CIS Microsoft 365 Benchmark: a tenant hardening checklist

Most professional firms run their email, files and client communication in one Microsoft 365 tenant. When an examiner, a cyber insurer or a client's security questionnaire asks how that tenant is configured, "the defaults" is a weak answer. The CIS Microsoft 365 Benchmark (formally the CIS Microsoft 365 Foundations Benchmark) gives a firm an outside, consensus standard to point to, and a way to show which settings it applied and why it skipped the rest.

What is the CIS Microsoft 365 Foundations Benchmark?

The CIS Microsoft 365 Foundations Benchmark is a free set of secure configuration recommendations for Microsoft 365, published by the Center for Internet Security (CIS) and developed through a consensus process with practitioners and vendors. CIS announced version 7.0.0 in its June 2026 benchmarks update. That release added 22 new recommendations, moved 12 over from the CIS Microsoft Azure Foundations Benchmark, removed 2 and updated 68.

CIS's assessment tool documentation lists the services the benchmark covers, including Exchange Online, SharePoint Online, OneDrive for Business, Microsoft Teams, Power BI and Microsoft Entra ID. Each recommendation carries a profile. The CIS Benchmarks FAQ describes Level 1 as a base recommendation that can be implemented fairly promptly and Level 2 as defense in depth for environments where security is paramount.

Is the CIS Microsoft 365 Benchmark required?

No law requires it by name. It matters because regulators and clients expect a documented, reasonable configuration, and a published benchmark is an easy one to defend. CIS Control 4 asks firms to establish and maintain a documented secure configuration process, and a benchmark baseline with recorded exceptions is that process for a Microsoft 365 tenant. In California, the Attorney General's 2016 Data Breach Report said the CIS Controls identify a minimum level of information security that organizations collecting or maintaining personal information should meet.

Where should a firm start hardening Microsoft 365?

Start with administrator accounts and sign-in, because a compromised admin or a legacy login bypasses everything else. The checklist below groups first-pass items by area, with Microsoft's documentation for each. Confirm the matching recommendation number and profile level in the v7.0.0 PDF before you change a setting.

Tenant settings are one layer. Pair this work with an accurate device and account inventory, covered in CIS Control 1 and 2, and with endpoint hardening from the CIS Benchmark for Windows 11.

Administrator accounts

• Keep Global Administrator assignments to fewer than five people, as Microsoft recommends, and give everyone else the least-privileged role for their tasks.
• Use separate admin accounts that are not used for email or daily work.
• Create at least two cloud-only emergency access accounts on the onmicrosoft.com domain, protect them with phishing-resistant methods such as passkeys, and alert on every sign-in.
• Where your licensing includes it, use Privileged Identity Management so admin roles are activated only when needed.

Sign-in and authentication

• Require multifactor authentication for every user, consistent with CIS Safeguard 6.3 for externally exposed applications.
• Block legacy authentication. Microsoft reports that more than 97 percent of credential stuffing attacks and more than 99 percent of password spray attacks use legacy authentication. Tenants without Conditional Access licensing can block it through security defaults.
• Prefer phishing-resistant methods for administrators and anyone who approves payments or wires.

App consent

• Limit user consent to applications to verified publishers and low-impact permissions, or turn it off.
• Turn on the admin consent workflow so staff can request an app instead of working around the block.
• Review existing third-party app grants and remove anything unused. This matters more as staff connect AI tools to mailboxes and files.

How should email and sharing be configured?

Tighten email first with Microsoft's preset security policies, SPF, DKIM and DMARC, and a block on external auto-forwarding, then restrict sharing defaults in SharePoint, OneDrive and Teams. Email and file sharing are where client data leaves the firm, and Microsoft's own guidance covers most of the work.

Email

• Turn on the Standard or Strict preset security policies. Microsoft notes they are assigned to no one until you turn them on.
• Publish SPF, DKIM and DMARC records for every domain you send from. Microsoft states that anything less than all three results in substandard protection against spoofing.
• Block automatic forwarding to external addresses unless there is an approved business reason.

SharePoint, OneDrive and Teams

• Set organization-wide external sharing to the most restrictive level that still lets the firm work, and set the default link type to people in your organization.
• If you allow "Anyone" links, require them to expire and limit them to view only.
• Review guest accounts on a schedule and remove guests whose engagement has ended.

How do you confirm the tenant is logging what you need?

Verify unified audit logging yourself, then set retention and alerts. Microsoft states that audit logging is on by default for Microsoft 365 organizations, but auditing is not enabled by default for Small and Medium Business licenses, including Business Basic, Business Standard and Business Premium. Many small firms run on exactly those licenses.

• Confirm unified audit logging is on, using the Exchange Online PowerShell check Microsoft documents.
• Decide how long you need sign-in and audit records, and export them to longer-term storage if your license keeps them for less time.
• Send alerts for new admin role assignments, emergency account sign-ins and new inbox forwarding rules to someone who will act on them.

How should a firm handle settings it cannot apply?

Document them as exceptions instead of leaving them silently unapplied. Some recommendations will break a workflow, conflict with a client requirement or depend on a license the firm does not have. For each one, record:

• The recommendation and profile level.
• Why the firm is not applying it.
• The compensating control, if any.
• Who approved the exception and when it will be reviewed.

An exception list turns a partial baseline into a defensible one. Keep it with the configuration report so both can be produced together.

What should your firm do this quarter?

Run one assessment against the current version, fix the identity items, and write down the rest. A practical sequence:

• Download the v7.0.0 PDF from CIS and decide which profile level is your target.
• Assess the tenant, either with CIS-CAT Pro if you are a SecureSuite member or by walking the recommendations manually.
• Fix administrator, sign-in and app consent findings first.
• Schedule email, sharing and logging changes with user communication, since some will change how staff work.
• Record exceptions and set a date to reassess when CIS publishes the next version.

How does s90 help?

s90 assesses Microsoft 365 tenants against the CIS benchmark, applies the settings that fit the firm and documents the exceptions in a form an examiner or client can read. If you want to know where your tenant stands, we can walk through the results with you.