Fifteen Microsoft 365 tenant settings that need an explicit decision

This is a decision list, not a fix list. Fifteen tenant-wide Microsoft 365 settings carry a Microsoft default that was chosen for onboarding convenience, and an auditor will ask which way the tenant chose and on what basis. Each entry below names the control, the licence tier it genuinely needs, the side effects, and the rollback.

Six pieces of pre-2024 guidance in this area are now wrong. Five of them attach to numbered rows below, and one, number matching, describes a setting that no longer exists. Those corrections are set out separately.

Where the fifteen come from

The starting point was two public control sets, not a population of audited tenants: the CIS Microsoft 365 Foundations Benchmark and the CISA Secure Cloud Business Applications (SCuBA) baselines for Microsoft 365. Every statement in the rows below is verified against the Microsoft Learn page for that control, and those pages are the citations to check. The CIS benchmark itself sits behind a registration form, so it is not a source a reader can open cold.

Not every row maps to a numbered control in either baseline. Rows 13 and 15 are here because they change how the other Conditional Access rows behave, not because a benchmark numbers them. Conditional Access policy design and rollout sequencing are a separate problem and out of scope; this list covers tenant-wide settings across identity, email, collaboration and audit.

Prerequisites

Before touching anything: two cloud-only emergency access accounts excluded from every Conditional Access policy; the Microsoft Graph PowerShell SDK, the SharePoint Online Management Shell and the Exchange Online PowerShell module installed; and roles that can read policy. The Graph pass below runs on Global Reader plus Security Reader. The SharePoint block needs SharePoint Administrator, because Microsoft documents Get-SPOTenant as requiring a SharePoint Online administrator. The Exchange block needs a role that can read Exchange Online organisation configuration. Writing any of the changes needs more than these, and Microsoft documents the least-privileged role per control on the pages cited.

Run the read-only pass first and record the current value of every setting. That record is the rollback plan. Deploy any new Conditional Access policy in report-only mode and read the sign-in logs before enforcing.

The fifteen settings

Rows 10 to 12 vary with the capability in scope: manual labelling and basic DLP sit at a lower tier than automatic labelling and endpoint DLP. Confirm the tier against the Microsoft 365 service descriptions before budgeting.

The six that older guidance gets wrong

Number matching is no longer a setting. Microsoft documents that number matching is enabled for all Microsoft Authenticator push notifications and that users cannot opt out. There is no toggle to find. A user running an Authenticator build that predates it cannot authenticate at all. The live 2026 item in that area is row 3: Microsoft retired the ability to manage authentication methods in the legacy MFA and SSPR policies beginning 30 September 2025, and the Authentication methods policy is now the only place methods are managed.

Continuous access evaluation is not something you switch on. Microsoft auto-enables it for tenants that never configured the old preview setting. In a Conditional Access policy the only CAE control is the session option that switches it off, plus the separate strict location enforcement option, which Microsoft lists as public preview. Two documented limits matter for a control narrative: CAE does not support guest accounts, and critical event response is near real time with propagation latency of up to 15 minutes, while IP location enforcement is instant.

Guest devices can never be Intune-compliant in your tenant. A Conditional Access policy that grants guests access only on a compliant or Microsoft Entra hybrid joined device blocks every guest by construction, because their devices are enrolled in the partner's tenant. The supported control is row 13: cross-tenant access inbound trust settings, which accept the MFA, compliant device and hybrid joined claims asserted by the partner's home tenant. Microsoft's documented default is that those claims are not trusted, and configuring trust settings requires Entra ID P1 on the tenant doing the configuring.

Basic authentication in Exchange Online is gone for every protocol except SMTP AUTH. Microsoft removed it for Exchange ActiveSync, POP, IMAP, Remote PowerShell, Exchange Web Services, the Offline Address Book, Autodiscover, Outlook for Windows and Outlook for Mac, and states plainly that no one, including Microsoft support, can re-enable it. The exception Microsoft names on the same page is SMTP client submission: basic authentication for SMTP AUTH was disabled only in tenants that were not already using it, it remains available where it was in use, and Microsoft has moved its retirement timeline more than once, pointing readers to the current announcement rather than a fixed date. That makes it the largest surviving legacy-credential surface in a lot of tenants, so check it rather than assuming it. The commands are in the Exchange block below. Row 1 still earns its place for two reasons Microsoft names on the same pages: certificate-based authentication remains legacy authentication in Entra terms and is blocked by that policy, and the policy covers endpoints outside Exchange Online. Frame the threat accordingly rather than claiming POP and IMAP are wide open.

