Microsoft 365 security checklist for businesses in Pakistan

By the FarSec team · Updated 2026-11-05

Why Microsoft 365 is the main target

For many Pakistani companies, Microsoft 365 holds everything: email with banks and clients, contracts in OneDrive and SharePoint, Teams chats and invoices. An attacker who gets into one mailbox can read past conversations, send a fake "updated bank details" email from a real address, and set hidden forwarding rules that copy every new message out. This invoice fraud is one of the most expensive attacks a small business can suffer, and it needs no malware at all.

1. Sign-in protection

• MFA for every user, not just managers. The free Security defaults setting in Microsoft Entra ID turns it on for the whole tenant. Larger licences can use Conditional Access policies instead.
• Prefer the Microsoft Authenticator app or a security key over SMS codes, which can be intercepted or moved to a new SIM.
• Block legacy authentication (old POP, IMAP and basic sign-in protocols). They skip MFA, and password-spraying attacks rely on them.
• Remove leavers on their last day and review guest accounts every quarter.

2. Admin accounts

• Two to four Global Administrators at most. Everyone else gets a narrower role, such as User Administrator or Exchange Administrator.
• Separate admin accounts (for example admin.ali@company) that are never used for daily email or browsing.
• Strongest MFA on admin accounts, and one sealed "break-glass" account for emergencies, stored offline.
• Check who has admin rights now. Former IT vendors and ex-employees often still do.

3. Email protection

• SPF, DKIM and DMARC for your domain, so criminals cannot easily send email that looks like it came from you. Start DMARC at p=none to watch reports, then move to quarantine and reject.
• Turn on the preset security policies in Microsoft Defender for Office 365 (Standard or Strict) for anti-phishing, Safe Links and Safe Attachments where your licence includes them.
• Block automatic forwarding to external addresses. Attackers use hidden forwarding rules to copy mail out quietly.
• Show an "External" tag on emails from outside the company, so staff think twice before acting on a payment request.

4. Files and sharing

• Limit "Anyone with the link" sharing in SharePoint and OneDrive, or give those links an expiry date.
• Restrict sharing of sensitive sites (finance, HR, legal) to named people only.
• Review third-party apps that users have granted access to their mail and files. Remove unknown ones, and require admin approval for new app consent.

5. Logging and alerts

• Make sure unified audit logging is on and you know how long logs are kept on your licence. Without logs, nobody can tell what an attacker read or changed.
• Turn on alerts for new inbox forwarding rules, new admin role assignments and sign-ins from unusual countries.
• Check Microsoft Secure Score once a month. It lists missing settings in order of impact.

6. Backup

Microsoft keeps your service running, but protecting your data is your job. Deleted items and older versions are kept only for limited periods, and a ransomware infection on a synced laptop can overwrite OneDrive files. Use a dedicated Microsoft 365 backup that stores copies outside your tenant, and test a restore of one mailbox and one SharePoint site.

Quick self-test

• Can any user in your company sign in with only a password?
• How many Global Administrators do you have, and do you know every one of them?
• Does your domain publish a DMARC record, and is it set beyond p=none?
• Would you notice if someone added a rule forwarding the CEO's email to Gmail?
• When did you last restore a deleted mailbox?

If any answer is "not sure", start there. A Microsoft 365 configuration review is part of every FarSec security assessment.