- Blocking legacy authentication eliminates the attack vector used in a majority of credential-based M365 compromises, and requires no additional licensing
- MFA enforced via Conditional Access is more reliable than per-user MFA settings, which can be bypassed by legacy clients
- Admin accounts used for email expand the blast radius of a phishing attack. Dedicated admin accounts with no mailbox cost nothing to create.
- External sharing in SharePoint and Teams defaults to permissive settings that most organisations never review
- Microsoft Secure Score gives you a baseline measurement and a prioritised remediation list. Organisations that have never opened it typically score below 45%.
Why defaults are the problem
Microsoft's priority is getting your users productive as fast as possible. The out-of-box M365 configuration reflects that: legacy authentication protocols are on, every user can create Teams and SharePoint sites, external guests can reach shared content with minimal friction, and admin roles have no just-in-time access controls.
For a five-person startup sharing documents, those defaults are fine. For any organisation handling sensitive data, operating under regulatory obligations, or carrying cyber insurance with security controls warranties, they represent material exposure.
Incident response teams investigating M365 compromises find the same misconfigurations regardless of the organisation's size, sector, or geography. The controls below address the most common attack paths, in the order that matters.
MFA: the obvious one that many miss
Most IT managers have enabled MFA. Fewer have enforced it in a way that cannot be bypassed.
Per-user MFA settings, configured through the legacy MFA portal, are circumvented by clients using legacy authentication protocols (SMTP, IMAP, POP3, and older Exchange ActiveSync). An attacker with a stolen password authenticates through a legacy protocol and receives tokens that skip the MFA challenge entirely. Turning on per-user MFA without blocking legacy authentication gives you the appearance of protection, not the protection itself.
FIDO2 hardware keys and the Microsoft Authenticator app (with number matching) give the strongest phishing resistance in M365. SMS one-time codes are vulnerable to SIM-swap attacks and should be removed as an MFA option where your user base allows it. Phone call authentication offers a similar level of weakness. Move users to app-based or hardware methods before removing the weaker fallbacks.
Conditional Access: what MFA alone cannot do
Conditional Access policies in Entra ID (formerly Azure AD) evaluate authentication requests against conditions including device compliance, location, user risk score, and application, then enforce controls or block access. They are the enforcement layer that makes MFA a firm requirement rather than a configuration that users and legacy clients can route around.
The minimum Conditional Access baseline for most organisations covers:
- Require MFA for all users. This replaces per-user MFA settings with a policy that applies regardless of client or protocol, provided legacy authentication is also blocked.
- Block legacy authentication. A separate policy that blocks all sign-in attempts using protocols that do not support modern authentication. This is the single highest-impact security change in most M365 tenants and costs nothing to implement.
- Require compliant or hybrid-joined device for access to corporate data. Ensures that only managed, patched devices can access M365 services. Requires Intune or a compatible MDM solution.
- Block or challenge risky sign-ins. Uses Microsoft's sign-in risk scoring to require step-up authentication or block access from compromised credential attempts, unfamiliar locations, or anomalous sign-in patterns.
Conditional Access requires Entra ID P1 as a minimum, included in Microsoft 365 Business Premium and the E3/E5 plans. If your organisation runs Business Basic or Standard, Security Defaults gives you a limited but useful starting point. It lacks the policy granularity you need for a full hardening baseline, but it is better than nothing while you plan a licence upgrade.
Admin account hygiene
Global Administrator is the highest-privilege role in an M365 tenant. Holders can reset passwords, add users, configure security settings, access all data, and modify billing. A compromised Global Admin account gives an attacker complete control of the tenant.
The most common finding in M365 audits is that the people who hold Global Admin roles also use those accounts as their primary email address. One phishing email in that inbox is one click from full tenant compromise.
Dedicated admin accounts
Admin roles should go to dedicated accounts with no mailbox and no M365 apps licence. Your administrators use these accounts only when carrying out admin tasks, never for web browsing, email, or productivity work. Unlicensed accounts can hold admin roles in M365, so the cost is zero.
