Use cases
- Microsoft 365 or Google Workspace is business-critical and administrative access has grown over time.
- The organization has experienced suspicious logins, phishing, payment-change fraud, or mailbox-rule abuse.
- MFA exists but coverage, exceptions, recovery methods, and privileged identities have not been reviewed together.
- Shared mailboxes, delegates, vendors, former staff, or legacy accounts make ownership unclear.
Review surface
- MFA coverage, authentication policy, recovery methods, and privileged identities
- Mailbox forwarding, inbox rules, delegation, shared mailbox access, and administrative controls
- Email authentication posture including SPF, DKIM, and DMARC where in scope
- External applications, connected services, guest access, and high-risk consent paths
- Joiner, mover, leaver, and account-recovery processes
Method
01Map privileged and high-value identities before looking at lower-risk accounts.
02Review configuration and recent security-relevant account behavior available within the agreed scope.
03Separate preventive controls from detection and recovery controls.
04Prioritize changes that reduce blast radius without creating unnecessary operational friction.
Deliverables
- Identity and mailbox security findings
- Privileged-access and MFA observations
- Forwarding, delegation, and recovery-path review
- Prioritized hardening actions
- Operational recommendations for reporting and verification workflows
Practice context
This work draws on Blackpine IAM engineering, cloud security, email-compromise response, and advisory experience rather than treating mailbox settings as a stand-alone checklist.
Illustrative finding — not client data
Area
Mailbox controls
Observation
External forwarding remains available to accounts that do not require it operationally.
Consequence
A compromised mailbox could silently disclose messages outside the organization.
Example action
Restrict automatic external forwarding by policy, document approved exceptions, and monitor changes to forwarding and inbox rules.
Scope
Engagement boundary
Blackpine does not request passwords through the website or general email. Access requirements are agreed after scope and authorization are confirmed.