Securing Microsoft 365: 10 settings that are often missing

Is Microsoft 365 secure out of the box? The short answer

Not entirely. Microsoft runs the data centres and protects the platform, but how secure your tenant is depends on your own settings. Many companies still work with the configuration from their initial setup years ago, and that is exactly where important protections are often missing.

The ten settings below close the most common gaps, from sign-in to email, file sharing and backup. Most are available in every business plan. As Microsoft regularly renames its menus, we describe what to configure rather than where to click.

Protect sign-ins and accounts (settings 1 to 4)

1. MFA for every user, without exception

Without a second factor, a stolen password is enough to take over a mailbox. Enable MFA for every account, not only for management or IT. An authenticator app is a good standard; administrators should use phishing-resistant methods such as FIDO2 security keys or passkeys. Our guide to introducing MFA explains how to plan the rollout.

2. Block legacy authentication

With legacy or basic authentication, apps and devices send only a username and password, so MFA never applies. Microsoft has already switched it off for most Exchange Online protocols and has announced its end for SMTP sending, which many multifunction printers and older applications use, although that timeline has changed several times. Block legacy sign-ins through security defaults or conditional access, and move devices and applications to modern authentication now.

3. Separate admin accounts with least privilege

If one account both reads email and manages the tenant, every phishing email puts the whole company at risk. Administrators therefore get a separate, cloud-only account without a mailbox, used only for admin tasks. Only a few people should be Global Administrators, and Microsoft recommends fewer than five. Limited roles such as User, Helpdesk or Exchange Administrator cover everyday work.

4. Use conditional access where your licence allows it

With conditional access, sign-in rules take context such as device, location and application into account. Typical policies require MFA for everyone, allow access to sensitive data only from managed devices and block sign-ins from countries where you do no business. The feature requires Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium and E3, for example. Without it, the free security defaults provide solid baseline protection.

Protect email and files (settings 5 to 7)

5. Anti-phishing policies and Defender for Office 365

Every tenant with Exchange Online includes Exchange Online Protection, a baseline filter against spam, malware and spoofed senders. Microsoft Defender for Office 365 adds link checks at the moment of clicking, sandboxing of attachments and impersonation protection, for example against someone posing as the managing director. Plan 1 is included in Business Premium. The easiest approach is to enable the preset security policies at the Standard or Strict level.

Protect your own domain with SPF, DKIM and DMARC as well, so that nobody can send convincing emails in your name. And since no filter catches everything, staff who know the warning signs of phishing remain important.

6. Block automatic forwarding to external addresses

After taking over a mailbox, attackers often create a rule that silently forwards all email to an external address or hides certain messages. This lets them follow invoices and payments even after the password has been changed. Make sure automatic external forwarding is explicitly switched off in the outbound spam policy, with exceptions only for individual, documented mailboxes. Check existing forwarding and inbox rules as well.

7. Limit external sharing in SharePoint and OneDrive

In many tenants, users can share files by link with anyone, without the recipient having to sign in. Such links can be passed on and remain valid indefinitely unless an expiry date is set. Where possible, allow external sharing only with guests who have to sign in, make specific people the default link type and enforce an expiry date for anonymous links if you allow them at all.

Monitor and assess (settings 8 and 9)

8. Enable audit logging and alerts

Without logs, it is hard to establish after an incident who accessed which data and when. Check that the unified audit log and mailbox auditing are switched on: both are enabled by default in many tenants, but not in all. The standard audit tier currently keeps entries for 180 days; longer periods require a higher licence or exporting the logs.

Alerts matter just as much, for example for new forwarding rules, newly assigned admin roles or unusual sign-ins. Set the recipients explicitly, especially if your admin accounts have no mailbox, and decide who acts on them. If you cannot cover this internally, a managed security service can take over the monitoring.

9. Use Secure Score as orientation

Microsoft Secure Score rates your tenant's configuration and lists recommended actions by their impact. It is a good starting point for finding gaps and showing progress. The score is no goal in itself: some recommendations require licences you do not have, and others do not fit the way you work. Document why you implement a recommendation or deliberately do not.

Back up your data independently (setting 10)

Under the shared responsibility model, Microsoft keeps the service available, while your data remains your responsibility. The recycle bin, version history and retention policies help recover individual items but are not a complete backup: they reach back only a limited time or mainly serve compliance, and a full restore after mass deletion or ransomware is difficult with them.

Back up Exchange, OneDrive and SharePoint (which also hold Teams files) with a separate backup service whose access is protected separately from your normal admin accounts. Test regularly that a mailbox or a library can actually be restored. Our article on the 3-2-1 rule and immutable backups shows what a robust backup strategy looks like.

The 10 settings at a glance

Conclusion: set it up properly, then review regularly

None of these settings is complicated, but together they close gaps that attackers frequently exploit in Microsoft 365. Review them regularly, because new users, licences and features keep changing the tenant. For a review of your environment, Q-entra supports you with the setup as part of cyber security and, if you wish, with ongoing care through managed security.