Introduction
Microsoft 365 has become an essential platform for businesses, supporting everything from email and file sharing to collaboration and device management. However, moving business operations to the cloud does not automatically make an organisation secure.
As an IT Systems Manager, I believe effective Microsoft 365 security starts with understanding the risks, reviewing the available security controls, and configuring them to suit the organisation’s needs. Additional security products can be valuable, but there is also a great deal businesses can do by properly using the Microsoft 365 security features available to them.
In this guide, I’ll cover seven practical Microsoft 365 security areas every business should review, from identity protection and external sharing to device compliance and data recovery.
Note: Microsoft security features and licensing requirements vary by subscription. Always check which capabilities are available in your organisation’s plan before implementing a policy.
1. Enforce Multi-Factor Authentication (MFA)
Passwords alone are not enough to protect business accounts. Attackers can steal credentials through phishing, password reuse, and other techniques. Multi-factor authentication (MFA) adds another layer of protection by requiring users to verify their identity.
What to review:
- Require MFA for all users wherever possible.
- Use Microsoft Entra Conditional Access when the organisation’s licence supports it.
- Consider phishing-resistant authentication, such as FIDO2 security keys or supported passkeys, especially for privileged administrator accounts.
- Review legacy authentication methods and block those that are no longer required.
Microsoft Authenticator number matching is a useful improvement over simple approval notifications because users must enter a displayed number to complete authentication. However, number matching is not the same as phishing-resistant MFA.
For administrator accounts, stronger authentication methods should be a priority. Before enforcing a new Conditional Access policy, test its impact and ensure emergency access accounts are properly configured to reduce the risk of accidentally locking administrators out.
Microsoft’s guidance: Require phishing-resistant MFA for administrators.
2. Restrict Global Administrator Permissions
One of the most important principles in IT security is least privilege: users should have only the permissions they need to perform their jobs.
Giving multiple employees Global Administrator access for convenience increases the potential impact if an account is compromised.
What to review:
- Audit all accounts assigned the Global Administrator role.
- Assign more specific administrative roles wherever possible.
- Use separate administrator accounts rather than everyday accounts for privileged tasks.
- Review administrator access regularly, including accounts belonging to former employees or external service providers.
- Where licensing permits, use Microsoft Entra Privileged Identity Management (PIM) to provide eligible users with temporary administrative access when needed.
For example, someone who only manages SharePoint may not need Global Administrator permissions. A more limited role can reduce unnecessary access to other parts of the environment.
PIM and some advanced identity controls require specific licensing, so check the organisation’s subscription before planning an implementation.
The objective is simple: limit standing administrative privileges and make privileged access easier to review and control.
3. Review SharePoint and OneDrive External Sharing
Microsoft 365 makes it easy to collaborate with customers, suppliers, and other external parties. However, poorly controlled sharing can expose confidential business information.
A link shared for convenience can become a security risk if it gives broader access than intended.
What to review:
- Check the organisation-wide external sharing settings for SharePoint and OneDrive.
- Use the most restrictive sharing level that still supports business requirements.
- Consider limiting external sharing to approved domains where appropriate.
- Prefer named recipients over anonymous links when access needs to be controlled.
- Configure link expiration and other restrictions where supported and appropriate.
- Review guest accounts and remove access when collaboration ends.
These settings should reflect how the business actually works. Some organisations need frequent external collaboration, while others handle sensitive information that requires tighter restrictions.
Avoid disabling external sharing without consulting the teams that depend on it. Instead, establish a clear policy and review exceptions regularly.
For businesses that rely heavily on SharePoint and OneDrive, security settings should be part of a broader information governance strategy, not a one-time configuration task.
4. Strengthen Email Security and Reduce BEC Risk
Business Email Compromise (BEC) remains a serious risk because attackers can impersonate executives, suppliers, or trusted business contacts to request payments or sensitive information.
Email filtering is important, but no single security tool can stop every phishing or impersonation attempt.
What to review:
- Review the anti-phishing and anti-spam policies available in Microsoft Defender for Office 365 and Exchange Online Protection.
- Configure protection against impersonation and suspicious messages where supported by the subscription.
- Check SPF, DKIM, and DMARC records for the organisation’s email domain.
- Review suspicious inbox rules and automatic forwarding settings.
- Train employees to verify unusual payment requests and bank account changes through a separate, trusted communication channel.
- Establish a clear process for reporting suspicious emails.
For example, if a supplier emails new bank details, employees should verify the change using a known phone number or another previously trusted channel rather than relying on the contact details included in the email.
