Kestrel Assurance Confidential ## 1Executive summary Northwind Freight's Microsoft 365 tenant is configured like a company that grew faster than its IT team: the platform's security features are licensed and mostly present, but several defaults that were acceptable when the tenant was created in 2019 are still in force. Kestrel Assurance reviewed the tenant configuration between 8 and 19 September 2026 and recorded 24 findings: 2 critical, 5 high, 11 medium and 6 low. We found no evidence of an active compromise in the logs available to us, with one exception under F-06 that Northwind should treat as a suspected incident until the review in progress says otherwise. 2 Critical 5 High 11 Medium 6 Low Area Critical 2 High 5 Medium 11 Low 6 Count Identity and access F-02 F-04 F-07 F-09 F-12 F-19 6 Exchange Online F-01 F-06 F-10 F-13 F-20 5 SharePoint and OneDrive F-03 F-11 F-14 F-21 4 Logging and response F-05 F-15 F-16 3 Devices F-08 F-17 F-22 3 Teams F-18 F-23 F-24 3 Figure 1Where the 24 findings sit. Each cell is one finding, ordered by severity within its area. Both critical findings and four of the five high findings are in identity and mail; the rest of the tenant is in reasonable shape. The two critical findings describe one weakness from two sides. Legacy SMTP authentication (F-01) lets a password alone open 14 mailboxes, including the invoicing mailbox, with no second factor. Global Administrator accounts protected only by SMS or push approval (F-02), with no conditional access policy for administrator roles (F-04), mean that one convincing phishing page shown to one administrator hands over the whole tenant. Together with open mail forwarding (F-06), these four findings form the path we would take if we were asked to attack the tenant, and they are the reason this report ends in a 30-day plan rather than a quarterly roadmap. The remaining findings are surface and visibility. Audit retention of 90 days (F-05) limits any future investigation, 41 stale guest accounts (F-07) and three anonymously shared SharePoint sites (F-03) widen the exposure, and the medium and low items in section 5 are standard hardening. All seven critical and high findings can be closed within 30 days by Northwind's own IT team. Two of them, F-05 and F-07, have a native fix that depends on a licensing decision set out in section 7 and a scripted alternative that does not. ## 2Scope and method The assessment covered the configuration of one Microsoft 365 tenant as it stood in September 2026\. It did not test people, endpoints or code. __Workloads in scope and the settings groups reviewed in each.__ | Workload | Reviewed | | ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Entra ID | Directory roles, Privileged Identity Management, conditional access, authentication methods, MFA registration, guest and external collaboration settings, password policy, diagnostic settings. | | Exchange Online | Authentication protocols, transport configuration, outbound spam and automatic forwarding, inbox rules, anti-phishing and Safe Links policies, domain authentication (SPF, DKIM, DMARC), mailbox auditing. | | SharePoint Online and OneDrive | Tenant and site sharing levels, link types and expiry, sync restrictions, idle session sign-out, sensitivity labels as applied to sites. | | Microsoft Teams | External and guest access, meeting policies and lobby settings, channel permissions for guests, recording expiry. | | Intune | Compliance and app protection policies only where they affect access to tenant data. No device was tested. | | Purview and Defender | Unified audit log status and retention, alert policies and their recipients, open alerts in the Defender portal, Secure Score history for reference only. | ### How the review was done * **Access.** Kestrel held the `Global Reader` and `Security Reader` roles from 8 September. Northwind removed both on 19 September at 16:40 CEST and confirmed the removal in writing. No write action was taken in the tenant. * **Collection.** Settings were exported on 17 September 2026 with Microsoft Graph PowerShell and Exchange Online PowerShell, and cross-checked in the admin centres. Counts in this report are as of that export. * **Comparison.