/
Microsoft 365 Security Inspection Report

Microsoft 365 Security Inspection Report

  • Verified

    • You can find this module at the Company level only.

    This module appears only for tenants on the Silver Plan

    The Microsoft 365 Security Inspection Report provides a comprehensive overview of the security posture within the Microsoft 365 environment. It evaluates various security controls, identifies vulnerabilities, and offers recommendations to enhance security measures, ensuring robust protection against potential threats and breaches; using the CIS Microsoft 365 Benchmarks which can be found in detail here: CIS Microsoft 365 Benchmarks

    For GCC High tenants, please make sure to use the CS_Security_Reader, which contains limited security reader permissions. This will allow you to access the necessary security and assessment data.

    Refer to: https://cybercns.atlassian.net/wiki/spaces/CVB/pages/2407465144/Microsoft+365+Security+Inspection+Report#Configure-API-Permissions

    CS-Video.png

    Visit our YouTube Channel for more video content: https://www.youtube.com/@connectsecure

    Table of Contents

    Microsoft 365 Security Inspection - Licensing Requirements

    M365 Inspector requires the tenant to have an active subscription to Microsoft Entra ID P1 (formerly known as Azure Active Directory Premium P1) or Microsoft Entra ID P2 (formerly known as Azure Active Directory Premium P2) or a subscription that includes Microsoft Entra ID P1 or P2.

    Microsoft 365 Security Inspection - Details

    Access the Microsoft 365 Security Inspection from the Cloud Assessments category.

    image-20250805-185659.png

    Getting Started - Application Thumbprint Certificate

    Before you begin the setups below, you must download the Certificate for Application Thumbprint.

    • Log in to your ConnectSecure portal tenant (https://portal.myconnectsecure.com)

    • Navigate to Global > Settings > Integrations > Microsoft 365 Security Inspector.

    image-20250303-194549.png

    • Scroll down and click on the Download Certificate. This file will be used directly in the Azure Portal in later steps.

    image-20241219-142622.png

    Certificate Renewal

    Upon logging in, if your M365 certificate is expired; you will be prompted by the following message to help get the certificate renewed.

    image-20251116-191018.png

    Steps to Proceed:

    1. ConnectSecure: Navigate to Global → Settings → Integrations → Microsoft 365 Security Inspector. Select the credential that needs to be updated and click “Download Certificate”.

    2. Azure Portal: Log in to portal.azure.com → App Registrations → All Applications, and select the relevant application (e.g. ConnectSecure_M365_Audit).

    3. Upload the Certificate: Go to Certificates & Secrets under Client Credentials, click Upload Certificate, and upload the file downloaded from ConnectSecure. Then click Add.

    4. Copy Thumbprint: Copy the Newly Generated Thumbprint from Azure.

    5. Paste the Thumbprint: Return to ConnectSecure → Global Settings → Integrations, and paste the copied thumbprint into the “Application Thumbprint” field.

    6. Finalize: Update to complete the process.

    M365 Audit - Setup in Azure Portal

    1. Log in to the Azure portal (http://portal.azure.com ).

    2. Tap on the ‘App registrations’ option in Azure services (or use the Search).

    image-20241219-143105.png

    1. Tap on the ‘New registration’ option.

    image-20241219-143126.png

    1. Complete the required fields.

      1. Name = Give this application registration a name of your choice (IE: ConnectSecure_M365_Audit)

      2. Support Account Type = Single Tenant for Non-CSP, Multi Tenant for CSP

      3. Redirect URI = Set the platform to Web and use: https://authccns.mycybercns.com

      4. Tap on Register to complete

    image-20241219-143420.png

    1. Record the Application (client) ID and Directory (Tenant ID) values from the screen.

    image-20241219-143610.png

    Generate Client Secret

    1. Click on the ‘Add a certificate or secret’ link from the Client credentials section.

    image-20241219-143740.png

    1. Tap on ‘New client secret’.

    image-20241220-165442.png

    1. Set the client secret required fields for Description and Expires, then tap Add.

    image-20241219-144013.png

    1. Copy the Value generated and store it; this will be used in the ConnectSecure portal setup.

    image-20241219-144124.png

    1. Tap on the Certificates option.

    image-20241219-144420 (1).png

    1. Tap on ‘Upload certificate’.

    image-20241219-144457.png

    1. Select the application thumbprint certificate you downloaded at the beginning steps and give it a description (IE: ConnectSecure_M365_Audit), then tap Add.

    image-20241219-144623.png

    1. After the upload, you will see the Thumbprint value; record this for use in ConnectSecure.

    image-20241220-165213.png

    NOTE: When you copy the thumbprint value it will copy the full value; you will only see a partial thumbprint value on the screen in the UI

    Configure API Permissions

    1. Under the Manage section, tap on the Manifest option.

    image-20241219-145123.png

    1. Download one of the two JSON files below, open it, and make the necessary edits.

    We offer two role options for conducting M365 assessments:

    • Option 1: Uses the Global Reader role, providing full visibility across tenant-wide settings, Secure Score, compliance data, and audit logs.

