Microsoft 365 holds most organisations' email, documents and identities, which makes it one of the most attacked platforms in the world. Microsoft secures the infrastructure, but under the shared responsibility model, configuring your tenant securely is your job.
This is the checklist I use as a Microsoft-certified information security administrator (SC-401). Exact features depend on your licences, such as Business Premium, E3 or E5.
1. Identity and access
- Require MFA for every user, with phishing-resistant methods for administrators.
- Block legacy authentication protocols that cannot do MFA.
- Use Conditional Access to require compliant devices, block risky countries you do not operate in and demand stronger authentication for risky sign-ins.
- Minimise global administrators (two to four is a common target) and use Privileged Identity Management for just-in-time admin access where available.
- Keep two break-glass accounts excluded from Conditional Access, with long passwords stored securely and sign-ins monitored.
- Review guest users and app consents regularly, and restrict users from consenting to risky third-party apps.
2. Email protection
- Enable Defender for Office 365 Safe Links and Safe Attachments, or the preset security policies.
- Configure SPF, DKIM and DMARC for all your domains.
- Block automatic forwarding to external recipients.
- Turn on anti-impersonation protection for executives and your own domains.
More on this in my phishing prevention guide.
3. Data protection with Microsoft Purview
- Create sensitivity labels such as Public, Internal, Confidential and Highly Confidential, with encryption on the top tiers.
- Deploy data loss prevention (DLP) policies for sensitive information like ID card numbers, financial data and health records, starting in audit mode before enforcing.
- Set retention policies that match legal and business requirements.
- Consider insider risk management for high-risk departures and data theft scenarios.
4. SharePoint, OneDrive and Teams sharing
- Disable or restrict "Anyone" links and set expiry dates on external sharing links.
- Limit external sharing to specific trusted domains where possible.
- Control who can create Teams and invite guests.
5. Devices
Manage devices with Intune, define compliance policies (encryption, OS version, screen lock) and require compliant devices for access to corporate data through Conditional Access.
6. Monitoring and response
- Confirm the unified audit log is enabled and retained long enough.
- Send Microsoft 365 and Entra ID logs to your SIEM, such as Microsoft Sentinel.
- Alert on new inbox forwarding rules, impossible travel, mass downloads, new admin role assignments and suspicious OAuth consents.
- Track Microsoft Secure Score, but treat it as a guide, not a goal.
7. Admin hygiene
Admins should use separate cloud-only admin accounts, never read email from privileged accounts, and access admin portals only from trusted devices. Review role assignments every quarter.
Want your tenant reviewed or hardened? Contact me for a Microsoft 365 security assessment.
References and further reading
- Microsoft Entra Conditional Access overview
- Microsoft Purview documentation
- Microsoft Secure Score
- CIS Microsoft 365 Foundations Benchmark
Frequently asked questions
Is Microsoft 365 secure by default?
Microsoft secures the underlying infrastructure, but many important controls such as Conditional Access, DLP, sharing restrictions and alerting must be configured by the customer under the shared responsibility model.
What is Conditional Access in Microsoft 365?
Conditional Access is a Microsoft Entra ID feature that grants or blocks access based on signals such as user, location, device compliance and sign-in risk, for example requiring MFA from unmanaged devices.
What is Microsoft Purview DLP?
Microsoft Purview Data Loss Prevention detects and controls the sharing of sensitive information, such as financial or health data, across email, SharePoint, OneDrive, Teams and endpoints.