Microsoft 365 Security Hardening Checklist for Indian Enterprises: 25 Checks by Licence Tier

Many Microsoft 365 tenants in India were set up quickly, years ago, by whoever was available, and have been accumulating users, apps and exceptions ever since. The platform has grown an entire security stack in that time, but almost all of it is off until someone switches it on, and what you can switch on depends on the licence you bought. This Microsoft 365 security checklist has 25 items grouped by licence tier, so you can work through the ones you already pay for before anyone sells you a higher one. The items that also help meet a CERT-In or DPDP obligation are marked, because for an Indian enterprise those are the ones the auditor asks about first.

Reviewed October 2026. Licence inclusions below reflect Microsoft's published plan comparisons for Business Premium, Microsoft 365 E3 and E5 at the time of writing; Microsoft moves features between plans, so check the current comparison before you buy on the strength of a line here. Secure Score names and portal paths also change; the control does not. The CERT-In and DPDP markings are an engineering guide, not legal advice; most DPDP duties apply from 13 May 2027.

• 25: checks, grouped into what every tenant can do, what Business Premium and E3 add, and what E5 adds
• 180 days: of audit log retained by default on the standard audit plan, which is exactly the CERT-In minimum
• 2: regulatory clocks, CERT-In and DPDP, that the marked items help you meet

What each tier gives you

• Identity. Every tenant: Security defaults, MFA, basic audit; Business Premium and E3: Entra ID P1: Conditional Access, self-service password reset with on-premises writeback; E5: Entra ID P2: Privileged Identity Management, Identity Protection risk policies, access reviews (advanced reviews need Entra ID Governance)
• Devices. Every tenant: None; Business Premium and E3: Intune: enrolment, compliance, encryption, app protection; E5: The same, plus Defender for Endpoint Plan 2 with EDR and automated investigation
• Email and collaboration. Every tenant: Exchange Online Protection; Business Premium and E3: Defender for Office 365 Plan 1 (rolling out to E3 through autumn 2026): Safe Links, Safe Attachments; E5: Plan 2: attack simulation, automated investigation and response
• Data. Every tenant: Basic retention; Business Premium and E3: Purview DLP for Exchange, SharePoint and OneDrive; sensitivity labels; basic retention policies; E5: Endpoint DLP, Insider Risk Management, Audit (Premium): one year for Exchange, SharePoint, OneDrive and Entra activity of E5 users
• Monitoring. Every tenant: Unified audit log, 180-day retention; Business Premium and E3: The same, plus Defender for Business (Business Premium) or Defender for Endpoint Plan 1 (E3); E5: Defender XDR across all signals; Defender for Cloud Apps; Sentinel integration

The honest summary for most Indian mid-market tenants on E3 or Business Premium: the second column is where most of the risk reduction lives, and on many tenants much of it is not switched on.

Tier 1: eight checks for every tenant, on any licence

• 1. Check: Separate admin accounts from daily accounts; Why it matters: An admin who reads email on the same account as they manage the tenant hands an attacker both in one phish; Also meets: DPDP safeguards
• 2. Check: MFA for every user, security defaults if nothing else; Why it matters: Accounts protected only by a password are the easiest way into a tenant; Also meets: DPDP safeguards
• 3. Check: Fewer than five Global Administrators, plus two break-glass accounts excluded from Conditional Access policies that block sign-in, with their credentials kept offline; Why it matters: Fewer standing global admins, and a tested way back in if a policy locks everyone out; Also meets:
• 4. Check: Block legacy authentication; Why it matters: Protocols that cannot do MFA are the way attackers go around it; Also meets: DPDP safeguards
• 5. Check: Turn off user consent to third-party apps; set up admin consent requests; Why it matters: Consent phishing hands an app permanent access to mail and files with no password involved; Also meets: DPDP processors
• 6. Check: Confirm the unified audit log is on, mailbox auditing is on, and you know its retention; Why it matters: The audit log is the evidence for every incident; 180 days on the standard plan matches CERT-In's minimum; Also meets: CERT-In logs
• 7. Check: Publish SPF, DKIM and DMARC for every sending domain, DMARC at quarantine or reject; Why it matters: Stops your domain being used to phish your own customers and suppliers; Also meets:
• 8. Check: Set external sharing in SharePoint and OneDrive to existing guests or specific domains, and review Teams external access; Why it matters: Anonymous links are how personal data leaves a tenant without anyone noticing; Also meets: DPDP safeguards

The break-glass accounts are the item teams skip. Two cloud-only accounts not tied to any person, protected by FIDO2 security keys (passkeys) or certificate-based authentication, excluded from Conditional Access policies that block sign-in, with the keys kept in separate safes, and signed into at least every 90 days to prove they work. The day a Conditional Access policy locks out every administrator, they are the only way back.