** Observed values were compared with the Kestrel Microsoft 365 baseline, version 4.2 (September 2026), which follows the vendor's published security defaults and adds the controls Kestrel sees defeat real attacks. Appendix A lists every setting and its baseline value. * **Logs.** Entra sign-in logs (30 days) and the unified audit log (90 days) were searched for use of the weak configurations found, not for a general compromise assessment. * **Interviews.** Two working sessions with Northwind IT (Head of IT, Exchange administrator) on 12 and 15 September established which configurations are intentional. * **Not done.** No exploitation, phishing simulation, endpoint testing, review of on-premises Active Directory, or review of third-party applications connected through single sign-on. Screenshots, exports and the working findings file are held in the Kestrel evidence store under reference `KA-2026-0917` and retained for 12 months from the report date. ## 3Severity scale Severity rates the configuration as observed, not the likelihood that Northwind is targeted. Where two findings combine into one attack path, both carry the higher rating and say so. __The four severity levels used in this report and the response window Kestrel recommends for each.__ | Severity | Meaning | Fix within | | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------ | | Critical | A reachable path to tenant-wide compromise or bulk data loss that needs only a password or one phished user, with no compensating control in place. | 7 days | | High | A gap that materially weakens identity, mail or data protection and is used in common attacks; exploitation needs one further condition to be true. | 30 days | | Medium | A deviation from the baseline that widens the blast radius of a compromise or slows its detection, but does not by itself give access. | 90 days | | Low | Hygiene and defence in depth. Worth doing, not worth an out-of-cycle change. | Next change window | ## 4Critical and high findings Each finding gives the evidence as exported on 17 September 2026, the impact if it is left as is, the fix Kestrel recommends, the owner agreed with Northwind IT on 19 September and an effort estimate for that owner. Setting and command names are written exactly as they appear in the admin centres and PowerShell modules. F-01 ### Legacy authentication enabled on 14 mailboxes Critical Evidence * `Get-TransportConfig` returns `SmtpClientAuthenticationDisabled : False`, so SMTP AUTH is allowed tenant-wide. * 14 mailboxes also carry an explicit per-mailbox override (`Get-CASMailbox`): 11 user mailboxes and the shared mailboxes `invoicing@`, `dispatch@` and `claims@`. * Entra sign-in logs for the 30 days to 19 September show 1,206 successful sign-ins with client app `Authenticated SMTP` from 9 source IP addresses. Northwind IT attributes 7 to the scan-to-email appliances and the transport management system. 2 are unattributed. * No conditional access policy blocks legacy authentication clients. Security defaults are off. Impact SMTP AUTH never asks for a second factor. A correct password for any of the 14 accounts is enough to read the mailbox and send mail as it. `invoicing@` receives and issues payment instructions, so this is a direct route to invoice fraud, and the two unattributed addresses mean the route may already be in use. Fix 1. Identify the two unattributed source addresses this week. If no owner is found by day 7, block them and wait for something to break rather than the reverse. 2. Move the scan-to-email appliances and the transport management system to an inbound connector with an IP allow list, or to OAuth where the device supports it. 3. Run `Set-TransportConfig -SmtpClientAuthenticationDisabled $true` and clear the 14 per-mailbox overrides. 