Microsoft 365 readiness check

1. For each line, find the device or app from the user and IP address in Entra admin center > Sign-in logs.
2. Phones and mail apps: switch to Outlook or a mail app that uses modern sign-in. Scanners and apps: see the SMTP AUTH guide (relay connector or OAuth).
3. When nothing legacy remains, block it with Conditional Access ("Client apps: Exchange ActiveSync clients, Other clients" > Block).

No new legacy sign-ins appear in the next 30-day scan.

Not applicable.

1. Tell each person (email below) to install Microsoft Authenticator on their phone before the session.
2. Each person goes to https://aka.ms/mysecurityinfo, chooses "Add sign-in method" > "Microsoft Authenticator" and follows the QR code. For anyone without a smartphone, issue a FIDO2 security key, or a Temporary Access Pass to register one.
3. Once Authenticator shows in their methods, remove the phone method (commands below) so nobody falls back to SMS.
4. When everyone is moved, turn SMS and voice off for the tenant: Entra admin center > Protection > Authentication methods > Policies > SMS / Voice call > disable.

# Microsoft Graph PowerShell: Connect-MgGraph -Scopes UserAuthenticationMethod.ReadWrite.All
# Optional: one-time pass (8 hours) for someone registering a security key
New-MgUserAuthenticationTemporaryAccessPassMethod -UserId "<user>" -BodyParameter @{ lifetimeInMinutes = 480; isUsableOnce = $false }
# Remove the mobile phone method after Authenticator is registered (3179e48a... is Microsoft's fixed id for the mobile number)
Remove-MgUserAuthenticationPhoneMethod -UserId "kdominguez@dental.example.com" -PhoneAuthenticationMethodId 3179e48a-750b-4051-897c-87b9720928f7
Remove-MgUserAuthenticationPhoneMethod -UserId "rsantos@dental.example.com" -PhoneAuthenticationMethodId 3179e48a-750b-4051-897c-87b9720928f7
Remove-MgUserAuthenticationPhoneMethod -UserId "jwhite@dental.example.com" -PhoneAuthenticationMethodId 3179e48a-750b-4051-897c-87b9720928f7
Remove-MgUserAuthenticationPhoneMethod -UserId "lnguyen@dental.example.com" -PhoneAuthenticationMethodId 3179e48a-750b-4051-897c-87b9720928f7
Remove-MgUserAuthenticationPhoneMethod -UserId "bharris@dental.example.com" -PhoneAuthenticationMethodId 3179e48a-750b-4051-897c-87b9720928f7
Remove-MgUserAuthenticationPhoneMethod -UserId "gflores@dental.example.com" -PhoneAuthenticationMethodId 3179e48a-750b-4051-897c-87b9720928f7

Get-MgUserAuthenticationMethod -UserId <user> lists a microsoftAuthenticator (or fido2) method and no phone method; the next Attestry scan closes the finding.

Re-add a number if someone is locked out: New-MgUserAuthenticationPhoneMethod -UserId <user> -PhoneNumber "+1 ..." -PhoneType mobile (stops working on February 1, 2027).

Subject: 10-minute sign-in update before February 1

Microsoft is retiring text-message sign-in codes on February 1. 6 people at your office use them today and would be locked out of email. Please ask them to install the free Microsoft Authenticator app before [DATE]; we'll walk everyone through the rest in about 10 minutes each.

1. On the sync server, check the version and sign-in type (commands below). Take a backup or snapshot of the server first.
2. Download the latest Entra Connect Sync from the Entra admin center (Identity > Hybrid management > Microsoft Entra Connect > Connect Sync; it is no longer on the Download Center). The server needs .NET Framework 4.7.2 and TLS 1.2.
3. Run the installer to upgrade in place. For very old versions (1.x, DirSync, Azure AD Sync), build a new server and use a swing migration instead.
4. Open the Entra Connect wizard > Configure > "Configure application-based authentication to Microsoft Entra ID" and sign in as a Hybrid Identity or Global Administrator. Upgrading alone no longer switches existing servers.
5. Run a delta sync and confirm in the Entra admin center that the last sync time updates.

# On the sync server, in an elevated PowerShell window
(Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Azure AD Connect").Version   # needs 2.6.84.0 or later
Import-Module ADSync
Get-ADSyncEntraConnectorCredential   # ConnectorIdentityType should say Application, not ServiceAccount
Start-ADSyncSyncCycle -PolicyType Delta

Get-ADSyncEntraConnectorCredential shows Application; the Entra admin center lists an app named ConnectSyncProvisioning_<server>_...; the next Attestry scan closes the finding.

Microsoft documents a revert to the sync account (Add-ADSyncAADServiceAccount), but it only works until April 7, 2027. Restore the snapshot if the upgrade itself fails.