Safe Links and Safe Attachments are already running, at the weakest tier. Microsoft documents that there is no default Safe Attachments policy, but that the Built-in protection preset security policy provides Safe Attachments and Safe Links to every recipient who is not covered by the Standard or Strict presets or by a custom policy. Built-in protection sits at the lowest precedence, so the real decision in row 6 is which recipients move up to Standard or Strict. In row 7, the current Safe Attachments actions are Off, Monitor, Block and Dynamic Delivery; Block is both the default and the value used by the Standard and Strict presets, and the Replace action no longer exists. On latency, Microsoft's own statement is that attachment scanning typically completes within 15 minutes; Dynamic Delivery removes the body delay entirely by delivering the message and holding the attachment.

Changing the consent policy does not revoke anything. Row 14 is worth doing, and Microsoft names the two built-in policies: microsoft-user-default-low allows user consent only for apps from verified publishers and only for permissions classified as low impact, while microsoft-user-default-legacy allows consent to any permission that does not require an admin. The trap is in the same document: updates to consent settings only affect future consent operations, existing grants remain unchanged, and users keep the access already granted. Tightening the policy without reviewing the existing grants changes nothing about the apps already in the tenant.

The read-only tenant check

Nothing in this section writes. Run it, save the output, and treat that file as the pre-change baseline.

# Read-only. Microsoft Graph PowerShell SDK v2.
Connect-MgGraph -Scopes 'Policy.Read.All','Directory.Read.All',
  'RoleAssignmentSchedule.Read.Directory','RoleEligibilitySchedule.Read.Directory' -NoWelcome

# Row 14. Which consent policy governs the default user role, if any.
(Get-MgPolicyAuthorizationPolicy).DefaultUserRolePermissions.PermissionGrantPoliciesAssigned

# Rows 1, 2, 5, 13, 15. Conditional Access inventory, including any policy
# whose session control switches continuous access evaluation off.
Get-MgIdentityConditionalAccessPolicy -All |
  Select-Object DisplayName, State,
    @{ n = 'CaeMode'; e = { $_.SessionControls.ContinuousAccessEvaluation.Mode } } |
  Sort-Object State, DisplayName | Format-Table -AutoSize

# Row 4. Standing (permanent) assignments, excluding roles that happen to be
# activated through PIM while this runs. Every row here is a candidate for an
# eligible assignment instead.
Get-MgRoleManagementDirectoryRoleAssignmentSchedule -All -ExpandProperty Principal |
  Where-Object {
    $_.AssignmentType -eq 'Assigned' -and $_.ScheduleInfo.Expiration.Type -eq 'noExpiration'
  } |
  ForEach-Object {
    [pscustomobject]@{
      Role      = (Get-MgRoleManagementDirectoryRoleDefinition -UnifiedRoleDefinitionId $_.RoleDefinitionId).DisplayName
      Principal = $_.Principal.AdditionalProperties.displayName
    }
  } | Sort-Object Role | Format-Table -AutoSize

# Row 4, second half. What is already eligible rather than standing.
Get-MgRoleManagementDirectoryRoleEligibilitySchedule -All -ExpandProperty Principal |
  ForEach-Object {
    [pscustomobject]@{
      Role      = (Get-MgRoleManagementDirectoryRoleDefinition -UnifiedRoleDefinitionId $_.RoleDefinitionId).DisplayName
      Principal = $_.Principal.AdditionalProperties.displayName
    }
  } | Sort-Object Role | Format-Table -AutoSize

# Row 13. Default inbound trust for external organisations.
(Get-MgPolicyCrossTenantAccessPolicyDefault).InboundTrust

# Row 9. Sharing scope and the link type users get by default.
Connect-SPOService -Url 'https://<tenant>-admin.sharepoint.com'
Get-SPOTenant | Format-List SharingCapability, OneDriveSharingCapability,
  DefaultSharingLinkType, DefaultLinkPermission,
  RequireAnonymousLinksExpireInDays, FileAnonymousLinkType

# Basic authentication for SMTP AUTH: tenant default, then per-mailbox overrides.
Connect-ExchangeOnline
Get-TransportConfig | Format-List SmtpClientAuthenticationDisabled

# Mailboxes where SMTP AUTH is explicitly enabled regardless of the tenant default.
Get-CASMailbox -ResultSize Unlimited |
  Where-Object { $_.SmtpClientAuthenticationDisabled -eq $false } |
  Format-Table Identity, SmtpClientAuthenticationDisabled -AutoSize

Expected output

The audit pass produces one artefact per check, and each has a value that needs no further action.

On SharePoint, read the values rather than assuming them. OneDrive can be set more restrictive than SharePoint but never more permissive, and a site can be more restrictive than the organisation but never less. If the scope is Anyone, Microsoft exposes two controls that limit the damage: an expiry in days for Anyone links, and a restriction of those links to view permission only.

