Stillwater Technology Group
Microsoft 365 security check-up
Lakeside Family Dental (sample) · data collected 2026-11-10
Sample report. The organisation, people and findings are invented.
Summary
4High priority
4Medium priority
2Low priority
11 accounts reviewed, 10 of them enabled. This check-up read settings only. Nothing in your system was changed.
What to fix, in order
| # | Priority | Issue |
|---|
| 1 | High | 2 administrator account(s) without multi-factor sign-in |
| 2 | High | 4 of 9 accounts have no multi-factor method registered |
| 3 | High | Multi-factor sign-in is not required by policy |
| 4 | High | 1 mailbox rule(s) forward email outside the organisation |
| 5 | Medium | Older sign-in methods are not blocked |
| 6 | Medium | 2 enabled account(s) unused for 90+ days |
| 7 | Medium | Files can be shared with anyone by link |
| 8 | Medium | lakesidefamilydental.example: no DMARC record |
| 9 | Low | 1 outside guest account(s) unused for 90+ days |
| 10 | Low | lakesidefamilydental.example: DKIM signing not set up |
Findings in detail
High1. 2 administrator account(s) without multi-factor sign-in
These accounts can change anything in the tenant and sign in with a password alone.
- dr.hartley@lakesidefamilydental.example
- admin@lakesidedental.onmicrosoft.com
- Why it matters
- One stolen password gives an attacker the whole organisation.
- What to do
- Register an authenticator app for each one today.
Relates to 45 CFR 164.312(d), person or entity authentication
High2. 4 of 9 accounts have no multi-factor method registered
These people sign in with a password alone.
- frontdesk@lakesidefamilydental.example
- hygiene2@lakesidefamilydental.example
- j.moreno@lakesidefamilydental.example
- scanner@lakesidefamilydental.example
- Why it matters
- Password theft by phishing is the most common way mailboxes are taken over.
- What to do
- Register an authenticator app for every account.
Relates to 45 CFR 164.312(d), person or entity authentication
High3. Multi-factor sign-in is not required by policy
Security defaults are off and no enabled policy requires it for all users.
- Why it matters
- People who have not registered are never asked to, and new accounts start unprotected.
- What to do
- Turn on security defaults, or add a conditional access policy requiring it for all users.
Relates to 45 CFR 164.312(d), person or entity authentication
High4. 1 mailbox rule(s) forward email outside the organisation
Each rule automatically sends incoming mail to an outside address.
- billing@lakesidefamilydental.example: rule "Copy statements" sends to lakeside.billing.backup@freemail.example
- Why it matters
- Attackers add these rules to keep reading mail after a password change, and patient information can leave unnoticed.
- What to do
- Confirm each rule with the mailbox owner, remove any that are not approved, and block automatic external forwarding.
Relates to 45 CFR 164.312(e)(1), transmission security
Medium5. Older sign-in methods are not blocked
No policy blocks legacy authentication.
- Why it matters
- Legacy protocols cannot ask for a second factor, so they bypass it.
- What to do
- Block legacy authentication with security defaults or a conditional access policy.
Relates to 45 CFR 164.312(a)(1), access control
Medium6. 2 enabled account(s) unused for 90+ days
2 of them still hold a paid licence.
- hygiene2@lakesidefamilydental.example (240 days)
- j.moreno@lakesidefamilydental.example (325 days)
- Why it matters
- Forgotten accounts, often former staff, are a common entry point and cost money.
- What to do
- Confirm each with the office manager, then disable it and remove the licence.
Relates to 45 CFR 164.308(a)(3), workforce security
Medium7. Files can be shared with anyone by link
SharePoint and OneDrive allow links that work without signing in.
- Why it matters
- A forwarded link opens the file for whoever holds it, with no record of who.
- What to do
- Limit sharing to named guests who must sign in.
Relates to 45 CFR 164.312(a)(1), access control
Medium8. lakesidefamilydental.example: no DMARC record
Receivers are given no instruction for mail that fails checks.
- Why it matters
- Spoofed mail using this domain is delivered, and nobody is told.
- What to do
- Publish DMARC at p=none with reporting, then move to quarantine and reject.
Relates to 45 CFR 164.312(e)(1), transmission security
Low9. 1 outside guest account(s) unused for 90+ days
Guests are people outside the organisation who were given access.
- it_oldvendor.example#EXT#@lakesidedental.onmicrosoft.com (1135 days)
- Why it matters
- Old guest access tends to outlive the reason it was granted.
- What to do
- Remove guests that are no longer needed.
Relates to 45 CFR 164.308(a)(4), information access management
Low10. lakesidefamilydental.example: DKIM signing not set up
No Microsoft 365 DKIM records were found for the domain.
- Why it matters
- Outgoing mail is not signed, which weakens DMARC and deliverability.
- What to do
- Enable DKIM for the domain in Microsoft Defender and publish both records.
Relates to 45 CFR 164.312(e)(1), transmission security
About this report
This is a technical review of Microsoft 365 settings at one point in time. It is not a HIPAA risk analysis, a compliance certification or legal advice. References to the HIPAA Security Rule show which safeguard a finding relates to.