Have you considered…?
- MFA baseline. Is MFA required for all user accounts with exceptions only where justified (break-glass, service)?
- Conditional Access coverage. Do policies cover all users, apps, and risky scenarios (impossible travel, unfamiliar sign-ins)?
- Legacy authentication. Is basic/legacy auth fully blocked to prevent password spray and token replay?
- Admin role hygiene. Who has standing Global Admin? Are roles right-sized and elevation audited?
- Break-glass account. Do you have a tested, documented break-glass with safe storage and alerting?
- Guest & app consent. Can guests and apps get in by default, or do you have purposeful guardrails?