Microsoft 365 tenant security assessment

1Executive summary

Northwind Freight's Microsoft 365 tenant is configured like a company that grew faster than its IT team: the platform's security features are licensed and mostly present, but several defaults that were acceptable when the tenant was created in 2019 are still in force. Kestrel Assurance reviewed the tenant configuration between 8 and 19 September 2026 and recorded 24 findings: 2 critical, 5 high, 11 medium and 6 low. We found no evidence of an active compromise in the logs available to us, with one exception under F-06 that Northwind should treat as a suspected incident until the review in progress says otherwise.

The two critical findings describe one weakness from two sides. Legacy SMTP authentication (F-01) lets a password alone open 14 mailboxes, including the invoicing mailbox, with no second factor. Global Administrator accounts protected only by SMS or push approval (F-02), with no conditional access policy for administrator roles (F-04), mean that one convincing phishing page shown to one administrator hands over the whole tenant. Together with open mail forwarding (F-06), these four findings form the path we would take if we were asked to attack the tenant, and they are the reason this report ends in a 30-day plan rather than a quarterly roadmap.

The remaining findings are surface and visibility. Audit retention of 90 days (F-05) limits any future investigation, 41 stale guest accounts (F-07) and three anonymously shared SharePoint sites (F-03) widen the exposure, and the medium and low items in section 5 are standard hardening. All seven critical and high findings can be closed within 30 days by Northwind's own IT team. Two of them, F-05 and F-07, have a native fix that depends on a licensing decision set out in section 7 and a scripted alternative that does not.

2Scope and method

The assessment covered the configuration of one Microsoft 365 tenant as it stood in September 2026. It did not test people, endpoints or code.

How the review was done

• Access. Kestrel held the Global Reader and Security Reader roles from 8 September. Northwind removed both on 19 September at 16:40 CEST and confirmed the removal in writing. No write action was taken in the tenant.
• Collection. Settings were exported on 17 September 2026 with Microsoft Graph PowerShell and Exchange Online PowerShell, and cross-checked in the admin centres. Counts in this report are as of that export.
• Comparison. Observed values were compared with the Kestrel Microsoft 365 baseline, version 4.2 (September 2026), which follows the vendor's published security defaults and adds the controls Kestrel sees defeat real attacks. Appendix A lists every setting and its baseline value.
• Logs. Entra sign-in logs (30 days) and the unified audit log (90 days) were searched for use of the weak configurations found, not for a general compromise assessment.
• Interviews. Two working sessions with Northwind IT (Head of IT, Exchange administrator) on 12 and 15 September established which configurations are intentional.
• Not done. No exploitation, phishing simulation, endpoint testing, review of on-premises Active Directory, or review of third-party applications connected through single sign-on.

Screenshots, exports and the working findings file are held in the Kestrel evidence store under reference KA-2026-0917 and retained for 12 months from the report date.

3Severity scale

Severity rates the configuration as observed, not the likelihood that Northwind is targeted. Where two findings combine into one attack path, both carry the higher rating and say so.

4Critical and high findings

Each finding gives the evidence as exported on 17 September 2026, the impact if it is left as is, the fix Kestrel recommends, the owner agreed with Northwind IT on 19 September and an effort estimate for that owner. Setting and command names are written exactly as they appear in the admin centres and PowerShell modules.

5Medium and low findings

Medium findings are due within 90 days and low findings in the next planned change window, as defined in section 3. Evidence and fix detail for each is in the working file handed over on 19 September (KA-2026-0917-findings.xlsx).

630-day priority plan

The plan closes all seven critical and high findings, plus the three medium findings that block them, in the order that removes the most risk soonest. Day 1 is the day Northwind accepts this report. Nothing in it needs a new licence except the native option for F-05 and F-07.

Days 1 to 2

Preserve the invoicing@ audit log and disable the 4 delete-and-forward rules. Reset the 4 accounts. Remove the 2 Global Administrator accounts from CA-Exclusions. Disable the 41 stale guests.

Closes F-06 step 1, F-04 step 2, F-07 step 1. Owner: IT operations, identity lead.

Days 3 to 7

Identify or block the 2 unattributed SMTP AUTH sources. Order FIDO2 keys. Reduce standing Global Administrators to 3 and retire it-admin@. Set automatic forwarding off. Deploy the block-legacy-authentication policy in report-only mode.

Closes F-06, F-02 step 1. Owner: Head of IT, IT operations.

Days 8 to 14

Enable the block-legacy-authentication policy and disable SMTP AUTH at tenant level. Create CA-Admins-01 in report-only mode. Set the 3 SharePoint sites to guests only and start the anonymous link review.

Closes F-01. Starts F-03. Owner: IT operations, SharePoint administrator.

Days 15 to 21

Register FIDO2 keys with every administrator in one session, then enable CA-Admins-01. Send Entra logs to storage with 365-day retention. Take the licensing decision on audit retention and access reviews (section 7). Revoke the 212 anonymous links.

Closes F-02, F-04, F-03, F-05 step 1. Owner: Head of IT, identity lead.

Days 22 to 30

Delete the 41 guests and restrict invitations. Apply the audit retention option chosen. Document or remove each of the remaining 61 CA-Exclusions members. Route all alert policies to the IT operations queue and clear the 312 open alerts.

Closes F-07, F-05, F-12, F-15, F-16. Owner: identity lead, IT operations.

Kestrel will re-test all seven critical and high findings in the week of 26 October 2026 and issue version 1.1 of this report with closure status. The re-test is included in the engagement.

7Open questions for Northwind

Three questions were open when this report was issued. Each changes the shape of a fix, not whether it is needed.

1. Which systems use the two unattributed IP addresses that authenticate with SMTP AUTH (F-01)?

   If no owner is found by day 7, Kestrel recommends blocking them and waiting for a report of something broken. An unknown system that sends mail as Northwind is a larger risk than a printer that stops.

2. Is anonymous sharing from /sites/Tenders a deliberate way of working with carriers, or a shortcut that stuck (F-03)?

   If deliberate, F-03 becomes a process change with a guest-based alternative, and Kestrel would like the Commercial team in the design session so that the replacement is used rather than bypassed.

3. Does Northwind hold, or intend to buy, Entra ID P2 or Entra ID Governance and Audit (Premium) (F-05, F-07)?

   With the licences, one-year retention policies and quarterly guest access reviews are native and need no upkeep. Without them, a daily log export and a scripted guest review reach the same outcome with about half a day of operations work each quarter.

AAppendix: tenant settings checked

Every setting compared against the Kestrel baseline, with the value observed on 17 September 2026 and the finding it produced. Settings that matched the baseline are listed so that the next assessment can confirm they still do.