EN / DEContact

KNOWLEDGE / IDENTITY, ACTIVE DIRECTORY AND ACCESS

Securing Microsoft 365: the most important settings

Microsoft 365 is far from optimally secured after setup. A few basic settings close the most common gaps.

By INZOSO Resilience · Updated · 1 min read

The basic measures

  • MFA for all accounts, administrators first. Conditional access allows fine control.
  • Disable legacy authentication, as it bypasses MFA.
  • Few administrators, separate admin accounts and emergency accounts.
  • Limit external sharing: control guest access in Teams and SharePoint deliberately.
  • Email protection: anti-phishing policies, SPF, DKIM, DMARC.
  • Device policies: only managed or compliant devices get access.
  • Enable and review logs and alerts.
  • Backup: back up Microsoft 365 data separately if needed, as responsibility is set out in the contract.

Mind the licences

Some functions, such as conditional access or advanced protection, depend on the licence tier. Check which functions your plan includes before planning. For small environments the security defaults offer a solid start.

Check instead of assume

A configuration review shows where your tenant deviates from recommendations. That is cheaper than the consequences of a taken-over mailbox.

secure Microsoft 365M365 securityconditional accessExchange Online protection

Frequently asked questions

How do you secure Microsoft 365?

With MFA for all accounts, legacy authentication disabled, few administrators, email protection, device policies and logging.

What is legacy authentication?

Older sign-in methods without MFA support that attackers can use to bypass multi-factor sign-in.

Is Microsoft 365 secure after setup?

Not automatically. Default settings are a start; a review and hardening of the configuration is advisable.

KEEP READING

IDENTITY, ACTIVE DIRECTORY AND ACCESS

What does an Active Directory audit cost?

There is no fixed number because the effort depends on the size and history of your environment. If you know the cost drivers, though, you can compare quotes well and control the scope.

Read article → IDENTITY, ACTIVE DIRECTORY AND ACCESS

Active Directory or Entra ID: which fits you?

Classic Active Directory and Microsoft Entra ID solve related but not identical tasks. This comparison helps decide between on-premises, cloud and hybrid.

Read article → IDENTITY, ACTIVE DIRECTORY AND ACCESS

Securing Active Directory: the key steps

Active Directory is the heart of many networks and a prime target for attackers. A few targeted steps reduce the risk substantially.

Read article →
RELATED SERVICE

Identity

Understanding identities and access as the foundation of a connected digital world.

MiTECHNOLOGIES IN THIS ARTICLE

Microsoft

Platform of operating system, server and cloud services.

EnTECHNOLOGIES IN THIS ARTICLE

Entra

Cloud identity service for sign-in and conditional access.

Next step

Have a specific question?

Send us a short description of your situation. We will assess it and tell you openly whether and how we can help.

Request a conversation