Privileged Identity Management
PIM, available with Entra ID P2 (included in E5), gives you just-in-time privileged access. Administrators request elevation to Global Admin when they need it, with a time-limited approval and a full audit trail. Outside an active elevation window, their accounts hold no privileged roles. An attacker who compromises one of those accounts gains nothing that requires elevated permissions.
Break-glass accounts
Every tenant should have two cloud-only accounts excluded from all Conditional Access policies, secured with FIDO2 hardware keys, and used for nothing routine. Your team reaches for them only if a Conditional Access or MFA misconfiguration locks out legitimate administrators. Configure an alert that fires the moment either account signs in.
Blocking legacy authentication
Legacy authentication covers SMTP AUTH, POP3, IMAP, and older Exchange ActiveSync clients. None of these protocols support modern authentication challenges, so none can prompt for MFA. Attackers with stolen credentials use them to bypass your MFA policies and collect access tokens.
Microsoft's telemetry shows that the majority of password spray attacks against M365 tenants target legacy authentication endpoints. Most organisations have far fewer legitimate users of these protocols than they assume. Filtering your sign-in logs for legacy authentication clients usually turns up a handful of devices, typically older printers or shared scanners set up for SMTP relay, that you can reconfigure or replace without disrupting anyone.
Run the Conditional Access block in report-only mode first, identify and reconfigure those legacy clients, then enforce. The change itself is straightforward. The gap between knowing about it and closing it is where most organisations stay too long.
Email security: Defender for Office 365
Base M365 plans include Exchange Online Protection (EOP), which handles spam and malware filtering. Defender for Office 365 Plan 1, included in Business Premium and available as an add-on with E3, adds controls that close the gap on phishing techniques EOP does not catch.
- Safe Links rewrites URLs in emails and Teams messages and checks them at click time, not delivery time. Phishing campaigns frequently send clean URLs that redirect to malicious content after delivery, specifically to pass pre-delivery scanning.
- Safe Attachments detonates email attachments in a sandbox before delivery and blocks files that show malicious behaviour. This catches weaponised documents that signature-based detection misses.
- Anti-phishing policies add impersonation protection for named users (CEO, CFO) and domains, and use mailbox intelligence to flag unusual email behaviour.
External sharing defaults
SharePoint and OneDrive default to an "Anyone" sharing level, meaning your users can create links that give file access to anyone with the URL, with no sign-in required. In some configurations, Microsoft Teams allows external users from any Microsoft tenant to join meetings without passing through a lobby.
Most organisations that have never reviewed these settings are sharing more data externally than they intend to. The right settings depend on your business requirements, but the minimum review should move SharePoint and OneDrive to "New and existing guests" rather than "Anyone", require guest accounts to re-authenticate after a defined period, and enable SharePoint access reviews in Entra ID Governance.
Unified Audit Log
The Unified Audit Log records user and admin activity across M365 services and is the primary forensic data source in any M365 incident investigation. Without it, you cannot reconstruct what an attacker did after compromising an account.
Enable and verify audit logging in the Microsoft Purview compliance portal. The default retention period is 90 days at most licence tiers, with longer retention available at higher licence levels or through export to a SIEM. Set alerts on high-risk events: admin role changes, mailbox forwarding rule creation, bulk file downloads, and Conditional Access policy modifications.
Microsoft Secure Score as a baseline
Microsoft Secure Score, available in the Microsoft Defender portal, calculates a percentage score from your M365 tenant's security configuration and assigns points for each implemented control. It pairs that score with a prioritised list of recommended actions, each showing the impact it would have on your score.
Organisations that have never opened Secure Score typically land between 30% and 50%. The controls in this article account for a significant share of the available points at Business and E3 licence levels. Run a quarterly Secure Score review to track progress and keep the improvement work structured rather than reactive.
If your organisation uses Microsoft Copilot for M365, the default configuration creates data access and governance risks worth reviewing separately. Our guide on Microsoft Copilot governance and data exposure covers those specific gaps.
Hardening M365 is one component of a broader security programme. Organisations that rely entirely on the Microsoft stack should also review their Microsoft dependency risks. For a prioritised sequence of controls beyond the Microsoft platform, a cybersecurity roadmap addresses identity, endpoint, network, and incident response readiness as an integrated workstream.