Microsoft 365 is the backbone of many organizations — and a prime target. Compromised mailboxes lead to business email compromise, data theft and ransomware. This baseline focuses on the controls with the biggest impact. Feature availability depends on your licences, so check what your tenant includes.
1. Identity and sign-in
- Enforce MFA for every user. Use Conditional Access policies (Entra ID P1) or, at minimum, security defaults. Exclusions should be rare, documented and reviewed.
- Use phishing-resistant methods for administrators. FIDO2 security keys, passkeys or Windows Hello for Business resist real-time phishing proxies that defeat push and code-based MFA.
- Block legacy authentication. Protocols that can't do MFA are a favourite route for password-spraying attacks.
- Require compliant or managed devices for access to sensitive applications where practical.
2. Administrative access
- Keep the number of Global Administrators small — typically two to four.
- Use dedicated, cloud-only admin accounts that don't have mailboxes and aren't used for daily work.
- Assign the least-privileged role that does the job, and use just-in-time elevation (Privileged Identity Management, Entra ID P2) where available.
- Maintain two emergency “break-glass” accounts with strong, securely stored credentials, excluded from Conditional Access in a controlled way and monitored for any use.
3. Email protection
- Publish SPF and DKIM for every sending domain, and move DMARC to an enforcing policy (quarantine or reject) once you've confirmed legitimate mail passes.
- Confirm that automatic forwarding to external addresses is blocked in the outbound spam policy, with approved exceptions only.
- Enable Safe Links and Safe Attachments if you have Microsoft Defender for Office 365.
- Tag external email so staff can spot impersonation attempts.
4. Logging and detection
- Verify that the unified audit log is enabled and understand its retention period under your licence.
- Alert on high-risk events: new inbox rules that forward or delete mail, OAuth app consents, MFA method changes and sign-ins from unusual locations.
- Use Entra ID Protection risk policies where licensed, and forward logs to your SIEM for correlation and longer retention.
5. Data sharing
- Restrict anonymous “anyone” links in SharePoint and OneDrive, or require expiry dates.
- Review external sharing settings and guest access regularly, and remove stale guests.
- Apply sensitivity labels and data loss prevention policies to your most sensitive information where licensed.
6. Measure and maintain
Microsoft Secure Score is a useful guide to configuration gaps, but treat it as a checklist rather than a goal in itself. Review your baseline at least quarterly — new features, licence changes and business needs all cause drift.