IdentityRisk: Medium
Audit MFA Registration in Microsoft 365
Review which users have authentication methods registered before assuming MFA coverage is handled.
Example playbook / Read-only / Validation pending
Read playbook →Guides
Read-only Microsoft 365 playbooks for review-first admins.
These are the checks I want in front of me before I start changing a tenant. The goal is not to automate judgment away. The goal is to make the first review clearer.
Available example playbooks
These starter playbooks are written as read-only examples. Review the permissions, output, and limitations before using them in any production tenant.
ExchangeRisk: High
Find External Mailbox Forwarding in Exchange Online
Find mailbox forwarding that may send mail outside the organization and prepare it for careful review.
Example playbook / Read-only / Validation pending
Read playbook →IdentityRisk: High
Review Privileged Role Assignments in Entra ID
Export privileged Entra role membership before making security or access policy changes.
Example playbook / Read-only / Validation pending
Read playbook →Coming soon playbooks
Planned read-only checks that belong in the same first-pass tenant review workflow.
Entra IDRisk: Medium
Find Expiring Entra App Credentials
Inventory app secrets and certificates that need owner review.
Coming soon / Planned read-only check
Coming soon
CollaborationRisk: Medium
Inventory Guest Users
List external identities and review stale or unrecognized guests.
Coming soon / Planned read-only check
Coming soon
IdentityRisk: High
Export Conditional Access Policies
Capture policy configuration for review before edits.
Coming soon / Planned read-only check
Coming soon
TenantRisk: Low
Tenant Summary Quick-Check
Collect high-level Microsoft 365 tenant posture details.
Coming soon / Planned read-only check
Coming soon
LicensingRisk: Low
Licensed Users Review
Export licensed user inventory for cleanup planning and reporting.
Coming soon / Planned read-only check
Coming soon
How to read the labels
Example playbook
A starter workflow you can read, adapt, and test before using in your own environment.
Lab review pending
The content needs more review before it should be treated as tested guidance.
Production validation required
Every tenant is different. Validate scope, permissions, and output before relying on a workflow.
Coming soon
A planned read-only check that belongs in the broader tenant review workflow.