The terse version. Every action from this series as a list you can run down, with the way to check each one and a pointer to the article that argues for it. No reasoning here on purpose. If a row makes you uneasy, the article behind it is where the argument lives.
Tiers mean the same thing they meant in the identity series. C is critical: the cost of getting it wrong is a breach or an outage and I would not sign off without it. R is recommended: I would want a reason for not doing it. O is optional: worth a decision, not worth an argument. Commands assume a connected Exchange Online session unless noted.
1. Data and email: authentication
| Tier | Do this | How to verify | See |
|---|---|---|---|
| C | Hold the registrar and DNS hosting account under privileged-access discipline | Named owners, strong auth, documented recovery path at the provider | [BP 2.1] |
| C | Publish SPF per sending domain, ending -all | Resolve-DnsName <domain> -Type TXT shows one v=spf1 record ending -all | [BP 2.1], [BP 2.1.1] |
| C | Stay inside the ten-lookup limit and never flatten Microsoft’s include | Evaluate the record recursively, not off its face; nested includes count and Microsoft’s own include is not a leaf. No literal Microsoft addresses present | [BP 2.1.1] |
| C | Enable DKIM for every custom domain, publishing the values the service gives you | Get-DkimSigningConfig | FL Domain,Enabled,Status returns enabled and valid | [BP 2.1.1] |
| C | Take DMARC to p=reject on every domain and subdomain | Resolve-DnsName _dmarc.<domain> -Type TXT shows p=reject | [BP 2.1], [BP 2.1.1] |
| C | Prove enforcement in both directions, not just in DNS | A forgery from outside the SPF record fails aligned SPF and DKIM, and reaches the intended verdict both inside your tenant and at an external receiver | [BP 2.1.1] |
| C | Send aggregate reports to a monitored address, not a person | Reports are received and parsed rather than read, senders are categorised as authorised or not, a new source triggers review, and retention is defined. A hosted service or your own parser both qualify; a mailbox alone does not | [BP 2.1.1] |
| C | Publish DMARC for the initial onmicrosoft.com domain | A record exists at _dmarc.<tenant>.onmicrosoft.com | [BP 2.1.1] |
| C | Where a gateway fronts the tenant, enable enhanced filtering on that connector | Get-InboundConnector | FL Name,EFSkipLastIP,EFSkipIPs,EFUsers; EFSkipLastIP False with an empty EFSkipIPs is off, not on; inbound mail through the gateway carries X-MS-Exchange-ExternalOriginalInternetSender | [BP 2.1] |
| R | Add trusted ARC sealers only where an intermediary demonstrably breaks authentication | Get-ArcConfig | FL ArcTrustedSealers lists only vendors you chose | [BP 2.1.1] |
| O | Enable inbound DANE with DNSSEC and publish a TLS reporting record | Get-SmtpDaneInboundStatus -DomainName <domain>; _smtp._tls record present | [BP 2.1.1] |
Note on inbound honouring: the anti-phishing policy already honours the sender’s DMARC policy by default, including in the default policy, and rejects on reject. There is no row for turning it on because there is nothing to turn on. The row above about enhanced filtering is what determines whether that default does anything in your estate.
2. Identity and access
| Tier | Do this | How to verify | See |
|---|---|---|---|
| C | Block legacy authentication with a Conditional Access policy you own | A policy exists in your own naming convention, enabled, with break-glass excluded | [BP 2.1] |
| C | Disable basic authentication for SMTP client submission org-wide | Get-TransportConfig | FL SmtpClientAuthenticationDisabled returns True; a basic-authentication submission attempt fails | [BP 2.1], [BP 2.3] |
| C | Inventory and date every per-mailbox SMTP AUTH exception | Get-CASMailbox finds explicit overrides only; a $null inherits the organisation setting, so the real inventory is Entra sign-in logs filtered to Authenticated SMTP, corroborated by message trace | [BP 2.3] |
| C | Block sign-in on shared and resource mailbox accounts | Correlate ExternalDirectoryObjectId to the Entra object and read accountEnabled; every row returns False. Synced objects are disabled on-premises, because a change here is overwritten | [BP 2.1] |
| R | Reject Direct Send unless a named device depends on it | Get-OrganizationConfig | FL RejectDirectSend returns True; an anonymous submission using an accepted domain in the envelope sender is refused with 550 5.7.68, while authenticated submission and connector relay still deliver | [BP 2.1] |
3. Data and email: threat policies
| Tier | Do this | How to verify | See |
|---|---|---|---|
| R | Assign the Standard preset to all users, or Strict where tolerance is lower | Get-EOPProtectionPolicyRule and Get-ATPProtectionPolicyRule show enabled rules covering everyone | [BP 2.2] |
| R | If you run custom policies instead, author a quarantine policy with notifications on | Get-QuarantinePolicy shows a custom policy with end-user notification enabled | [BP 2.2] |
| R | Populate user and domain impersonation protection | Protected users include the people who get impersonated, with external addresses; partner domains listed | [BP 2.2] |
| R | Set outbound automatic forwarding explicitly off | Get-HostedOutboundSpamFilterPolicy | FL AutoForwardingMode | [BP 2.2] |
| R | Block automatic forwarding at the remote domain as well | Get-RemoteDomain | FT DomainName,AutoForwardEnabled returns False on the default domain; any named partner exception carries a documented owner and purpose. Sweep mail flow rules separately, because a redirect action is not covered by the outbound policy | [BP 2.2] |
The two forwarding rows are not a duplicate. The compliance baselines check the remote domain and the product exposes the outbound policy, and an estate that sets only one will be correctly configured and still fail an assessment.