4. Deploy a conditional access policy that blocks legacy authentication for all users: report-only for 7 days, then enabled. Owner Northwind IT operations (Exchange administrator) Effort 3 days, plus vendor time for the appliances Window 7 days F-02 ### Global Administrators without phishing-resistant MFA Critical Evidence * 6 accounts hold the `Global Administrator` role permanently. None is assigned as eligible through Privileged Identity Management. One of the 6, `it-admin@`, is a shared account with a licensed mailbox. * Default MFA method for the 6: SMS or voice call on 4, Authenticator push on 2\. No administrator has a FIDO2 security key or certificate registered. * The Authentication methods policy has `FIDO2 security key` disabled, and `SMS` and `Voice call` enabled for all users. * No conditional access policy applies an authentication strength, so `Phishing-resistant MFA` is required of no role (see F-04). * The break-glass account `emergency-access@` has no sign-in alert configured. Impact A Global Administrator can reset any password, read any mailbox, grant any application access to all data and switch off the policies that would otherwise detect it. SMS codes and push approvals are defeated by reverse-proxy phishing kits and SIM swaps that are now routine, and six standing administrators give an attacker six targets instead of two. Fix 1. Reduce standing Global Administrators to 2 named accounts plus the break-glass account. Convert the other 3 to eligible assignments in PIM with a 4-hour activation and a justification prompt. Remove the mailbox and licence from `it-admin@`, or retire it. 2. Issue two FIDO2 keys to each administrator and enable `FIDO2 security key` in the Authentication methods policy. 3. Require the built-in `Phishing-resistant MFA` authentication strength for all directory roles through `CA-Admins-01` (F-04). Exclude only `emergency-access@`, and alert on any sign-in by that account. 4. Once every administrator is registered, disable SMS and voice call as methods for the administrator group. Owner Northwind Head of IT Effort 4 days, including key procurement and one registration session Window 7 days F-03 ### External sharing open on 3 SharePoint sites High Evidence * The tenant sharing level is `New and existing guests`, but 3 sites are set to `Anyone`: `/sites/Tenders`, `/sites/CarrierOnboarding` and `/sites/FleetPhotos`. On these sites the default link type is also `Anyone`. * 212 active anonymous links exist across the 3 sites; 38 grant edit access. `RequireAnonymousLinksExpireInDays` is not set, so none of them expires. * `/sites/Tenders` holds 1,940 files: bid documents and pricing schedules from 2023 to date. Impact Anyone holding one of the 212 links can read, and in 38 cases change, tender pricing and carrier contracts, without signing in and therefore without leaving a record of who. Links are forwarded by email and outlive the people who created them. Fix 1. Set the 3 sites to `New and existing guests` and the default link type to `Specific people`. 2. Revoke the 212 anonymous links once the site owners have re-shared what is still needed with named guests. Kestrel will supply the export of links with their creators. 3. Set `RequireAnonymousLinksExpireInDays` to 30 at tenant level so that any future exception expires on its own. Owner Northwind SharePoint administrator, with the Commercial team for `/sites/Tenders` Effort 1 day of configuration, plus owner review of the link export Window 30 days F-04 ### No conditional access policy for administrator roles High Evidence * 7 conditional access policies exist. None targets directory roles. Administrators are covered only by `CA-AllUsers-MFA`, which excludes the group `CA-Exclusions`. * `CA-Exclusions` has 63 members, including 2 of the 6 Global Administrator accounts and 9 service accounts. No member has a recorded reason or review date (F-12). * No policy requires a compliant or hybrid-joined device, limits sign-in frequency or restricts locations for privileged roles. Sign-in risk and user risk conditions are not used anywhere. Impact Administrators sign in from any device and any country under the same policy as a warehouse kiosk, and two of them with no MFA at all. Combined with F-02, the tenant's most powerful accounts have its weakest protection. Fix 1. Create `CA-Admins-01` for the 14 built-in privileged roles: require the `Phishing-resistant MFA` authentication strength, a compliant or hybrid-joined device, a 4-hour sign-in frequency with persistent browser sessions off, and block sign-in from outside the countries Northwind operates in. 2. Remove the 2 Global Administrator accounts from `CA-Exclusions` now. Review the remaining 61 members under F-12. 