Northwind Logistics — Corporate M365
Primary Domain: northwindlogistics.com · External ID: 91a4412c-51b0-488e-82d1-901cc8721aa0 · Last evaluated 2026-11-14T19:30:00Z
Posture Score
MFA Registration Coverage
95.5%
Global / Super Admins
3
High-Risk OAuth Apps
0
Require phishing-resistant MFA for all privileged administrator roles
Configuration matches CIS and SOC 2 hardened baseline.
Administrator accounts hold keys to every mailbox, SharePoint site, and directory setting. Requiring FIDO2/WebAuthn or Microsoft Authenticator number-matching blocks credential stuffing and adversary-in-the-middle token theft.
Enforce MFA for 100% of active member and guest users
4 warehouse kiosk accounts lack MFA registration and are not scoped by IP Conditional Access.
Even a single unlicensed or shared user account without MFA allows an attacker to pivot inside Microsoft Teams, read internal SharePoint sites, and launch internal phishing.
Affected Resources / Accounts:
dock-east@northwindlogistics.comdock-west@northwindlogistics.comRemediation Path: Entra Admin Center → Identity → Overview → Properties → Security defaults (or Conditional Access)
- Verify every active member and guest user is covered by Conditional Access MFA or Security Defaults.
- Review excluded groups to ensure temporary onboarding exemptions have been removed.
Get-MgReportAuthenticationMethodUserRegistrationDetail -All | Where-Object { -not $_.IsMfaRegistered }Keep standing Global Administrators between 2 and 4 accounts
Configuration matches CIS and SOC 2 hardened baseline.
More than 4 Global Administrators multiplies your blast radius; fewer than 2 risks tenant lockout if one admin is unavailable. Daily administrative work should use scoped roles (Exchange Admin, User Admin).
Ensure Global Administrator accounts are cloud-only (not hybrid synced)
Configuration matches CIS and SOC 2 hardened baseline.
If an on-premises Active Directory account is synced to Entra ID with Global Admin rights, an on-prem domain compromise immediately compromises the entire cloud tenant.
Block legacy authentication protocols (IMAP, POP3, SMTP Basic, ActiveSync)
Configuration matches CIS and SOC 2 hardened baseline.
Legacy authentication protocols cannot enforce MFA. Over 90% of successful password-spray attacks against Microsoft 365 authenticate through legacy IMAP, POP3, or older Office clients.
Disable automatic external mail forwarding on outbound spam policies and inbox rules
Configuration matches CIS and SOC 2 hardened baseline.
Attackers who compromise a mailbox routinely add silent inbox rules or SMTP forwarding to exfiltrate invoices, wire instructions, and password reset emails to an external address.
Restrict SharePoint & OneDrive anonymous "Anyone with the link" sharing
Configuration matches CIS and SOC 2 hardened baseline.
Anonymous "Anyone" links can be forwarded outside the intended recipient list and indexed or accessed without authentication, exposing customer contracts and internal spreadsheets.
Restrict Entra ID guest user invite permissions and directory visibility
Configuration matches CIS and SOC 2 hardened baseline.
By default, guests can enumerate all users and groups in your Entra directory. Restricting guest access to their own profile properties prevents external recon.
Require administrator consent for third-party OAuth applications requesting high-risk scopes
Configuration matches CIS and SOC 2 hardened baseline.
Illicit consent grant attacks trick users into clicking "Accept" on a third-party OAuth prompt, granting attackers persistent API access to Mail.ReadWrite and Files.ReadWrite.All without ever needing the user’s password or MFA.
Enable Microsoft Purview Unified Audit Log ingestion and mailbox auditing
Configuration matches CIS and SOC 2 hardened baseline.
Without Unified Audit Logging enabled, forensic responders cannot determine which emails or SharePoint files were accessed during an incident, failing SOC 2 and ISO 27001 logging requirements.