Subject: Planned maintenance on your directory sync server

Microsoft is retiring the way your on-site accounts sync to Microsoft 365 on April 7, 2027. After that, new starters, leavers and password changes would stop syncing. We'll upgrade the sync server during a short maintenance window on [DATE]; sign-ins are not affected while we work.

1. For a normal admin: sign in as that admin at https://aka.ms/mysecurityinfo and register a passkey or FIDO2 security key (Microsoft Authenticator as a second method).
2. For an emergency ("break glass") account: register two FIDO2 security keys, store them in separate safes, store the long password with them, and record where in your documentation.
3. Set an alert on any sign-in by the emergency account (Entra admin center > Monitoring > Diagnostic settings, or your SIEM).

# Optional: one-time pass so the key can be registered without a password prompt
New-MgUserAuthenticationTemporaryAccessPassMethod -UserId "breakglass@dental.example.com" -BodyParameter @{ lifetimeInMinutes = 60; isUsableOnce = $true }

Get-MgUserAuthenticationMethod -UserId <admin> lists a fido2 method; the next scan closes the finding.

Not applicable.

1. Find what sends through each mailbox: Entra admin center > Sign-in logs > add filter "Client app" = "Authenticated SMTP"; note the IP address and time. Match the IP to a copier, scanner, server or app.
2. Choose a replacement for each sender: (a) a newer firmware or app version that supports OAuth (modern authentication); (b) an SMTP relay: Exchange admin center > Mail flow > Connectors > "Your organization's email server" to "Office 365", restricted to the site's static public IP, with the device sending to <your-domain>-<tld>.mail.protection.outlook.com on port 25; or (c) Microsoft's High Volume Email service where available to the tenant.
3. Change the device or app to the new method and send a test message.
4. Switch SMTP AUTH off on the mailbox (command below), then watch the sign-in log for a day for failures.

# Run in Exchange Online PowerShell (Connect-ExchangeOnline)
Set-CASMailbox -Identity "billing@dental.example.com" -SmtpClientAuthenticationDisabled $true
Set-CASMailbox -Identity "scanner@dental.example.com" -SmtpClientAuthenticationDisabled $true

Get-CASMailbox -Identity <mailbox> | Select-Object SmtpClientAuthenticationDisabled (should say True); the next Attestry scan closes the finding.

Set-CASMailbox -Identity <mailbox> -SmtpClientAuthenticationDisabled $false (only works until Microsoft's default-off date).

Subject: Action needed before December 31: scan-to-email and app notifications

Microsoft is switching off an older way devices send email at the end of December. We found 2 device(s) or app(s) at your office still using it. We'll move each one to a supported method so nothing stops sending. Expect a short visit or remote session; no action is needed from your staff.

1. For each app, ask the vendor: "Do you have a Microsoft Graph version, and when do we need to upgrade before April 1, 2027?" (email below).
2. Schedule the upgrade, then remove the app's EWS permission in Entra admin center > Enterprise applications > the app > Permissions.
3. Optional early test: switch EWS off for a pilot mailbox and confirm the app still works.

# Exchange Online PowerShell: pilot test on one mailbox
Set-CASMailbox -Identity "<pilot mailbox>" -EwsEnabled $false

The app keeps working with EWS off for the pilot mailbox; the next scan no longer lists its EWS permission.

Set-CASMailbox -Identity "<pilot mailbox>" -EwsEnabled $true

Subject: Software that stops working April 1, 2027

Microsoft is switching off a connection method (EWS) that 2 of your applications use. We are contacting the vendors for their upgrade plans and will schedule the updates well before April.

1. Ask the mailbox owner and their manager whether the forwarding is approved (email below). Keep the reply in the finding.
2. If not approved: remove the forwarding and check for inbox rules that forward or redirect.
3. If nobody can explain it: treat the account as compromised. Reset the password, revoke sessions, check sign-in logs for unfamiliar locations, and review mailbox audit logs.

# Exchange Online PowerShell
Set-Mailbox -Identity "apatel@dental.example.com" -ForwardingSmtpAddress $null -DeliverToMailboxAndForward $false
Get-InboxRule -Mailbox "apatel@dental.example.com" | Where-Object { $_.ForwardTo -or $_.ForwardAsAttachmentTo -or $_.RedirectTo } | Format-List Name, ForwardTo, RedirectTo
# If compromise is suspected (Microsoft Graph PowerShell)
Revoke-MgUserSignInSession -UserId "<user>"

Get-Mailbox -Identity <mailbox> | Select-Object ForwardingSmtpAddress (should be empty).

If later approved: Set-Mailbox -Identity <mailbox> -ForwardingSmtpAddress "smtp:<address>" -DeliverToMailboxAndForward $true

Subject: Is this email forwarding approved?

We found 1 mailbox(es) set to forward company email to outside addresses. This is a common way client information leaks. Please reply to confirm whether each one is approved; anything not approved we'll switch off the same day.