Tier 2: nine checks with Entra ID P1 and Intune (Business Premium, E3)

• 9. Check: Conditional Access baseline: require MFA for all users, block legacy authentication, require MFA for all admins; Why it matters: Replaces security defaults with policies you can shape; start each policy in report-only mode; Also meets: DPDP safeguards
• 10. Check: Conditional Access: require a compliant or Entra-joined device for access to mail and files; Why it matters: Credentials alone no longer open the tenant; the device has to be one you manage; Also meets: DPDP safeguards
• 11. Check: Named locations for India and the countries you operate in; block or step up sign-ins from everywhere else; Why it matters: Sign-ins from countries where you have no users are a common sign of credential attacks; Also meets: CERT-In detection
• 12. Check: Intune enrolment for every laptop and phone that touches company data, with a compliance policy that checks encryption, OS version and threat level; Why it matters: A device Intune does not know is a device no policy applies to; Also meets: DPDP safeguards
• 13. Check: Disk encryption enforced through Intune: BitLocker on Windows, FileVault on Mac, with recovery keys escrowed to Entra ID (BitLocker) and Intune (FileVault); Why it matters: A lost laptop becomes a hardware loss instead of a personal data breach; Also meets: DPDP breach
• 14. Check: App protection policies on mobile: company data in managed apps only, no copy-out, remote wipe of company data; Why it matters: Covers the phone the company does not own, which is most phones; Also meets: DPDP safeguards
• 15. Check: Defender for Business or Defender for Endpoint Plan 1 deployed to every device, with tamper protection on; Why it matters: Endpoint detection is where ransomware is caught, and the alert feeds the six-hour clock; Also meets: CERT-In detection
• 16. Check: Defender for Office 365 Plan 1: Safe Links and Safe Attachments on for all users, anti-phishing policy with impersonation protection for executives and finance; Why it matters: Business email compromise targets the CFO's name, not the CFO's mailbox; Also meets: CERT-In detection
• 17. Check: A first DLP policy for Indian identifiers: Purview's built-in sensitive information types for Aadhaar and PAN (there are also India types for GST, voter ID and driving licence numbers), plus custom types for passport and bank account numbers, in warn mode, then block; Why it matters: Finds where personal data already is, which is the first question under the DPDP Act; Also meets: DPDP rights and erasure

Start every Conditional Access policy in report-only mode. Run it for a week, read the sign-in log for what it would have blocked, fix the exceptions you find, then enforce. The alternative is the Monday morning when the sales team cannot read email and the policy gets switched off for good.

Tier 3: eight checks that need E5

• 18. Check: Privileged Identity Management: no standing admin roles; eligible assignments activated with MFA and a reason, for a few hours at a time; Why it matters: Standing admin rights are what a compromised admin account inherits; Also meets: DPDP safeguards
• 19. Check: Identity Protection: block or require password change at high user risk, require MFA at medium sign-in risk; Why it matters: Turns Microsoft's view of leaked credentials and anomalous sign-ins into an automatic response; Also meets: CERT-In detection
• 20. Check: Access reviews for guests, privileged roles and sensitive groups every quarter; Why it matters: Guests and role members only ever accumulate without one; Also meets: DPDP processors
• 21. Check: Defender for Endpoint Plan 2: automated investigation and response on, attack surface reduction rules in block mode; Why it matters: Contains the endpoint before the on-call engineer has read the alert; Also meets: CERT-In six hours
• 22. Check: Defender for Office 365 Plan 2: attack simulation training quarterly, automated investigation for reported phish; Why it matters: Measures whether item 16 is working and trains the people it protects; Also meets:
• 23. Check: Audit (Premium): one-year retention, and longer for admin and mailbox events with the 10-year audit retention add-on; Why it matters: Covers the DPDP Rules' one-year minimum log retention (from May 2027) inside the tenant, not just in an export; Also meets: DPDP and CERT-In logs
• 24. Check: Endpoint DLP and Insider Risk Management for the identifiers in item 17, plus sensitivity labels that encrypt; Why it matters: Extends the data controls from the mailbox to the USB port and the personal email; Also meets: DPDP safeguards
• 25. Check: Stream Entra sign-in, audit and Defender incidents to Microsoft Sentinel in an Indian-region Log Analytics workspace; Why it matters: Puts the evidence where CERT-In's jurisdiction and your SOC both need it, under your retention rather than Microsoft's; Also meets: CERT-In logs

What Secure Score misses

Secure Score is a good to-do list and a poor measure of safety. Four things it does not tell you.