Side effects

Row 1 breaks any client still authenticating with a legacy flow, including certificate-based authentication on managed mobile devices. Row 2 needs a documented break-glass path on the emergency accounts, plus at least one phishing-resistant method registered per admin. Microsoft's built-in phishing-resistant MFA strength accepts FIDO2 security keys, Windows Hello for Business or a platform credential, and multifactor certificate-based authentication, so hardware key procurement is a budget item only where none of those is already in place. Row 4 adds an activation step to every administrative action, and the licence count is not the number of admins: Microsoft counts users with eligible or time-bound assignments, plus approvers, plus anyone assigned to or performing an access review. Row 5 blocks legitimate travel until the unblock path is written down.

Rows 6 to 8 raise the false-positive rate on mail from new external counterparties, so the allow-list needs an owner before the policies are promoted. Row 9 ends anonymous link sharing and generates support load. Rows 10 and 11 are the slowest: labels need training, and a DLP policy promoted straight to Block without an audit-mode baseline will stop legitimate work. On row 13, Microsoft advises excluding external users from the ID Protection MFA registration policy when trusting inbound MFA, because the two together leave the guest unable to satisfy either.

Rollback

Conditional Access rows roll back by setting the policy to report-only or disabled, but the change is not instant. Microsoft documents that Conditional Access policy and group membership changes can take up to a day to reach resource providers such as Exchange Online and SharePoint Online, reduced to about two hours by policy-update optimisation. CAE lengthens token lifetime to as much as 28 hours, so a locked-out user is not released by the policy edit alone. Near-real-time enforcement in CAE covers critical events, such as disable, password reset and explicit token revocation, and IP location changes; it does not cover policy edits.

To apply the rollback to a specific user immediately, revoke their sessions. This is the one command on this page that writes.

# Revokes the user's refresh tokens. Next sign-in is evaluated against the
# edited policy set instead of the cached one. Least-privileged scope is
# User.RevokeSessions.All, which is not in the read-only connection above.
Connect-MgGraph -Scopes 'User.RevokeSessions.All' -NoWelcome
Revoke-MgUserSignInSession -UserId 'user@contoso.com'

The same action is available as Revoke Session on the user profile page in the portal. Microsoft notes a delay of a few minutes before revocation lands, and that the call does not revoke sessions for external users, who sign in through their home tenant. Row 4 rolls back by restoring the permanent assignment; note that eligible assignments disappear if the P2 or Governance licence lapses, so licence expiry is itself an unplanned rollback. Rows 6 to 8 roll back by removing the recipients from the preset or reverting the policy action, and Built-in protection reasserts itself underneath.

Two rows do not roll back to the prior state. Row 9 is one: Microsoft warns that if external sharing is turned off and later turned back on, guests regain access, so turning it off at site level first is the only way to prevent that. Row 14 is the other: reverting the consent policy does not remove grants made while it was loose, and revoking those is a separate task against the enterprise application inventory.

Scoring the result

Do not set a Microsoft Secure Score percentage as the target. Microsoft states that Secure Score is not an absolute measurement of how likely a system or data could be breached and should not be read as a guarantee against breach. It is a useful queue of recommended actions, but a percentage makes a poor control objective and a worse audit exhibit.

Evidence control coverage instead: for each of the fifteen rows, the decision taken, the date, the person who took it, and the command output that shows the tenant in that state. That is the artefact an auditor can test. A first pass at the identity and email rows runs through the M365 Security Scorecard, and the full control set is the subject of the Microsoft 365 tenant hardening service.

Limitations

This list assumes a cloud-only or hybrid Microsoft 365 tenant in the Azure commercial cloud. The GCC High, DoD and 21Vianet clouds have different feature availability and different dates; the Exchange Online basic authentication timeline for 21Vianet ran separately. It assumes English-language admin portals, because blade names shift with localisation. It says nothing about endpoint configuration, Intune compliance policy content, or on-premises Active Directory, any of which can undo several of these controls from below.

It also stops applying the moment Microsoft reprices or renames a component. Every licence tier named above was read from Microsoft Learn on the verification date and none of it is a contractual commitment. Finally, no advice here establishes that a given control satisfies a given regulatory obligation. That mapping is a legal judgement, made with counsel, against the text that binds the entity.

Last verified 2026-07-28. Product behaviour, licence tiers, cmdlet permissions and retirement dates checked against the Microsoft Learn pages listed below. The PowerShell was written against the Microsoft Graph PowerShell SDK v2, the SharePoint Online Management Shell and the Exchange Online PowerShell module.