoint site, and directory setting. Requiring FIDO2/WebAuthn or Microsoft Authenticator number-matching blocks credential stuffing and adversary-in-the-middle token theft.
Enforce MFA for 100% of active member and guest users
Configuration matches CIS and SOC 2 hardened baseline.
Even a single unlicensed or shared user account without MFA allows an attacker to pivot inside Microsoft Teams, read internal SharePoint sites, and launch internal phishing.
Keep standing Global Administrators between 2 and 4 accounts
6 Global Administrators assigned (recommended baseline: 2 to 4 accounts).
More than 4 Global Administrators multiplies your blast radius; fewer than 2 risks tenant lockout if one admin is unavailable. Daily administrative work should use scoped roles (Exchange Admin, User Admin).
Affected Resources / Accounts:
admin-breakglass1@acmeholdings.onmicrosoft.comadmin-breakglass2@acmeholdings.onmicrosoft.comcto@acmeholdings.comit-director@acmeholdings.commsp-tier3@acmeholdings.comformer-devops@acmeholdings.comRemediation Path: Entra Admin Center → Identity → Roles & admins → Global Administrator
- Review all accounts permanently assigned the Global Administrator role.
- Downgrade day-to-day admins to least-privilege roles such as User Administrator or Exchange Administrator.
- Retain 2 dedicated cloud-only emergency access accounts protected by FIDO2 hardware keys.
$role = Get-MgDirectoryRole -Filter "DisplayName eq 'Global Administrator'" Get-MgDirectoryRoleMember -DirectoryRoleId $role.Id
Ensure Global Administrator accounts are cloud-only (not hybrid synced)
Configuration matches CIS and SOC 2 hardened baseline.
If an on-premises Active Directory account is synced to Entra ID with Global Admin rights, an on-prem domain compromise immediately compromises the entire cloud tenant.
Block legacy authentication protocols (IMAP, POP3, SMTP Basic, ActiveSync)
Legacy IMAP & POP3 Basic Auth still allowed on 3 shared service mailboxes.
Legacy authentication protocols cannot enforce MFA. Over 90% of successful password-spray attacks against Microsoft 365 authenticate through legacy IMAP, POP3, or older Office clients.
Affected Resources / Accounts:
scanner-mfp@acmeholdings.comap-invoices@acmeholdings.comlegacy-crm@acmeholdings.comRemediation Path: Entra Admin Center → Protection → Conditional Access → Block Legacy Authentication
- Create a Conditional Access policy targeting All users.
- Under Conditions → Client apps, check Exchange ActiveSync clients and Other clients.
- Under Access controls → Grant, select Block access.
Set-OrganizationConfig -DefaultAuthenticationPolicy "Block-Legacy-Auth"
Disable automatic external mail forwarding on outbound spam policies and inbox rules
2 user mailboxes have active inbox rules auto-forwarding to external personal domains.
Attackers who compromise a mailbox routinely add silent inbox rules or SMTP forwarding to exfiltrate invoices, wire instructions, and password reset emails to an external address.
Affected Resources / Accounts:
j.miller@acmeholdings.com → jmiller.archive@gmail.combilling@acmeholdings.com → contractor-ap@outlook.comRemediation Path: Microsoft Defender Portal → Email & collaboration → Policies & rules → Threat policies → Anti-spam → Outbound spam
- Edit the default Outbound spam filter policy.
- Set Automatic forwarding rules to Off — Forwarding is disabled.
- Audit existing mailbox ForwardingSmtpAddress values and remove unauthorized external targets.
Set-HostedOutboundSpamFilterPolicy -Identity Default -AutoForwardingMode Off
Restrict SharePoint & OneDrive anonymous "Anyone with the link" sharing
Configuration matches CIS and SOC 2 hardened baseline.
Anonymous "Anyone" links can be forwarded outside the intended recipient list and indexed or accessed without authentication, exposing customer contracts and internal spreadsheets.
Restrict Entra ID guest user invite permissions and directory visibility
Partner engineering guests permitted to view group memberships for joint project channels.
By default, guests can enumerate all users and groups in your Entra directory. Restricting guest access to their own profile properties prevents external recon.
Remediation Path: Entra Admin Center → Identity → External Identities → External collaboration settings
- Set Guest user access restrictions to "Guest user access is restricted to properties and memberships of their own directory objects".
- Set Guest invite settings to "Only users assigned to specific admin roles can invite guest users".
Require administrator consent for third-party OAuth applications requesting high-risk scopes
3 unverified third-party OAuth apps hold Mail.ReadWrite or Files.ReadWrite.All user grants.
Illicit consent grant attacks trick users into clicking "Accept" on a third-party OAuth prompt, granting attackers persistent API access to Mail.ReadWrite and Files.ReadWrite.All without ever needing the user’s password or MFA.
Affected Resources / Accounts:
SketchyNote AI Meeting AssistantPDF-Fast-Converter CloudInboxAnalytics ProRemediation Path: Entra Admin Center → Identity → Applications → Enterprise applications → Consent and permissions
- Select "Do not allow user consent" or "Allow user consent for apps from verified publishers, for selected permissions (Low impact)".
- Enable the Admin consent workflow so users can request review with a business justification.
Update-MgPolicyAuthorizationPolicy -DefaultUserRolePermissions @{PermissionGrantPoliciesAssigned = @()}Enable Microsoft Purview Unified Audit Log ingestion and mailbox auditing
Configuration matches CIS and SOC 2 hardened baseline.
Without Unified Audit Logging enabled, forensic responders cannot determine which emails or SharePoint files were accessed during an incident, failing SOC 2 and ISO 27001 logging requirements.