3. Run the policy in report-only mode for 7 days, confirm that no administrator would be locked out, then enable it. Owner Northwind identity lead Effort 2 days Window 30 days F-05 ### Audit log retention at 90 days High Evidence * Unified audit logging is on. Retention is the default 90 days for every workload; no audit retention policies are defined. * Entra ID sign-in and audit logs are kept for 30 days. Diagnostic settings send them to no destination. * No SIEM or log archive is connected. Mailbox auditing is on by default and no `AuditBypass` entries were found. Impact An investigation that starts more than 90 days after first access, which is common in business email compromise, cannot establish what was read, forwarded or changed, and sign-in history is gone after 30 days. Northwind's cyber insurance questionnaire, shared with Kestrel, states 12-month log retention. Fix 1. Configure Entra ID diagnostic settings to send `SignInLogs`, `AuditLogs` and `NonInteractiveUserSignInLogs` to a storage account with 365-day retention. No licence change is needed; storage cost at current volume is under 20 euros a month. 2. Choose between Audit (Premium) with one-year retention policies for Exchange, SharePoint and Entra ID, or a daily scripted export of the unified audit log to the same storage account. The trade-off is set out in section 7. Owner Northwind IT operations, with Kestrel advising on the retention design Effort 1 day once the licensing decision is made Window 30 days F-06 ### Mail forwarding to external domains allowed High Evidence * The outbound spam policy `Default` has automatic forwarding set to `On – Forwarding is enabled`. * 9 mailboxes have `ForwardingSmtpAddress` set to addresses at consumer webmail domains. * 27 inbox rules forward or redirect to external addresses. 4 of the 27 also delete the original message. 2 of those 4 are on the shared mailbox `invoicing@` and were created on 2 and 11 August 2026 from an IP address outside Northwind's known ranges. * The alert policy `Creation of forwarding/redirect rule` is enabled but notifies a mailbox nobody reads (F-15). Impact External forwarding copies every incoming message out of the tenant silently, and a rule that also deletes the message hides the copy from the mailbox owner. The two rules on `invoicing@` match the pattern of invoice fraud in progress. Kestrel recommended in writing on 19 September that Northwind treat this as a suspected incident. Fix 1. Today: export and preserve the mailbox audit log for `invoicing@`, disable the 4 delete-and-forward rules, reset the credentials of the 4 accounts involved, and review every payment instructed by email since 2 August. 2. Set automatic forwarding to `Off – Forwarding is disabled` in the outbound spam policy. This stops all 9 forwarding addresses and 27 rules at once. 3. Ask the 9 mailbox owners whether any forwarding has a business reason. If so, route it through a transport rule to a named partner domain rather than a personal address. 4. Point the alert policy at the IT operations queue. Owner Northwind IT operations; the payment review by Northwind Finance with Kestrel Effort 1 day of configuration; the incident review is scoped separately Window 7 days for step 1, 30 days for the rest F-07 ### Stale guest accounts: 41 inactive for more than 180 days High Evidence * 187 guest accounts exist. 41 have no sign-in in the last 180 days; 26 of the 41 have never signed in. * 9 of the 41 are members of the Teams `Carrier Partners` and `Rate Desk`, which hold carrier rate cards and signed contracts. * External collaboration settings allow `Anyone in the organization` to invite guests. No access review is configured and no guest access expiry is set on SharePoint sites. Impact Each dormant guest is an account Northwind does not control and cannot see being compromised. If a partner's mailbox is taken over, its Northwind access comes with it, and the 26 unused invitations can be accepted by whoever now controls those addresses. Fix 1. Disable the 41 accounts now and delete them after 14 days unless a Northwind owner objects. Kestrel will supply the list with the inviting user for each account. 