The summary.
ENABLE MULTI-FACTOR AUTHENTICATION FOR EVERY ACCOUNT
It prevents the large majority of compromises, and mail compromise is the commonest incident of all.
Block legacy authentication, which exists precisely to bypass it. And give administrators separate accounts from their daily ones.
SYNCHRONISED STORAGE IS NOT A BACKUP
A deletion, corruption or encryption synchronises everywhere. Establish how far version history goes and whether it is sufficient.
CONFIGURE YOUR MAIL AUTHENTICATION RECORDS, AND START IN MONITORING MODE
Without them your mail is filtered or rejected elsewhere. Setting the policy strictly first blocks legitimate mail you forgot about.
WATCH FOR FORWARDING RULES NOBODY CREATED
It is the classic sign of a compromised mailbox, and it persists after a password change.
REVIEW WHICH APPLICATIONS USERS HAVE GRANTED ACCESS TO
Consent to a malicious application bypasses passwords entirely.
HANDLE MAILBOXES AND FILES BEFORE REMOVING A LICENCE
Removing it first can begin deleting data. Use a shared mailbox, which needs no licence, for a departed person's address.
