Establish a tenant security baseline
Microsoft 365 concentrates email, files, collaboration and identity in one environment, so small configuration decisions can have broad consequences. Start with a documented baseline: verified domains, supported clients, administrator roles, authentication methods, external-sharing rules, audit settings and the licences on which controls depend. Record approved exceptions with owners and expiry dates instead of allowing one-off workarounds to become permanent.
Use Microsoft’s current documentation and service health information when planning changes. Features, defaults and licence requirements change. Test policies with a controlled group before broad enforcement, especially where older applications, shared devices or non-human accounts may rely on legacy behaviour.
Strengthen identity and administration
Require multi-factor authentication for users and give administrators stronger, separate accounts that are not used for ordinary email or browsing. Reduce the number of Global Administrators, prefer the least-privileged role that fits the task and review assignments regularly. Emergency access accounts should be tightly controlled, monitored and tested according to an agreed procedure.
Conditional Access can combine signals such as user, device, location, application and risk, but complexity needs discipline. Begin with clear outcomes and report-only testing where available. Block legacy authentication when dependencies have been resolved because older protocols may not support modern authentication protections. Review app consent and service principals as carefully as human accounts; an over-permissioned application can create durable access.
Protect mail flow and trusted domains
Configure SPF and DKIM for legitimate sending services, then introduce DMARC with monitoring before moving towards enforcement. Inventory every platform permitted to send as the organisation; forgotten marketing or line-of-business systems commonly complicate rollout. Mail authentication helps receiving systems evaluate domain use, but it does not make a message trustworthy merely because it passes.
Combine domain controls with anti-phishing policies, safe handling of links and attachments, controls for automatic external forwarding and monitoring for suspicious inbox rules. High-risk financial and identity changes should require verification through a known independent channel. This business process remains important even when technical filtering is strong.
Control sharing, devices and information
Review SharePoint, OneDrive and Teams sharing defaults, anonymous links, guest access and dormant external users. Apply more restrictive settings to sites containing sensitive material and give content owners a simple review process. Information protection should be based on actual sensitivity and handling needs; an elaborate labelling system that nobody understands will not produce reliable behaviour.
Decide what device state is required for important applications. Managed, encrypted and supported devices provide stronger assurance than browser access from unknown endpoints. Where unmanaged access is necessary, limit download or session behaviour according to business risk. Keep user experience in the design: controls that block legitimate work without a clear route to resolution invite unsafe workarounds.
Prepare to investigate and recover
Enable appropriate audit capabilities, define retention that fits legal and operational needs and ensure someone is responsible for review and escalation. Useful signals include unusual sign-ins, changes to privileged roles, new forwarding rules, risky app consent, mailbox access and security-policy changes. An alert has little value unless it reaches a person who understands the environment and can act.
Practise account containment and recovery before an incident. Teams should know how to revoke sessions, reset credentials, investigate inbox rules and delegated access, review application permissions and restore administrative control. Preserve relevant evidence and coordinate regulatory or legal decisions with qualified advisers. The final step is to correct the control weakness that allowed the incident, not simply unlock the user.
What to do next.
- ✓Use separate protected accounts for administration.
- ✓Enforce modern multi-factor authentication and retire legacy authentication.
- ✓Review privileged roles, app consent and emergency access.
- ✓Deploy SPF, DKIM and DMARC through a monitored rollout.
- ✓Review external sharing, forwarding and anonymous links.
- ✓Test logging, containment and administrator recovery procedures.
Use guidance responsibly
Technology, provider behaviour and legal requirements change. Validate implementation details against current official documentation, test changes safely and obtain qualified legal advice where required.