2. Restrict guest invitations to members and administrators, and set guest access on SharePoint sites to expire after 60 days. 3. Set up a quarterly access review of all guests with the Team owner as reviewer. This needs Entra ID Governance or P2 licences for the reviewers; the alternative is the scripted review described in section 7. Owner Northwind identity lead, with the owners of the 2 Teams Effort 2 days Window 30 days ## 5Medium and low findings Medium findings are due within 90 days and low findings in the next planned change window, as defined in section 3\. Evidence and fix detail for each is in the working file handed over on 19 September (`KA-2026-0917-findings.xlsx`). __The 17 medium and low findings, with the tenant area and the owner agreed with Northwind IT.__ | ID | Finding | Severity | Area | Owner | | ---- | ------------------------------------------------------------------------------------- | -------- | ---------- | ------------------------ | | F-08 | No app protection policy for Outlook and Teams on personal mobile devices | Medium | Devices | IT operations | | F-09 | 37 licensed users not registered for MFA; registration campaign not enabled | Medium | Identity | Identity lead | | F-10 | Anti-phishing impersonation protection covers 3 of the 12 executives named by Finance | Medium | Exchange | IT operations | | F-11 | OneDrive sync allowed from unmanaged devices; no domain restriction | Medium | SharePoint | SharePoint administrator | | F-12 | 63 accounts in CA-Exclusions with no documented reason or review date | Medium | Identity | Identity lead | | F-13 | DMARC policy at p=none for the primary domain; no aggregate reporting address | Medium | Exchange | IT operations | | F-14 | Sensitivity labels defined but not published to any user or site | Medium | SharePoint | SharePoint administrator | | F-15 | Security alerts routed to a shared mailbox with no owner or triage rota | Medium | Logging | Head of IT | | F-16 | 312 open alerts in the Defender portal, the oldest from February 2026 | Medium | Logging | Head of IT | | F-17 | 22% of Entra-joined Windows devices report as not compliant; no grace period enforced | Medium | Devices | IT operations | | F-18 | Teams external access open to all domains; anonymous users can bypass the lobby | Medium | Teams | Teams administrator | | F-19 | Password expiry set to 90 days for all users | Low | Identity | Identity lead | | F-20 | MailTips for external recipients disabled | Low | Exchange | IT operations | | F-21 | Idle session sign-out not configured for unmanaged browsers | Low | SharePoint | SharePoint administrator | | F-22 | Device enrolment restrictions allow personally owned Windows devices | Low | Devices | IT operations | | F-23 | Guests can create, edit and delete channels in shared Teams | Low | Teams | Teams administrator | | F-24 | Meeting recordings never expire; the default 120-day expiry is disabled | Low | Teams | Teams administrator | ## 630-day priority plan The plan closes all seven critical and high findings, plus the three medium findings that block them, in the order that removes the most risk soonest. Day 1 is the day Northwind accepts this report. Nothing in it needs a new licence except the native option for F-05 and F-07. Days 1 to 2 Preserve the `invoicing@` audit log and disable the 4 delete-and-forward rules. Reset the 4 accounts. Remove the 2 Global Administrator accounts from `CA-Exclusions`. Disable the 41 stale guests. Closes F-06 step 1, F-04 step 2, F-07 step 1\. Owner: IT operations, identity lead. Days 3 to 7 Identify or block the 2 unattributed SMTP AUTH sources. Order FIDO2 keys. Reduce standing Global Administrators to 3 and retire `it-admin@`. Set automatic forwarding off. Deploy the block-legacy-authentication policy in report-only mode. Closes F-06, F-02 step 1\. Owner: Head of IT, IT operations. Days 8 to 14 Enable the block-legacy-authentication policy and disable SMTP AUTH at tenant level. Create `CA-Admins-01` in report-only mode. Set the 3 SharePoint sites to guests only and start the anonymous link review. Closes F-01. Starts F-03. Owner: IT operations, SharePoint administrator. Days 15 to 21 Register FIDO2 keys with every administrator in one session, then enable `CA-Admins-01`. Send Entra logs to storage with 365-day retention. Take the licensing decision on audit retention and access reviews (section 7). Revoke the 212 anonymous links. Closes F-02, F-04, F-03, F-05 step 1\. Owner: Head of IT, identity lead. Days 22 to 30 Delete the 41 guests and restrict invitations. Apply the audit retention option chosen. Document or remove each of the remaining 61 `CA-Exclusions` members. Route all alert policies to the IT operations queue and clear the 312 open alerts. Closes F-07, F-05, F-12, F-15, F-16. Owner: identity lead, IT operations. Kestrel will re-test all seven critical and high findings in the week of 26 October 2026 and issue version 1.1 of this report with closure status. The re-test is included in the engagement. ## 7Open questions for Northwind Three questions were open when this report was issued. Each changes the shape of a fix, not whether it is needed. 