1. Enforce MFA for Office 365 Global Admin Accounts – Global Admin accounts are tempting, high-value targets for attackers and need to be protected accordingly. Organizations should enforce MFA for all Office 365 Global Admin accounts. While Azure MFA requires licensing (Azure AD Premium or other corresponding bundle), Microsoft offers MFA for free on all admin accounts. Couple this with the Exchange Online PowerShell module that supports MFA for added protection (note: MFA-enabled accounts cannot be setup to run scheduled, which is logical considering no one is typically present to provide a second auth factor). See articles "What is Azure Multi-Factor Authentication?" (link) and "How To Get Azure Multi-Factor Authentication" (link) for additional information.
2. Enable Exchange Online and Skype for Business Online Modern Authentication – Disabled for these workloads by default, organizations are encouraged to enable modern authentication for Exchange Online and Skype for Business Online (recommendation is to enable both to prevent extra logon prompts). Keep in mind that this will not disable basic authentication but will enable modern authentication capabilities for supported clients which includes MFA. When modern authentication is enabled for Exchange Online, Outlook 2016 and Outlook 2013 (version 15.0.4753 or later, with a required registry setting) will use modern authentication to log in to Office 365 mailboxes instead of basic authentication. This also enables other authentication features like multi-factor authentication (MFA) using smart cards, certificate-based authentication (CBA) and third-party SAML identity providers. If your organization is using third-party federation service, please check with the vendor to ensure modern authentication is supported.
3. Enable Mailbox-level Auditing for All Exchange Online Mailboxes – Sometimes administrators require audit logs for investigative purposes. This is sometimes necessary as a result of a breach but also sometimes to try and determine the actions that led up to a certain outcome (such as a delegate deleting an item out of a delegator's mailbox). Mailbox-level audit actions are only recorded when mailbox auditing is enabled and it is disabled by default. In order to be able to comply with the organization's auditing needs, enable it for all mailboxes and if needed, adjust the auditing config (such as login and all deletes for owner actions). Unfortunately, setting AuditEnabled to True via Set-MailboxPlan is not supported. Therefore, develop a simple maintenance script to enable auditing for all mailboxes.
4. Disable Client-Based Auto-Forwarding - Remote domain settings override settings that users might configure in Outlook or OWA.       By default, users are allowed to setup automatic forwarding to any remote domain but auto-forwarding can be easily disabled by updating the default remote domain named Default. Use Exchange Online RPS "Set-RemoteDomain Default -AutoForwardEnabled:$False". This is a global setting and applies to every email sent from within the tenant. For a little more granular control (i.e., to allow overrides) an Exchange Transport Rule can be employed instead (text from securescore.office.com):
   • If The Sender is located 'Inside the organization'
   • If The Recipient is located 'Outside the organization'
   • If The message type is 'Auto-Forward'
   • Reject the message with the explanation 'External Mail Forwarding via Client Rules is Not Permitted'
5. Update the Default MRM Policy (or Create a New One) – The Default MRM policy in Exchange Online includes a move to archive default policy tag as well as a number of personal tags. Update the policy early if needed or create additional policies if desired. As an aside, I am a proponent of using a couple of additional tags, including "Junk Email" and "Deleted Items" (and sometimes "Sent Items"). Also note that if you create a new retention policy, it will have to be assigned to all current and future mailboxes (see Mailbox Plans below for more information on automating). Use Exchange Online RPS "Set-Mailbox <Mailbox> -RetentionPolicy:<PolicyName>".
6. Disable Remote PowerShell for Non-Admin Users - By default, all accounts in Exchange Online are allowed to use Exchange Online PowerShell. Administrators can enable or disable a user’s ability to connect to Exchange Online PowerShell. While a user's capabilities in Exchange Online PowerShell are defined by role based access control (RBAC) and the roles that are assigned to them, it's generally unnecessary and opens up another connectivity method when accounts are compromised. Use Exchange Online RPS "Set-User <Account> -RemotePowerShellEnabled:$True".
7. Disable POP3 and IMAP4 (and Other Protocols) on Mailboxes - POP and IMAP are client access protocols not used very often these days, except in the case of application mailboxes. As with the case with many of the client access protocols, they could be utilized to remotely try and guess user credentials. If an organization already requires the use of Outlook mobile app, the ActiveSync protocol can be disabled since the Outlook mobile app uses its own API in combination with REST.  Controls options include changing settings on a per-mailbox level (example: Exchange Online RPS: "Set-CASMailbox <Mailbox> -PopEnabled:$False -ImapEnabled:$False"), Exchange Online Mailbox Plans (see below) and Exchange CARs (see below).
8. Standardize Future Mailbox Configurations via Mailbox Plans - Some configurations can be deployed via mailbox plans such as quotas, retention policies, RoleAssignmentPolicy, enablement of certain protocols. See articles "Set-MailboxPlan" (link) and "Set-CASMailboxPlan" (link) for additional information.
9. Consider Deploying Exchange Client Access Rules (CARs) to Disable Unwanted Mailbox Access Methods - CARs help control access to the organization's email based on client properties or client access requests. CARs are like transport rules for client connections to the Exchange Online organization. While above I mentioned disabling certain features or protocols on a per-mailbox basis (such as PowerShell, POP and IMAP) CARs can be used to disable things more broadly but also allow exceptions. See article "Client Access Rules in Exchange Online" (link) for additional information.
10. Enable New OME (Office Message Encryption) - OME makes it easier to share protected emails with anybody—inside or outside of the organization. If your tenant was created after February 2018 OME should already be enabled by default. However, if it was enabled before this date then it is likely not enabled. Note that OME requires E3 licenses or higher. Enabling OME takes a bit more than just toggling the feature on but is documented. See articles "Office 365 Message Encryption FAQ" (link) and "Set Up New Office 365 Message Encryption Capabilities Built On Top of Azure Information Protection" (link) for additional information.
11. Deploy Report Message Outlook Add-in For All Users - This is not the legacy Outlook COM add-in that was deployed via MSI but rather, a new Report Message add-in for Outlook that enables users to easily report misclassified email, whether safe or malicious, to Microsoft for analysis. Microsoft uses these submissions to improve the effectiveness of email protection technologies. You can easily enable the add-in for your entire organization for both OWA and Outlook click-to-run. In order to see what users are doing, organizations can also create a transport rule to copy the messages off to another mailbox for later review. See article "Enable the Report Message Add-In" (link) for additional information.
12. Deploy Office 365 ProPlus Monthly (Used To Be Called Current) Channel to Everyone - Many organizations take a conservative approach to deploying Office to users and often times choose to deploy Semi-Annual (used to be called Deferred) channel to most users. However when doing so, organizations run the risk of having to deal/live with potential issues until the next build release which could be up to 6 months away (now with releases in January and July) since only security updates are address between releases. If an issue is impactful enough, the only workaround organizations have is to move users up to Semi-Annual (Targeted) or to Monthly. This could be on a temporary basis (moved back when the issue is fixed) but this can be time consuming and disruptive for the user who is already dealing with an issue. If the frequency of updates and potential changes is manageable to your users, consider deploying Monthly to the majority of the organization and Semi-Annual as an exception. See article "Overview of Update Channels for Office 365 ProPlus" (link) for additional information.

