Microsoft 365 Best Practices Security Assessment Guide

This guide outlines the process for conducting a Microsoft 365 best practices security assessment. It describes the shared security model of Microsoft 365, emphasizing the responsibility of businesses to assess their security posture and determine necessary services and controls. The document details Avalon's approach to assessing security settings and policies, which includes comparing current configurations against established best practices from organizations such as the Center for Internet Security (CIS), the National Institute of Standards and Technology (NIST), and the Cybersecurity and Infrastructure Security Agency (CISA). The assessment process involves a combination of manual review and automation, utilizing authenticated view-only admin access to verify relevant settings. The findings are documented in a detailed report that indicates whether the settings pass, fail, or are in a warning state, along with strategic recommendations for addressing any identified shortcomings. This guide serves as a resource for organizations looking to enhance their Microsoft 365 security measures.