Mail flow rules can support security controls, but they should not be treated as a complete BEC defence. Technical protection, employee awareness, and payment verification procedures need to work together.
I covered a real email compromise incident and the lessons it taught me in my earlier article, Lessons From a Real Email Compromise Attack: DMARC, Mimecast, and Security Awareness. I also discuss additional defensive measures in Building a Multi-Layered Defense Against BEC Attacks: Beyond Basic Email Security.
5. Review Audit Logs and Security Monitoring
When a security incident occurs, administrators need to understand what happened, which accounts were involved, and what actions were taken.
Microsoft 365 provides audit and sign-in information that can help with investigations. However, simply having logs available does not guarantee that suspicious activity will be detected.
What to review:
- Verify that Microsoft Purview auditing is available and operating as expected.
- Understand the audit log retention period included in the organisation’s licence.
- Review Microsoft Entra sign-in logs for unusual sign-in activity.
- Investigate unexpected mailbox forwarding rules and suspicious inbox rule changes.
- Monitor changes to administrator roles, permissions, and security settings.
- Establish a process for investigating alerts and escalating potential incidents.
For example, an unexpected mailbox forwarding rule may indicate an attacker is attempting to collect business emails. It should be investigated rather than dismissed as an ordinary configuration change.
Log retention and advanced investigation capabilities vary by licence. Businesses should confirm that their retention periods meet operational, regulatory, and investigation requirements.
For more information, see Microsoft’s overview of auditing solutions in Microsoft Purview.
6. Use Intune to Manage and Protect Business Devices
Microsoft 365 security does not stop at user accounts. A compromised or poorly managed laptop can also expose company information.
Microsoft Intune can help organisations manage devices, deploy security policies, and assess whether devices meet defined compliance requirements.
What to review:
- Enforce appropriate device security policies for supported Windows, macOS, iOS, and Android devices.
- Use Microsoft Intune to deploy and monitor settings such as BitLocker encryption on supported Windows devices.
- Establish update and patch management policies.
- Define device compliance requirements based on business risk.
- Where licensing and configuration support it, use Conditional Access to restrict access to company resources from devices that do not meet the required compliance conditions.
- Review devices that have not checked in recently or are no longer managed.
For example, a business might require company laptops to have encryption enabled and meet defined security requirements before allowing access to selected corporate resources. This requires the relevant device compliance and access policies to be configured together; deploying Intune alone does not automatically enforce every access restriction.
In my own IT management work, Intune is part of the broader process of maintaining consistent laptop configurations and applying security policies. The exact approach depends on the device environment, existing management tools, and available licences.
You can read more in my article, Microsoft Intune: How I Manage Company Laptops and Devices.
7. Establish a Microsoft 365 Backup and Recovery Strategy
A common misconception is that storing files and emails in the cloud removes the need for a backup strategy.
Microsoft provides service resilience and built-in recovery capabilities, but businesses still need to understand what those features cover and whether they meet their recovery requirements.
Accidental deletion, malicious activity, compromised accounts, and retention gaps can all create data recovery challenges.
What to review:
- Understand the native recovery and retention capabilities available for Exchange Online, SharePoint, and OneDrive.
- Decide whether a separate backup solution is needed to meet business recovery requirements.
- Review backup scope, retention periods, access controls, and recovery objectives.
- Protect backup administration with strong authentication and restricted permissions.
- Test restoration regularly rather than assuming backups will work when needed.
Businesses may consider solutions such as Microsoft 365 Backup, Veeam Backup for Microsoft 365, or Veeam Data Cloud, depending on their requirements and licensing. These products and services have different capabilities, so compare their coverage, retention options, recovery features, and costs before making a decision.
In my environment, we use Veeam Data Cloud for Microsoft 365 backup. Having a backup solution is only part of the process; understanding how to restore the right data within an acceptable timeframe is equally important.
For a more detailed explanation, see my article, Microsoft 365 Backup: Why Every Business Needs a Recovery Plan.
Conclusion
Securing Microsoft 365 is an ongoing responsibility, not a one-time configuration task.
The seven areas in this guide provide a practical starting point: strengthen authentication, limit administrator privileges, control external sharing, improve email protection, review audit logs, manage devices, and establish a reliable backup and recovery strategy.
Not every organisation will need the same configuration. The right approach depends on the business’s risk profile, regulatory obligations, existing IT environment, and Microsoft licensing.
My recommendation is to review these areas systematically, prioritise the most significant risks, test changes before enforcing them broadly, and document the resulting policies.
Good Microsoft 365 security is not just about enabling features. It is about making sure the controls are appropriate, monitored, and effective when the business needs them.
Leave a Reply