• It scores the controls your licence allows and is silent about the ones it does not. A Business Basic tenant has no Conditional Access, device management or endpoint detection to score, so a good score says nothing about them.
• It does not know about backup. Microsoft retains deleted mail and files for a period and then they are gone; ransomware that encrypts SharePoint through a synced laptop is inside that period. Protecting Exchange, SharePoint and OneDrive data is your responsibility under the shared-responsibility model; it needs a backup service, Microsoft 365 Backup (billed per GB) or a third-party product, and it is not a Secure Score item.
• It does not check that the break-glass accounts work, that the audit log is being exported, or that anyone reads the alerts. A tenant can score well and still notice its incidents on Monday.
• It does not know where your data is. The tenant's data location is in the admin centre under Settings, Org settings, Organization profile; for a tenant provisioned in India, Exchange, SharePoint, OneDrive and Teams content is stored at rest in India, and for a tenant provisioned elsewhere it may not be. The DPDP checklist starts with that question.

The India specifics

Three items on the checklist carry Indian weight beyond their security value.

Audit retention. Audit (Standard) retains 180 days, which happens to be the CERT-In figure, but it is Microsoft's retention, in Microsoft's store. CERT-In's Directions ask for logs maintained within Indian jurisdiction and producible on order, and from 13 May 2027 the DPDP Rules require logs to be kept for at least a year. Item 25 is the answer on E5; on E3 and Business Premium, export the audit log on a schedule to storage in an Indian Azure region and keep it for a year. Our CERT-In checklist covers the rest of that runbook.

Personal data discovery. Purview ships sensitive information types for Aadhaar and PAN; add custom types for Indian passport and bank account numbers. A warn-mode DLP policy on those four, left running for a fortnight, produces the inventory of where personal data lives in mail and files that the DPDP checklist asks for in its first week.

Licensing. The jump from E3 to E5 buys items 18 to 25, and whether that is worth it depends on how many of items 1 to 17 are actually done. A tenant paying for E5 that has not finished tier 2 is paying for controls it is not ready to use, and a tenant on E3 usually gets more from finishing tier 2 than from the upgrade. Buy the tier you will finish; the licensing section of our Cloud Cost Audit Checklist has the questions to ask before the renewal.

The order of work

1. Week 1: tier 1, items 1 to 8. None needs a licence; all need an administrator and a change window. Create the break-glass accounts first.
2. Week 2: Conditional Access in report-only mode (items 9 to 11) and Intune enrolment of the pilot group (items 12 to 14).
3. Week 3: Defender on every device and Defender for Office 365 policies (items 15 and 16); turn Conditional Access to enforced once the report-only week is clean.
4. Week 4: the DLP discovery policy (item 17) and the audit log export; read what the DLP finds before deciding anything about E5.
5. Month 2, if on E5: PIM, Identity Protection and Sentinel (items 18, 19 and 25) first, because they change what an attacker can do with an account they already have; the rest in order.

Where CloudSwift fits

In a Microsoft 365 management engagement this checklist is a natural first month of work, run against the tenant as it is rather than as the licence brochure imagines it. Identity and access management covers the Entra ID work in items 1 to 5, 9 to 11 and 18 to 20, which is where most of the risk sits, and the Microsoft 365 platform practice covers the device, email and data controls around it. Where a tenant needs round-the-clock watch on the alerts the checklist switches on, that is managed security.

If you would like the 25 items scored against your tenant, book a consultation. Scoring needs only a read-only administrator role, and the output is the list in the order to fix.

Frequently asked questions

Do I need E5 to secure a Microsoft 365 tenant?

No. Seventeen of the 25 items here need no more than Business Premium or E3, and those are the ones that stop the common attacks: MFA, Conditional Access, managed devices, endpoint detection and email protection. E5 adds just-in-time admin, risk-based policies, longer audit retention and deeper data controls, which matter most for larger or regulated tenants.

Is security defaults enough, or do I need Conditional Access?

Security defaults give every tenant MFA and block legacy authentication, which is far better than nothing. Conditional Access, included from Business Premium and E3 upward, lets you require managed devices, restrict by location and shape policies for different groups. Move to Conditional Access as soon as the licence allows, starting in report-only mode.

How long does Microsoft 365 keep the audit log?

180 days on Audit (Standard), one year on Audit (Premium) with E5, with a ten-year add-on available. CERT-In requires 180 days of logs maintained within Indian jurisdiction, and from 13 May 2027 the DPDP Rules require at least a year. Exporting the audit log to storage in an Indian Azure region and keeping it for a year covers both for the Microsoft 365 audit log, whatever the plan.

Does Microsoft back up my Microsoft 365 data?

Microsoft keeps deleted items for a retention period and provides service resilience, but a backup you can restore from after ransomware, a malicious deletion or an expired retention policy is a separate service: Microsoft 365 Backup (billed per GB, covering Exchange, SharePoint and OneDrive) or a third-party product, which you also need for Teams. Either way, protecting the data is your responsibility.

Which items help with the DPDP Act?

MFA, Conditional Access, device encryption, app protection and the DLP discovery policy are controls that help meet the Act's duty to take reasonable security safeguards (section 8(5) and Rule 6, from 13 May 2027); the audit log retention and Sentinel export are the breach evidence; access reviews and app consent controls are the processor and access discipline. The marked column in each table shows which item maps to which duty.