4. Monitoring and response
| Tier | Do this | How to verify | See |
|---|---|---|---|
| C | Confirm the unified audit log is on, never assume it on Business SKUs | Get-AdminAuditLogConfig | FL UnifiedAuditLogIngestionEnabled, run from an Exchange session; a test action appears in an audit search | [BP 2.1] |
| C | Confirm mailbox auditing is on at the organisation level | Get-OrganizationConfig | FL AuditDisabled returns False | [BP 2.1] |
| R | Enable search-query auditing on the accounts where it matters | Set-Mailbox <user> -AuditOwner @{Add="SearchQueryInitiated"} on executives, privileged admins, legal and HR, and sensitive shared mailboxes. Needs premium auditing to generate, and customising AuditOwner stops Microsoft managing that sign-in type’s defaults | [BP 2.1] |
| C | Route alert notifications to a monitored queue | Get-ProtectionAlert recipients are a shared queue, not an individual | [BP 2.1] |
| R | Decide audit retention against the incident you expect, before you need it | Licensing and any retention policy match the stated requirement; note ten years is not retroactive | [BP 2.1] |
| R | Set the user-reported destination explicitly, never leave it blank | The submission policy names a monitored mailbox, not an unset default | [BP 2.2] |
| R | Remove the legacy reporting add-ins in favour of the built-in button | Neither add-in appears under integrated apps; the report button is enabled | [BP 2.2] |
Do not set the mailbox audit age limit. It no longer governs retention in Exchange Online and a script that sets it reports success while doing nothing.
5. Device trust
| Tier | Do this | How to verify | See |
|---|---|---|---|
| O | Apply read-only Outlook web access plus application-enforced restrictions for unmanaged devices | Get-OwaMailboxPolicy | FL ConditionalAccessPolicy plus a matching Conditional Access policy | [BP 2.2] |
| R | Disable consumer and third-party storage providers | Get-OwaMailboxPolicy | FL AdditionalStorageProvidersAvailable returns False | [BP 2.2] |
Both rows now reach the desktop, not just the browser, because Outlook web policies govern the new Outlook for Windows. And read-only blocks download and offline mode, not printing; attachments stay viewable in the browser unless you use the stricter variant.
6. Data and email: retention and archiving
| Tier | Do this | How to verify | See |
|---|---|---|---|
| R | Extend deleted item retention to 30 days on existing mailboxes and the mailbox plan | Get-Mailbox | FT RetainDeletedItemsFor and Get-MailboxPlan | FT RetainDeletedItemsFor | [BP 2.2] |
| R | Use Purview retention policies as the general instrument; reserve litigation hold for live matters | A retention policy covers Exchange; holds map to named matters | [BP 2.2] |
| O | Enable archive mailboxes only where growth warrants it | Get-Mailbox | FT ArchiveStatus | [BP 2.2] |
| O | Decide the automatic archiving position deliberately; there is no enable parameter, but a threshold of 100 disables it tenant-wide | Get-OrganizationConfig | FL AutoArchivingThresholdPercentage | [BP 2.2] |
| O | Treat auto-expanding archiving as irreversible and scope it deliberately | Enabled only on mailboxes with a stated growth case, never tenant-wide by default | [BP 2.3] |
7. Tenant governance
| Tier | Do this | How to verify | See |
|---|---|---|---|
| O | Audit legacy distribution lists and public folders and decide case by case | A written decision per collaboration-heavy object; broadcast lists left alone | [BP 2.2] |
8. The dated items, which are not settings
| Tier | Do this | How to verify | See |
|---|---|---|---|
| C | Confirm no POP3 or IMAP4 client still negotiates TLS 1.0 or 1.1 | Deadline 31 July 2026; rollout 1 August to 31 December; failures are hard, not degraded | [BP 2.3] |
| C | Build your Exchange Web Services allow list before Microsoft infers one for you | An explicit list exists and every entry is an application you can name | [BP 2.3] |
| C | Know the organisation-level EWS setting overrides per-mailbox settings | Your inventory was built from the organisation setting, not from mailboxes | [BP 2.3] |
| C | Diary the basic-auth submission date and re-verify it before acting | End of December 2026 recorded, with the withdrawn earlier date noted as withdrawn | [BP 2.3] |
| R | Replace any runbook step using retired search, hold or client access rule surfaces | No runbook references classic content search, mailbox search or client access rules | [BP 2.3] |
| R | If first-party backup is enabled, record what it is not governed by | The retention design states that backups are outside Purview retention and not discoverable | [BP 2.3] |
One closing note on the reference frameworks, because someone will ask. Where a federal SCuBA control corresponds to a row above, I have anchored to it, and its Exchange section was restructured recently enough that a good deal of published commentary cites identifiers that no longer exist. Several rows here have no corresponding control at all, including everything on archiving, deleted-item retention, user reporting and transport authentication. That is a property of the framework rather than a gap in the row.
Best Practices
‹ Previous: [BP 2.3.1] Build Sheet: Protocol Retirement Discovery
Next: [BP 3] Collaboration: The Surface You Already Shared ›