1. Which systems use the two unattributed IP addresses that authenticate with SMTP AUTH (F-01)? If no owner is found by day 7, Kestrel recommends blocking them and waiting for a report of something broken. An unknown system that sends mail as Northwind is a larger risk than a printer that stops. 2. Is anonymous sharing from `/sites/Tenders` a deliberate way of working with carriers, or a shortcut that stuck (F-03)? If deliberate, F-03 becomes a process change with a guest-based alternative, and Kestrel would like the Commercial team in the design session so that the replacement is used rather than bypassed. 3. Does Northwind hold, or intend to buy, Entra ID P2 or Entra ID Governance and Audit (Premium) (F-05, F-07)? With the licences, one-year retention policies and quarterly guest access reviews are native and need no upkeep. Without them, a daily log export and a scripted guest review reach the same outcome with about half a day of operations work each quarter. ## AAppendix: tenant settings checked Every setting compared against the Kestrel baseline, with the value observed on 17 September 2026 and the finding it produced. Settings that matched the baseline are listed so that the next assessment can confirm they still do. __Observed versus baseline values for the 28 settings reviewed, grouped by workload.__ | Setting | Observed | Baseline | Finding | | ----------------------------------------------- | -------------------------------- | ----------------------------------------------------- | ---------- | | Entra ID | | | | | Security defaults | Off | Off, with conditional access in use | Matches | | Conditional access policies | 7, none for roles or legacy auth | Baseline set including admin and legacy-auth policies | F-01, F-04 | | Global Administrator accounts | 6 permanent | 2 to 4, eligible through PIM | F-02 | | Authentication methods: FIDO2 security key | Disabled | Enabled for administrators | F-02 | | Authentication methods: SMS, Voice call | Enabled, all users | Disabled | F-02 | | MFA registration | 1,375 of 1,412 users | All licensed users | F-09 | | Guest invite settings | Anyone in the organization | Members and administrators | F-07 | | Guests inactive over 180 days | 41 of 187 | 0 | F-07 | | Password expiration policy | 90 days | Never, with MFA enforced | F-19 | | Exchange Online | | | | | SmtpClientAuthenticationDisabled (organisation) | False | True | F-01 | | Mailboxes with SMTP AUTH override | 14 | 0 | F-01 | | Automatic forwarding (outbound spam policy) | On | Off | F-06 | | Inbox rules forwarding externally | 27 | 0 | F-06 | | DMARC policy, primary domain | p=none | p=reject | F-13 | | Impersonation protection: users | 3 | All named executives | F-10 | | Mailbox auditing | On, no bypass entries | On | Matches | | SharePoint Online and OneDrive | | | | | Tenant sharing level | New and existing guests | New and existing guests | Matches | | Sites set to Anyone | 3 | 0 | F-03 | | RequireAnonymousLinksExpireInDays | Not set | 30 | F-03 | | Sync from unmanaged devices | Allowed | Blocked | F-11 | | Idle session sign-out | Not configured | Warn at 60 min, sign out at 90 | F-21 | | Logging and response | | | | | Unified audit log | On | On | Matches | | Audit retention | 90 days | 365 days | F-05 | | Entra ID diagnostic settings | No destination | Storage or SIEM, 365 days | F-05 | | Open Defender alerts | 312 | Triaged within 7 days | F-16 | | Devices and Teams | | | | | App protection policies (iOS, Android) | None | Outlook, Teams, Office apps | F-08 | | Compliant Windows devices | 78% | 95% or more | F-17 | | Teams external access | All domains | Allowed domains list | F-18 | | Meeting recording expiry | Off | 120 days | F-24 |