Multi-Factor & Phishing-Resistant Auth · Microsoft 365 Security Checkliste

Skillplan M365 Checklist

2026-07-20 00:25

Bewertungsfortschritt 0 / 136 Elemente 0%

Bisherige Erfüllung 0 / 0 Kontrollen 0%

Enable phishing-resistant authentication methods (FIDO2 keys, Windows Hello for Business, certificate-based auth) tenant-wide.

Enforce phishing-resistant MFA for all administrative roles via Conditional Access Authentication Strengths.

Disable SMS and voice-call MFA methods for any account holding an administrative role.

Enable Microsoft Authenticator number matching for all users to defeat MFA-fatigue attacks.

Enable additional context (app name, location) in Authenticator push notifications.

Run an authentication methods registration campaign to nudge users to Authenticator and away from SMS.

Audit and remove unused legacy MFA methods (security questions, voice OTP) from all user profiles.

Run an authentication-strength audit quarterly to confirm no admin role has a weak factor configured.