Microsoft 365 is secure. Your Microsoft 365 tenant probably is not. The platform ships with reasonable defaults and a lot of switches that nobody has ever flipped. Below are the ten we find off, in tenants we inherit, most weeks.
A note on licensing before the list, because it decides what you can actually do. Microsoft 365 Business Basic and Standard give you the apps and the email. Business Premium adds Entra ID P1, Intune, Defender for Business and Defender for Office 365 Plan 1, which is where most of the controls below live. If you are on Standard and serious about security, the upgrade to Premium is the first change to make; several of the settings below are not available without it.
1. Phishing-resistant MFA for everyone
Not “most people”. Everyone. Including the CFO who keeps complaining. Microsoft Authenticator with number matching is free, fast, and defeats the session-hijack phishing kits that are now mainstream.
Where to look: Entra admin centre, Protection, Authentication methods. Enable Microsoft Authenticator with number matching for all users, disable SMS and voice call as methods, and set a registration campaign so anyone still on SMS is nudged across within a fortnight. For global admins, register a FIDO2 key or a passkey as well; those accounts are the ones a phish is aimed at.
2. Conditional access baselines
If you have Business Premium, you have Entra ID P1, which means you have conditional access. At minimum: block legacy authentication, require compliant or hybrid-joined devices for admins, and require MFA from unknown locations. That is a 90-minute configuration on a quiet Tuesday.
Build the policies in report-only mode first and leave them there for a week. The sign-in log will show you exactly who would have been blocked and why, which is usually a copier that still sends scans by SMTP and one director’s personal iPad. Fix those, then switch the policies on. Always keep one break-glass account excluded from every policy, with a long password in the safe and an alert on any sign-in.
3. Sign-in risk policies
Identity Protection flags sign-ins with atypical travel, unfamiliar properties, or matches to leaked credentials. Configure the policy to force password reset on medium risk. It catches compromise before the attacker gets useful access.
On Business Premium the risk detections are available but the automated policies need Entra ID P2. The practical route without P2 is a conditional access policy that requires MFA when sign-in risk is medium or high, and a weekly look at the risky users report. Five minutes on a Monday; it has caught leaked credentials for us more than once before the attacker used them.
4. External sender banner
Set-ExternalInOutlook and a transport rule with a yellow banner on the top of every message from outside your tenant. Users start spotting the “looks internal but is not” phishing emails immediately. Biggest bang for no buck.
Use the native Outlook tag rather than a transport rule where you can. Set-ExternalInOutlook -Enabled $true adds the External label in Outlook, Outlook on the web and the mobile apps without touching the message body, so it does not break replies or signatures. Add the domains of trusted partners to the allow list so the label stays meaningful.
5. Defender for Office 365 impersonation protection
Add your board, your finance team, and any name-brand suppliers to the impersonation protection list. Messages that look like them but are not get a warning banner or quarantine. Stops the “urgent invoice” class dead.
Include display-name variants (the “R. McDowell” as well as the “Ryan McDowell”) and the domains of suppliers you pay regularly. Set the action for user impersonation to quarantine rather than “move to junk”; junk folders get read.
6. Anti-phishing and safe links
Default policies leave a lot on the table. Tighten the anti-phishing threshold from standard to aggressive on the high-risk users, enable safe links rewriting, and enable safe attachments with dynamic delivery. Users will not notice anything except fewer bad clicks.
The quickest way to get all of this right is the preset security policies in the Defender portal: apply the Standard preset to everyone and the Strict preset to finance, directors and anyone who can approve a payment. Presets are maintained by Microsoft, so they move as the threats do.
7. Data loss prevention
DLP is the one most teams put off. Start small: a rule that warns users when they share documents containing credit card numbers or national insurance numbers externally. Build from there. The library of templates covers 80 percent of use cases out of the box.
Start in audit mode, not block mode. Two weeks of “what would have been stopped” tells you which rules are going to annoy the sales team and which are catching real leaks. Policy tips that explain why a share was blocked do more for behaviour than a silent failure ever will.
8. Retention and litigation hold
Email retention defaults to “forever, but deletable”. That is neither a retention policy nor a defensible position. Pick a retention period by department, put shared mailboxes on hold, and let Purview do the rest.
A workable starting point for a UK SMB is seven years for finance and anything contractual, three years for general mailboxes, and a hold on any mailbox involved in a complaint or a dispute. Write the periods down somewhere a data subject access request can be answered from; the policy is only defensible if you can explain it.
9. SharePoint sharing defaults
The default is “anyone with the link”. For most businesses that is wrong. Change the default to “specific people” at tenant level, and let users upgrade to wider sharing explicitly. Cuts the accidental overshare by a large margin.
While you are there, set an expiry on any “anyone” links that remain (30 days is plenty), and run the sharing report in the SharePoint admin centre. Most tenants find at least one file that has been open to the internet for years.
10. Audit log retention
Turn on unified audit logging, extend retention to 365 days. When something does happen, you need the logs. Discovering you have 30 days of audit after a breach is a painful lesson.
If a breach investigation ever happens, the questions will be “when did they get in, what did they read, and what did they send”. Only the audit log answers those. Export it to a SIEM or a log store if you can; a year of retention inside Microsoft 365 is the minimum, not the ideal.
And one bonus
Third-party backup. Microsoft does not back up your M365 data. Retention policies and recycle bins are not backup. Keepit, Druva or AvePoint will all cover you for £4 to £6 per user per month.
Test the restore, not just the backup. Once a quarter, pick a mailbox and a SharePoint library at random and restore an item from three months ago. If nobody has ever done that, you do not have a backup, you have a subscription.
How to work through this
None of the above is exotic. None of it requires a consultancy engagement. It does require someone to sit down with the tenant for a day.
If you are doing it yourself, take them in the order above. MFA and conditional access first, because everything else assumes the accounts are sound; the mail protections next, because email is where the attacks arrive; then the data controls. Microsoft Secure Score in the Defender portal will track the changes and point out anything this list missed.
We tune M365 tenants for clients weekly. If yours has never had the treatment, it is probably overdue.