Purpose
Microsoft 365 accumulates sensitive data in places most organisations never audit: mailbox forwarding rules, "anyone with the link" shares, Teams chat history, and forgotten permission breaks. This checklist gives a structured review across the platform, with a priority, an accountable owner role and the evidence needed to show each check was actually done.
Capability names change across Microsoft 365 admin centres, so checks are described generically rather than by menu path. Use it alongside the AI Privacy Risk Checklist before enabling any AI assistant that indexes this content, and the Data Inventory and RoPA Starter Kit so these repositories are captured as systems. For program context see Practical Privacy Program Implementation; if AI tools are in scope, see AI Privacy and Data Readiness. Start with the assessment to see how this fits your overall posture.
How to use it
Work area by area. For each check record priority, owner role, and evidence — a report export, a signed-off config change, or a documented decision. Re-run high-priority checks on a fixed cadence, not once.
Exchange Online
| Check | Priority | Owner | Evidence |
|---|
| Review mailbox forwarding rules, including auto-forward to external addresses | High | IT/security admin | Exported rule report, exceptions justified |
| Review shared mailbox and delegate access | Medium | IT admin | Access list with business justification |
| Confirm mail flow rules don't silently exfiltrate attachments externally | High | Security admin | Mail flow rule export |
| Review distribution/group membership for sensitive-topic lists | Low | Data owner | Membership export vs. expected roster |
SharePoint and OneDrive
| Check | Priority | Owner | Evidence |
|---|
| Identify sites/libraries shared broadly org-wide | High | Privacy/IT lead | Sharing report with remediation log |
| Identify anonymous/"anyone with the link" shares, especially with edit rights | High | IT admin | External sharing report, removed-link log |
| Review guest access; remove stale guests | Medium | IT admin | Guest access report with removal dates |
| Review permission-inheritance breaks on high-value sites | Medium | Site owner | Permission audit export |
| Review leaver/inactive OneDrive accounts for orphaned sensitive content | Medium | IT admin | Leaver access review log |
Teams
| Check | Priority | Owner | Evidence |
|---|
| Review external access and guest permissions | High | IT admin | Tenant configuration export |
| Review private channel/chat storage for unexpected sensitive content | Medium | Data owner | Sample content review notes |
| Confirm recording/transcription retention aligns with your schedule | Medium | Privacy lead | Retention mapping document |
| Review apps/connectors with access to Teams content | Low | IT admin | Approved app register |
Sensitivity labels
| Check | Priority | Owner | Evidence |
|---|
| Confirm a small, meaningful label taxonomy exists | High | Privacy lead | Approved taxonomy document |
| Confirm labels are applied to priority sensitive content | High | Data owner | Label coverage report |
| Confirm label protections are tested, not just configured | Medium | Security admin | Test case results |
Data loss prevention
| Check | Priority | Owner | Evidence |
|---|
| Run DLP policies in test/audit mode before enforcement | High | Security admin | Simulation report reviewed pre-go-live |
| Confirm alerts route to an owner who reviews them | High | Security admin | Alert triage log |
| Tune false positives before broad enforcement | Medium | Security admin | Tuning notes, revised policy history |
Retention
| Check | Priority | Owner | Evidence |
|---|
| Confirm mail/Teams/document retention matches your schedule | High | Privacy lead | Policy list mapped to schedule |
| Confirm legal hold is documented and tested | Medium | Legal/privacy lead | Test hold with confirmed preservation |
| Review disposition review workflow for expiring content | Low | Data owner | Disposition review log |
Sharing and guest access (cross-cutting)
| Check | Priority | Owner | Evidence |
|---|
| Set and document tenant-wide default sharing posture | High | IT admin | Signed-off sharing policy |
| Re-certify external sharing on sensitive-data sites | Medium | Site owner | Re-certification log |
eDiscovery / Content Search
| Check | Priority | Owner | Evidence |
|---|
| Restrict content search access to authorised roles | High | Security admin | Role assignment export |
| Test that a search actually finds known sensitive content across mail/SharePoint/Teams | Medium | Privacy lead | Test search results |
| Confirm search/export activity is itself logged | Medium | Security admin | Audit export of search actions |
Purview data classification
| Check | Priority | Owner | Evidence |
|---|
| Confirm sensitive information types reflect actual data, not just defaults | High | Privacy lead | Reviewed classifier list |
| Run scans against priority repositories rather than relying on discovery alone | Medium | Privacy lead | Scan report with follow-ups |
| Spot-check for false negatives on known sensitive documents | Low | Data owner | Spot-check log |
Audit logging
| Check | Priority | Owner | Evidence |
|---|
| Confirm unified audit logging is enabled tenant-wide | High | IT admin | Configuration confirmation |
| Confirm log retention meets investigative/regulatory needs | Medium | Privacy/security lead | Retention setting with rationale |
| Confirm the team can actually query logs during an incident | High | Security admin | Rehearsal test query result |
Prioritise on two factors: sensitivity of the data exposed, and breadth of exposure (how many people, and whether external parties, can reach it). Broad or anonymous external access to sensitive data is urgent regardless of cause. Before enabling any AI assistant, treat all High items above as blocking — assistants tend to surface over-broad access immediately and at scale.
Worked example (illustrative)
A mid-sized professional services firm runs the SharePoint/OneDrive checks ahead of an AI assistant pilot. The sharing report surfaces a finance site with an "anyone with the link" edit link created two years earlier for an audit and never removed. Given the sensitivity and breadth, priority is set High; IT removes the link, the privacy lead files a before/after export as evidence, and the finding becomes part of the pilot's go/no-go criteria. Illustrative only.
Maintenance and review
- Re-run High checks at least quarterly; Medium checks twice a year; Low checks annually.
- Trigger an out-of-cycle review before enabling any new AI assistant, connector, or major sharing policy change.
- One accountable owner (typically privacy or IT security lead) confirms all area owners completed their reviews and filed evidence.
- CSV worksheet (.csv) — every check with its area, priority, owner role, assigned owner, evidence requested, finding, status, action and due date, plus one clearly labelled example row.
- Guidance (Markdown .md) — this page.
- Print / Save as PDF — a clean print view for review meetings.
Nothing here is emailed — each option downloads or prints directly from your browser.