    • Option 2: Uses the Security Reader role, which aligns with least-privilege best practices but offers a more limited scope. Selecting this option will restrict certain findings due to permission constraints.

    When the Security Reader role is selected, access to specific data such as Last Logon Date, MFA status, and Secure Score details may be restricted by Microsoft APIs.

    You can supplement missing data using Microsoft Graph API queries or PowerShell scripts, if elevated permissions are not available.

    (Option 1)

    CS_Global_Admin contains global admin permissions.

    This JSON file provides write access to the tenant

    (Option 2)

    CS_Security_Reader contains limited security reader permissions

    1. In the ‘Microsoft Graph App Manifest (New) file, replace the 'requiredResourceAccess’ section with the copied data from the downloaded JSON file from the step above. You can open the JSON file with notepad or a word processor to copy the contents.

    image-20241219-145638.png

    1. Tap on the Save button to complete.

    image-20241219-145745.png

    1. Tap on API Permissions from the left panel, then tap the ‘Grant admin consent for…’ button.

    image-20241219-145916.png

    The status should display green check marks once permissions are granted:

    image-20250303-201124.png

    Assign Roles in Microsoft Entra Roles and Administrators

    1. At the top, use the Search, enter ‘Microsoft Entra Roles and Administrators’, and tap to select.

    image-20241219-150228.png

    1. Search for and tap on the ‘Global Reader’ option.

    GR.png

    1. Select the ‘Add Assignments’ button.

    GR Assigmnent.png

    1. Search for your added application name here and tap Add. (IE: ConnectSecure_M365_Audit)

    image-20241219-194208.png

    1. You must tap on Add to save.

    image-20250303-201427.png

    1. The user who created the app registration will appear; you can add additional users here if needed.

    image-20250303-201930.png

    Enter optional policy descriptions and justifications as required; this may vary depending on your Azure portal settings.

    M365 Audit - Setup in ConnectSecure

    1. Login to your ConnectSecure portal (IE: portal.myconnectsecure.com)

    2. Please navigate back to Global > Settings > Integrations > Microsoft 365 Security Inspector, where we originally obtained the download certificate (application thumbprint).

    image-20250303-202037.png

    Credentials

    Complete the required fields with your values from the previous steps outlined above.

    Field Name

    Description

    Field Name

    Description

    Enter Name

    Use a name of your choice to identify the M365 creds being used.

    Microsoft 365 Auth Endpoint

    (Default) Global Service (https://login.microsoftonline.com)

    US Government (https://login.microsoftonline.us)

    Tenant ID

    Enter the Directory (tenant) ID from the Azure portal app registration.

    Application Client ID

    Enter the Application (client) ID from the Azure portal app registration.

    User Principal Name

    Enter the username (with domain) of the user who created the app registration.

    Application Client Secret

    Enter the ‘Value’ from the Client Secret.

    Application Thumbprint

    Enter the value generated from the Thumbprint under the app registration ‘Certificates’ section.

    Select Associated Company

    Select to associate with a ConnectSecure company.

    image-20241219-195152.png

    Proceed to Company Mapping below.

    Company Mapping

    You will need to map the ConnectSecure company to the M365 company.

    1. Tap on the Company Mapping tab within the Microsoft 365 Security Inspector integration and use the ‘Add’ button to create a new mapping.

    image-20241220-134518.png

    1. Select from the options to import a new company from M365 into ConnectSecure or map an existing ConnectSecure company to the M365 company.

    image-20241220-134613.png

    1. In this case, I will map to an existing ConnectSecure company and tap the next button. You will then select the M365 company from the Local Company (ConnectSecure).

    image-20241220-134858.png

    1. Tap on the Add, then Finish to complete mapping.

    image-20241220-134939.png

    Start M365 Sync

    The M365 sync operation may take 3 to 4 hours, depending on tenant size and user volume. In some cases, full synchronization can take up to 24 hours to complete.

    Once you complete the mappings, navigate to Cloud Assessments > Microsoft 365 Security Inspection Report and click on the Sync option to start the assessment scan.

    image-20250320-014716.png

    Tap on the jobs to see the syncing status.

    image-20250320-014919.png

    You can review the Findings Summary or the M365 Audit Report once the assessment is finished, which will provide findings, remediated records, and a remediation summary.

