A Microsoft 365 tenant can look normal from the user's point of view while carrying serious security gaps behind the scenes. We pay close attention to identity, administrator access, forwarding, third-party applications, sharing and the controls that determine what happens after a credential is stolen.
Microsoft 365 security depends on identity, configuration, licensing, user behavior and ongoing administration.
This guide outlines practical areas organizations should review.
1. Require Strong Authentication
Use multi-factor authentication for business users and especially privileged accounts.
Organizations using appropriate licensing can implement Conditional Access to apply more granular authentication and device requirements.
2. Protect Administrative Accounts
Limit the number of administrators.
Use least privilege and separate privileged access from everyday user activity where practical.
Review administrator roles periodically.
3. Secure User Lifecycle
Create a repeatable process for onboarding, job changes and terminations.
Offboarding should address active sessions, passwords, MFA methods, devices, forwarding rules, shared data and third-party applications.
4. Protect Email
Configure anti-spam and anti-phishing protections appropriate to the tenant.
Use SPF, DKIM and DMARC to strengthen domain email authentication.
5. Review Forwarding and Inbox Rules
Attackers who compromise a mailbox may create forwarding rules or other persistence.
Monitor suspicious changes and review unusual mail-flow behavior.
6. Control OAuth and Third-Party Applications
Applications can request access to Microsoft 365 information.
Organizations should understand which applications are authorized, what permissions they have and who can approve new application access.
7. Manage External Sharing
Review how SharePoint, OneDrive and Teams allow data to be shared outside the organization.
Guest access should match business requirements.
8. Protect Devices
Where appropriate, use endpoint management and device compliance to determine which devices can access business data.
9. Enable and Retain Useful Logs
Logging supports both security monitoring and incident investigation.
Retention depends on Microsoft licensing and organization requirements.
10. Plan Data Recovery
Determine whether native Microsoft retention capabilities meet the organization's recovery requirements or whether an independent Microsoft 365 backup is appropriate.
11. Review Security Regularly
Microsoft cloud services change continuously.
Review identities, applications, privileged roles, security alerts, sharing and policy settings periodically.
Common questions
Does Microsoft provide security features?
Yes. Microsoft 365 offers extensive security capabilities, but features depend on licensing and must be configured and managed.
Is MFA enough?
MFA is a critical control but not a complete security program. Organizations must also manage devices, email threats, privileged access, applications, sharing and logging.
Should every organization use Conditional Access?
Conditional Access can be powerful, but licensing and requirements vary. Rules should be planned and tested to prevent unintended access problems.
Sources and further reading
This guide references current primary-source material. Requirements and product capabilities can change, so verify current source guidance before implementation.