Microsoft 365 Security Hardening

Account takeover almost always starts with a stolen password, and MFA stops the great majority of it. Enforce MFA for all users, not just administrators, using Conditional Access if you have it or Security Defaults if you do not. Prefer an authenticator app or a hardware key over text messages, which can be intercepted.

Older protocols such as IMAP, POP and basic authentication cannot enforce MFA, so attackers target them directly. Check the sign in logs to see what still relies on legacy authentication, move those apps onto modern authentication, then block the legacy protocols. This single change closes a door that a lot of attacks walk straight through.

Microsoft Defender for Office 365 lets you raise the default protection. Switch on mailbox intelligence, impersonation protection for your senior people and your own domains, and safe links and safe attachments if your licence includes them. Set the policies to quarantine rather than deliver anything judged to be phishing.

Count your Global Administrators and reduce the number to the few who genuinely need it, giving everyone else the least privileged role that fits their work. Review external sharing settings in SharePoint and OneDrive so files are not shared more widely than intended, and turn off automatic forwarding of email to outside addresses.

You cannot investigate what you did not record. Confirm the unified audit log is on so sign ins, file access and admin changes are captured. Set alerts for the events that matter, such as a new mailbox forwarding rule or a change to MFA settings, and decide how long you need to keep the logs.

Microsoft Secure Score turns all of this into a single figure with prioritised actions and an estimate of the effort each one takes. Use it to plan the next round of improvements, then put a recurring date in the diary to review it, because tenants drift as staff and apps change.