    Tap on the PowerPoint, Word, or Excel file icons for report data.

    image-20250303-202947.png

    Microsoft 365 Remediation Plan

    A list of detected problems organized by severity, showing which issues still need action. This helps prioritize fixes based on risk level.

    image-20250808-192232.png

    Click on any of the findings name to see the details.

    image-20260303-021104.png

    To suppress a problem, use the checkbox or the three-dot action menu.

    image-20250808-192540.png

    Microsoft 365 Remediated Records

    Problems that have already been resolved. Their status is marked as remediated and no longer require attention.

    image-20250808-192359.png

    Microsoft 365 Suppression

    The Suppression field shows that a finding or alert has been intentionally hidden from active review. This usually means the issue is considered low-risk, has been addressed through other security measures, or is not relevant for remediation. Suppressed items won’t trigger alerts or appear in summary dashboards unless the suppression is lifted.

    image-20250808-191741.png

    To unsuppress a record, select the checkbox or use the three-dot action menu.

    image-20250808-192841.png

    Microsoft 365 Security Inspection Dashboard

    Review the findings in the company-level dashboard.

    image-20250122-210809.png

    Microsoft 365 Security Inspection Items

    #

    Check

    Severity

    #

    Check

    Severity

    1

    Safe Attachments Not Enabled

    Critical

    2

    Microsoft Secure Defaults

    Critical

    3

    Domains with no DKIM Record Selector 2

    High

    4

    Applications Registered to Tenant with Client Secret (Password) Credentials

    Critical

    5

    Expired Domain Registration Found

    High

    6

    Password Synchronization Enabled

    Informational

    7

    Exchange Mailboxes with SendOnBehalfOf Delegates Found

    High

    8

    Do Not Bypass the Safe Links Feature

    Critical

    9

    Microsoft Teams External Domain Communication Policies

    High

    10

    Spam ZAP (Zero-Hour Auto Purge) Not Enabled

    Critical

    11

    SharePoint 'Anyone' Shared Links Never Expire

    Critical

    12

    Mailbox Auditing Should be Enabled at Tenant Level

    Critical

    13

    Tenant License Level

    Informational

    14

    Exchange Mailboxes with Internal Forwarding Rules Enabled

    High

    15

    MFA Not Required for Device Registration

    Critical

    16

    Applications Registered to Tenant with Certificate Credentials

    Critical

    17

    DKIM Not Enabled for Exchange Online Domains

    High

    18

    No Conditional Access Policies Mitigate User Risk

    Critical

    19

    Domains with SPF Soft Fail Configured

    High

    20

    Domains without DMARC Policy Action Configured

    High

    21

    Federation Trusts in Tenant

    Informational

    22

    SharePoint Legacy Authentication is Enabled

    Critical

    23

    Exchange Mailboxes Hidden from Global Address Lists Found

    High

    24

    No Custom Anti‑Malware Policy Present

    Medium

    25

    Dangerous Default Permissions

    Critical

    26

    Iframes Not Identified as Spam

    High

    27

    User Accounts Created via Email Verified Self‑Service Creation Found

    High

    28

    Exchange Online Mailboxes with SMTP Authentication Enabled

    Critical

    29

    Domains with no DMARC Records

    High

    30

    Azure PowerShell Service Principal Assignment Not Enforced

    Critical

    31

    Users Found in Azure AD Roles

    Informational

    32

    No Custom Anti‑Phishing Policy Present

    Medium

    33

    DLP Policies Not Enabled and Enforced

    Low

    34

    Exchange Mailboxes with Forwarding Rules to External Recipients

    High

    35

    Anti‑Domain Spoofing Not Fully Enabled

    High

    36

    Phish ZAP (Zero‑Hour Auto Purge) Not Enabled

    Critical

    37

    Office Message Encryption is Not Enabled

    High

    38

    Conditional Access Policies ‑ Legacy Authentication

    High

    39

    No Transport Rules to Block Executable Attachments

    Critical

    40

    Suspicious Outgoing Spam Messages Not Monitored

    High

    41

    Safe Links Click‑Through is Allowed

    Critical

    42

    Tenant Transport Rules

    Informational

    43

    Outgoing Sharing Invitations are Not Monitored

    High

    44

    Exchange Mobile Device Mailbox Security Policies

    Review Required

    45

    Third‑Party Applications Allowed

    Critical

    46

    Highly Privileged Hidden Role Assignment Found

    Critical

    47