Ten Microsoft 365 security controls to set first

This is a sensible order of work for the security of a Microsoft 365 tenant in a small or mid-sized organisation. It is a starting point, not a complete programme, and some controls depend on your licence. The order matters: identity first, because stolen or guessed passwords are one of the commonest ways into a Microsoft 365 account, and the NCSC recommends multi-factor authentication for online business services.

Microsoft changes its settings, portals and licensing regularly, so use this as a checklist of what to look for and confirm each step against Microsoft’s current documentation, linked below where it matters most.

Identity

1. Multi-factor authentication for everyone. Require it for all users, not just administrators. Prefer the Microsoft Authenticator app or a security key over text messages, and phishing-resistant methods such as passkeys for administrators where you can. If you have no Conditional Access policies, the security defaults setting in Microsoft Entra ID is a reasonable baseline, because it requires registration for multi-factor authentication and blocks some older sign-in methods.

2. Block legacy authentication. Older sign-in protocols cannot use multi-factor authentication, so attackers target them. Block them once you have checked that nothing you rely on, such as an old scanner or line-of-business application, still needs them.

3. Conditional Access baseline. Use policies to require multi-factor authentication, block sign-ins from places you never work from, and require managed or compliant devices for sensitive apps. This needs a licence that includes Microsoft Entra ID P1, which Business Premium and the Enterprise plans do.

4. Separate and protect administrator accounts. Administrators should have a separate account for admin tasks, with no email or web browsing on it, and as few Global Administrators as the business can run with. Keep two emergency “break-glass” accounts that are excluded from policies that could lock everyone out, stored securely and monitored. Microsoft now requires multi-factor authentication to sign in to its admin portals, and it recommends phishing-resistant methods for emergency accounts, so check Microsoft’s current emergency access guidance rather than relying on a password alone.

5. Control app consent. Restrict users from granting third-party applications access to company data without approval, and turn on the admin consent workflow so requests reach someone who can judge them. Malicious “consent” requests are a real attack route.

Email

6. Anti-phishing and safe links. Enable protection against impersonation, dangerous links and unsafe attachments. In the Microsoft Defender portal, the Standard and Strict preset security policies are a quick way to apply a sensible baseline. Set up SPF, DKIM and DMARC so that criminals cannot easily send email that looks like it comes from your domain.

7. Check automatic external forwarding. Attackers who gain access often create a hidden rule that forwards mail out. Review the outbound spam policy, and look at mailbox forwarding and inbox rules for addresses outside the business. Block or alert on automatic forwarding to external addresses.

Devices and data

8. Manage devices. Require encryption, screen locks and supported operating systems, and keep them patched. Microsoft Intune, included in Business Premium, does this, and it lets you remove company data from a lost or stolen device.

9. Label and protect sensitive data. Start small: decide what is confidential, label it, and use data loss prevention to stop it leaving by accident. This also reduces what Copilot can expose if you adopt it. Business Premium includes sensitivity labels, but check what your licence covers.

Detection and recovery

10. Logging, alerts and backup. Make sure audit logging is on and that someone reads the alerts. Retention depends on your licence, so check how far back you can look. And remember that Microsoft keeps the service running but does not act as your backup. Recycle bins and retention features exist, but decide how you would restore email and files after an incident or a mistake, and test it.

Measure as you go

Microsoft Secure Score, in the Microsoft Defender portal, gives you a number and a list of recommended actions for your tenant. It is a useful way to see progress, but treat it as a guide, not a goal. A higher score does not always mean the right controls are in place for your business, and some recommendations need a licence you may not have.

A sensible order over a month

1. Week one: multi-factor authentication for everyone, block legacy sign-in, and review who holds administrator roles.
2. Week two: email protection, DMARC and forwarding rules.
3. Week three: device management and a Conditional Access baseline, with a pilot group first.
4. Week four: logging, recovery tests and a dated record of what you have enabled.

Tell staff before you change anything that affects how they sign in. Most of the pain in a rollout comes from surprises, not from the controls themselves.

Where the licence limits you

Some controls need more than Business Premium. Just-in-time administrator access through Microsoft Entra Privileged Identity Management, for example, needs a higher licence. Do not buy for the sake of it: first work out which gaps matter to your business and which risks you can accept.

Evidence for clients and insurers

Insurers and clients increasingly ask about multi-factor authentication, patching, backups and admin controls. A short record of what you have enabled, dated, is often enough to answer a questionnaire and helps if you pursue Cyber Essentials.

About this guide

Innoligo is an authorised Microsoft CSP partner. This guide is general information and applies whoever you buy your licences from. A security assessment reviews these controls against your actual configuration and ranks the fixes for you. If you are still choosing a plan, read Microsoft 365 plans compared.

Microsoft, Microsoft 365, Entra, Intune, Defender and Copilot are trademarks of the Microsoft group of companies. This guide is independent and is not published or endorsed by Microsoft.