PS C:\> Get-Mailbox -InactiveMailboxOnly | ? {$_.WhenSoftDeleted -lt [DateTime]::Now.AddDays(-30)} | ft Name,WhenSoftDeleted

Name               WhenSoftDeleted
----               ---------------
Test32             06/12/17 9:23:07 PM
Test24             06/12/17 9:10:04 PM
Test25             07/19/17 8:56:14 AM

• Restore - If another employee takes on the job responsibilities of the departed employee, or if another user needs access to the contents of the inactive mailbox, the contents of the inactive mailbox to an existing mailbox can be restored (or merged). The archive from an inactive mailbox can also restored. After it's restored, the inactive mailbox is preserved and is retained as an inactive mailbox.
• Recover - If the departed employee returns to your organization, or if a new employee is hired to take on the job responsibilities of the departed employee, the contents of the inactive mailbox can be recovered. This method converts the inactive mailbox to a new mailbox that contains the contents of the inactive mailbox. After it's recovered, the inactive mailbox no longer exists.

• Litigation Hold (if it was enabled for the inactive mailbox) is removed.
• In-Place Holds are removed. This means that the inactive mailbox is removed as a source mailbox from any In-Place Hold or In-Place eDiscovery searches.
• The inactive mailbox is removed from any Office 365 retention policies that where applied to it.
• The single item recovery period (which is defined by the RetainDeletedItemsFor mailbox property) is set to 30 days. Typically, when a new mailbox is created in Exchange Online, this retention period is set to 14 days. Setting this to the maximum value of 30 days gives you more time to recover any data that's been permanently deleted (or purged) from the inactive mailbox. You can also disable single item recovery or set the single item recovery period back to the default of 14 days.
• Retention hold is enabled, and the retention hold duration is set to 30 days.

