Microsoft 365 Tenant Hardening Checklist

Tenant hardening is one of the best migration readiness investments you can make. If identity, sharing, audit, guest access, privileged roles, and governance are weak before migration, the new Microsoft 365 environment can inherit the same operational risk at a larger scale.

This checklist is intended for IT leaders, Microsoft 365 administrators, SharePoint owners, and migration teams preparing for Microsoft 365, SharePoint Online, Teams, OneDrive, Exchange Online, or Power Platform migration work.

Identity and access baseline

Start with identity controls because they affect every workload:

• Enforce multifactor authentication for administrators and high-risk users.
• Block or phase out legacy authentication.
• Review Conditional Access policies for administrators, guests, contractors, and unmanaged devices.
• Use separate privileged admin accounts where appropriate.
• Review Global Administrator membership and reduce standing privilege.
• Confirm break-glass account process, monitoring, and documentation.
• Review inactive users, orphaned accounts, and service accounts before migration.

SharePoint and OneDrive sharing controls

Sharing decisions should be intentional before you migrate large volumes of content:

• Review organization-level external sharing defaults.
• Decide whether new sites inherit restrictive or permissive defaults.
• Review guest access and sharing links.
• Restrict anonymous links where they do not match business requirements.
• Define owner responsibilities for reviewing external access.
• Review unmanaged device access policies for SharePoint and OneDrive.
• Validate sharing policies against HR, finance, legal, executive, and regulated sites.

Teams and collaboration readiness

Teams can multiply SharePoint sites, groups, guests, apps, and files. Before migration:

• Review Teams creation policies and naming conventions.
• Define Teams ownership requirements.
• Review guest access and external access policies.
• Confirm lifecycle expectations for inactive teams.
• Review apps, tabs, and connector policies.
• Align Teams file governance with SharePoint site governance.

Audit, alerting, and compliance

A migration can expose activity patterns and compliance gaps. Establish a baseline:

• Confirm audit logging and retention settings.
• Review alerting for risky sign-ins, suspicious sharing, and privileged changes.
• Review sensitivity labels and retention labels.
• Define DLP policies for obvious high-risk data types.
• Confirm eDiscovery, legal hold, and records requirements before moving content.
• Validate reporting access for security and compliance teams.

Power Platform controls

If the migration includes InfoPath, Nintex, SharePoint Designer, or other legacy automation, Power Platform governance must be part of the plan:

• Define environments for development, test, and production.
• Review DLP policies and connector classifications.
• Identify business-critical flows and apps.
• Review orphaned app and flow ownership.
• Confirm ALM expectations for solutions and deployments.
• Define support ownership for production flows and apps.

Use Form Migrator for InfoPath-heavy estates and Flow Migrator for workflow-heavy estates when discovery needs to move faster.

Migration-specific hardening questions

Ask these before cutover:

• Are permissions clean enough to migrate?
• Are external sharing settings aligned with the target model?
• Do migration admins have least-privilege access where possible?
• Are business owners ready to validate access after migration?
• Are service accounts documented and monitored?
• Are high-risk workloads included in the migration risk register?
• Is the help desk ready to triage access, sync, sharing, and workflow issues?

Recommended operating cadence

Hardening is not a one-time task. After migration, define a cadence for:

• Access reviews
• Guest reviews
• Privileged role reviews
• Site owner reviews
• External sharing reviews
• Power Platform app and flow ownership reviews
• DLP and Conditional Access policy reviews

Next step

Use this checklist as part of a Microsoft Migration Readiness Assessment. Horton Scientific can help baseline the tenant, identify migration blockers, and create a prioritized remediation plan before broad migration waves begin.