Most Microsoft 365 tenants we review were set up quickly and have grown without a plan. The good news is that a small number of settings account for a large share of real-world risk. If you are responsible for Microsoft 365 in a growing organization, start here.
1. Require multifactor authentication for everyone
Stolen passwords remain the most common way into Microsoft 365. Require MFA for every user, not just administrators. If you have Microsoft Entra ID P1 — included in Microsoft 365 Business Premium — use Conditional Access policies rather than per-user settings, so you can apply consistent rules and exceptions.
2. Use stronger methods for administrators
Attackers increasingly bypass basic MFA through phishing proxies and repeated push notifications. Administrators should use phishing-resistant methods such as passkeys or FIDO2 security keys, and approval prompts should show number matching and sign-in context.
3. Reduce the number of global administrators
Many tenants have more global administrators than they need. Keep a small number of dedicated administrator accounts that are not used for daily email, assign narrower roles where possible and keep two secured emergency-access accounts.
4. Block legacy authentication
Older protocols cannot enforce MFA. Microsoft has disabled Basic authentication for most Exchange Online protocols, but confirm that legacy sign-ins are blocked by policy and that no business application still depends on them.
5. Stop automatic forwarding to external addresses
After compromising a mailbox, attackers often create rules that forward mail outside the organization. Block external auto-forwarding by default and review existing inbox rules for unexpected forwarding or deletion.
6. Configure SPF, DKIM and DMARC
These DNS records help receiving mail servers verify that messages claiming to come from your domain are genuine. Publish SPF, enable DKIM signing and move DMARC from monitoring toward enforcement once legitimate mail sources are identified.
7. Review external sharing
Check how SharePoint and OneDrive files can be shared outside the organization. “Anyone” links that never expire are a common source of exposure. Set sensible defaults, require expiration and review existing links for sensitive sites.
8. Manage the devices that reach company data
Unmanaged laptops and phones are hard to secure and impossible to wipe. Use Microsoft Intune to enroll company devices, require encryption and updates, and protect company data in mobile apps on personal phones.
9. Make sure audit logging is on and retained
When something goes wrong, audit records show what happened. Confirm that unified audit logging is enabled and understand how long your plan retains records. Retention periods vary by license.
10. Plan for recovery
Microsoft keeps the service running, and retention policies and recycle bins help recover recent deletions. They are not the same as a backup you control. Decide what you would need to restore after ransomware or a malicious deletion, and whether third-party backup is justified.
Where to go from here
These checks are a starting point, not a complete assessment. Settings interact, licensing affects what is available and changes must be rolled out carefully to avoid disrupting staff. If you would like an independent review, our Microsoft 365 Security Assessment covers these areas and more, with prioritized recommendations.