1. Perform Restore Process to Existing Mailbox
2. Perform Recovery Process to New Mailbox with Soft Match

Perform Restore Process to Existing Mailbox

PS C:\> Get-Mailbox testmbx01 -InactiveMailboxOnly | fl Name,DistinguishedName,ExchangeGuid,PrimarySmtpAddress

Name               : TestMbx01
DistinguishedName : CN=TestMbx01,OU=Soft Deleted Objects,OU=jebjeb.onmicrosoft.com,OU=Microsoft Exchange Hosted
                     Organizations,DC=NAMPR15A001,DC=PROD,DC=OUTLOOK,DC=COM
ExchangeGuid       : 44d9503c-8b4d-43c6-b60b-951312dd4535
PrimarySmtpAddress : TestMbx01@jebeckham.com

PS C:\> $InactiveMailbox = Get-Mailbox -InactiveMailboxOnly -Identity 44d9503c-8b4d-43c6-b60b-951312dd4535
PS C:\> $InactiveMailbox

Name                     Alias               ServerName       ProhibitSendQuota
----                     -----               ----------       -----------------
TestMbx01                 TestMbx01           sn1pr15mb0207   99 GB (106,300,440,576 bytes)

PS C:\> New-MailboxRestoreRequest -SourceMailbox $InactiveMailbox.DistinguishedName -TargetMailbox TestMbx10@jebeckham.com -TargetRootFolder "TestMbx01-Restore" -AllowLegacyDNMismatch

Name           TargetMailbox Status
----           ------------- ------
MailboxRestore TestMbx10     Queued

PS C:\> Get-MailboxRestoreRequest

Name           TargetMailbox Status
----           ------------- ------
MailboxRestore TestMbx10     Completed

PS C:\> Get-MailboxRestoreRequest | fl

RunspaceId       : e42290bf-3ad7-4c19-8f9d-346e8c53d856
SourceDatabase   : NAMPR15DG013-db119
TargetMailbox     : TestMbx10
Name             : MailboxRestore
RequestGuid       : f4e44d33-f92f-4e6b-b8c0-4d7107167763
RequestQueue     : NAMPR15DG098-db101
Flags             : IntraOrg, Pull
BatchName         :
Status           : Completed
Protect           : False
Suspend           : False
Direction         : Pull
RequestStyle     : IntraOrg
OrganizationId   : NAMPR15A001.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/jebjeb.onmicrosoft.com -
                   NAMPR15A001.PROD.OUTLOOK.COM/ConfigurationUnits/jebjeb.onmicrosoft.com/Configuration
SourceMailboxSize :
WhenChanged       : 03/02/18 10:34:37 AM
WhenCreated       : 03/02/18 10:33:32 AM
WhenChangedUTC   : 03/02/18 4:34:37 PM
WhenCreatedUTC   : 03/02/18 4:33:32 PM
Identity         : TestMbx10\MailboxRestore
IsValid           : True
ObjectState       : New

PS C:\> Get-MsolUser -SearchString testmbx01 -ReturnDeletedUsers

UserPrincipalName       DisplayName isLicensed
-----------------       ----------- ----------
TestMbx01@jebeckham.com TestMbx01   False

PS C:\> Get-Mailbox testmbx01 -InactiveMailboxOnly

Name                     Alias               ServerName       ProhibitSendQuota
----                     -----               ----------       -----------------
TestMbx01                 TestMbx01           sn1pr15mb0207   99 GB (106,300,440,576 bytes)

Perform Recovery Process to New Mailbox with Soft Match

PS C:\> Get-Mailbox testmbx02 -InactiveMailboxOnly | FL Name,DistinguishedName,ExchangeGuid,PrimarySmtpAddress

Name               : TestMbx02
DistinguishedName : CN=TestMbx02,OU=Soft Deleted Objects,OU=jebjeb.onmicrosoft.com,OU=Microsoft Exchange Hosted
                     Organizations,DC=NAMPR15A001,DC=PROD,DC=OUTLOOK,DC=COM
ExchangeGuid       : a0f88755-9b5a-4ba6-8508-e91163807a80
PrimarySmtpAddress : TestMbx02@jebeckham.com

