Checklist for Preventing Brute Force Attacks in Microsoft 365

This document is a checklist designed for IT and security administrators aiming to enhance the security of Microsoft 365 environments against brute-force attacks. It outlines immediate, medium-term, and advanced actions that can be taken to mitigate risks associated with password-based attacks. Immediate actions include enabling audit logging, disabling legacy authentication protocols, and restricting PowerShell access. Medium-term actions focus on monitoring for indicators of compromise, enforcing strong password and session policies, and reducing admin privileges. Advanced actions involve refining conditional access policies, deploying automated threat response solutions, and monitoring app permissions. Each action item includes specific recommendations and notes for implementation, emphasizing a proactive approach to security rather than reactive measures. The checklist serves as a practical guide for organizations looking to secure their Microsoft 365 tenants effectively.