Securing Microsoft 365: the first ten settings

Why the defaults are not enough

Microsoft 365 is the centre of daily work for many Alberta businesses: email, files, Teams and identity all live there. That makes it the main target. Microsoft has improved its defaults over the years, but tenants created years ago often still carry older settings, and features such as conditional access depend on your licence. A short review of key settings closes the most common gaps.

The list below assumes Microsoft 365 Business Standard or Business Premium. Business Premium includes Entra ID P1 and Defender for Business, which unlock several of the stronger controls described here. If you are on a different plan, most items still apply, but some controls may need security defaults instead of custom conditional access policies. Your provider can confirm what your licence includes.

Identity and sign-in

Most Microsoft 365 compromises start with a stolen password, so identity settings come first. Require MFA for every user, either through security defaults or conditional access policies. Block legacy authentication, which cannot enforce MFA. Give administrators separate admin accounts that are not used for email or browsing, and keep the number of global administrators small, usually two to four.

Create one or two emergency access accounts, sometimes called break-glass accounts, with long passwords stored securely offline. They let you regain access if a policy locks everyone out. Exclude them from normal conditional access policies, monitor them for any sign-in, and check that they still work a couple of times a year.

• 1. Require MFA for all users
• 2. Block legacy authentication
• 3. Use separate, limited admin accounts
• 4. Create documented emergency access accounts

Email protection

Email is where fraud starts, so tighten Exchange Online next. Turn on the preset security policies in Microsoft Defender, which apply recommended anti-phishing, anti-spam and anti-malware settings. Block automatic forwarding of email to external addresses, a favourite trick of attackers who want a quiet copy of a finance mailbox. Set up SPF, DKIM and DMARC for your domain so others cannot easily spoof it.

Make sure external email is tagged so staff can see when a message that looks internal actually came from outside the organization. Microsoft provides a built-in external sender tag in Outlook that can be enabled by an administrator. It costs nothing and gives staff a simple, consistent visual cue right where they read messages.

• 5. Apply Defender preset security policies
• 6. Block automatic external forwarding
• 7. Configure SPF, DKIM and DMARC

Visibility and data sharing

You cannot investigate what you did not record. Confirm that the unified audit log is turned on and know how long it retains data on your licence. Configure alert policies so administrators are notified about suspicious events such as new inbox rules that forward or delete mail, or unusual sign-in activity.

Review sharing settings in SharePoint and OneDrive. Allowing anyone links with no sign-in makes it easy for sensitive files to travel far beyond your organization. Limit external sharing to specific people, set expiry on guest links, and review guest accounts periodically. Sensitivity labels can add another layer for the files that matter most.

• 8. Confirm audit logging and alerts
• 9. Restrict external sharing in SharePoint and OneDrive

Devices and ongoing review

The tenth setting connects devices to your policies. With Intune, included in Business Premium, you can require company laptops and phones to be encrypted, updated and protected before they reach company data. Even a basic policy that blocks access from unmanaged devices to sensitive apps raises the bar considerably. Start with company laptops, then add phones.

Finally, use Microsoft Secure Score as a checklist rather than a grade. It suggests improvements specific to your tenant. Review it quarterly, and document any recommendation you choose not to adopt and why. Some recommendations will not suit your business, and that is fine as long as the decision is deliberate and written down.

• 10. Require managed, compliant devices for company data