PS C:\> $InactiveMailbox = Get-Mailbox -InactiveMailboxOnly -Identity a0f88755-9b5a-4ba6-8508-e91163807a80
PS C:\> $InactiveMailbox

Name                     Alias               ServerName       ProhibitSendQuota
----                     -----               ----------       -----------------
TestMbx02                 TestMbx02           sn6pr15mb2464   99 GB (106,300,440,576 bytes)

PS C:\> New-Mailbox -InactiveMailbox $InactiveMailbox.DistinguishedName -Name TestMbx30 -DisplayName TestMbx30 -MicrosoftOnlineServicesID TestMbx30@jebjeb.onmicrosoft.com -Password (ConvertTo-SecureString -String 'P@ssw0rd' -AsPlainText -Force) -ResetPasswordOnNextLogon $False

WARNING: After you create a new mailbox, you must go to the Office 365 Admin Center and assign the mailbox a license, or it will be disabled after the grace period.

Name                     Alias               ServerName       ProhibitSendQuota
----                     -----               ----------       -----------------
TestMbx30                 TestMbx30           sn6pr15mb2464   99 GB (106,300,440,576 bytes)

WARNING: The inactive mailbox has been recovered. To preserve data until you obtain a valid license, we have enabled Single Item Recovery for 30 days. Additionally we have also enabled Retention Hold for 30 days. Once a valid license has been assigned for this mailbox, you can choose to disable these settings and use Litigation or In-Place Hold instead to preserve data.

PS C:\> Get-MsolUser -SearchString TestMbx30 | fl UserPrincipalName,DisplayName,isLicensed,ImmutableId

UserPrincipalName : TestMbx30@jebjeb.onmicrosoft.com
DisplayName       : TestMbx30
IsLicensed       : False
ImmutableId       :

PS C:\> Get-Mailbox TestMbx30

Name                     Alias               ServerName       ProhibitSendQuota
----                     -----               ----------       -----------------
TestMbx30                 TestMbx30           sn6pr15mb2464   99 GB (106,300,440,576 bytes)

[PS] C:\>Set-User testmbx30 -WindowsEmailAddress TestMbx30@jebjeb.onmicrosoft.com

PS C:\> Get-MsolUser -SearchString TestMbx30 | fl UserPrincipalName,DisplayName,isLicensed,ImmutableId

UserPrincipalName : TestMbx30@jebeckham.com
DisplayName       : TestMbx30
IsLicensed       : False
ImmutableId       : vPjCsGtfC0OPu8TZkcqFXw==

Sources and Additional Information

• Delete or Restore User Mailboxes in Exchange Online - https://technet.microsoft.com/en-us/library/dn186233(v=exchg.150).aspx
• Restore An Inactive Mailbox in Office 365 - https://support.office.com/en-us/article/Restore-an-inactive-mailbox-in-Office-365-97e06a7a-ef9a-4ce8-baea-18b9e20449a3
• Recover An Inactive Mailbox in Office 365 - https://support.office.com/en-us/article/Recover-an-inactive-mailbox-in-Office-365-35d0ecdb-7cb0-44be-ad5c-69df2f8f8b25
• Overview of Inactive Mailboxes in Office 365 - https://support.office.com/en-us/article/Overview-of-inactive-mailboxes-in-Office-365-1fbd74e8-7a60-4157-afe8-fe79f05d2038
• Manage Inactive Mailboxes in Office 365 - https://support.office.com/en-us/article/Manage-inactive-mailboxes-in-Office-365-296a02bd-ebde-4022-900e-547acf38ddd7

1. Open an on-premises Exchange PowerShell session
2. Connect Exchange Online remote PS:
   • $UserCredential = Get-Credential
   • $Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirection
   • Import-PSSession $Session -Prefix O365
3. Get-Mailbox | ft UserPrincipalName,DisplayName,LitigationHoldEnabled | ? {$_.LitigationHoldEnabled -eq $True}
4. Get-O365Mailbox | ft UserPrincipalName,DisplayName,LitigationHoldEnabled | ? {$_.LitigationHoldEnabled -eq $True}

• $mbxes = @()
• $mbxes += get-mailbox | ? {$_.LitigationHoldEnabled -eq $True}
• $mbxes += get-o365mailbox | ? {$_.LitigationHoldEnabled -eq $True}