Microsoft 365 is now the heart of most businesses: email, files, Teams and identity all live in one tenant. That makes it a prime target. The good news is that a handful of settings block the vast majority of attacks.
1. Enforce multi-factor authentication for everyone
Stolen passwords are the most common way into a tenant. Turn on MFA for every user, starting with administrators, and prefer the Microsoft Authenticator app over SMS.
2. Use Conditional Access
Conditional Access policies let you block legacy authentication, require compliant devices for sensitive data and restrict sign-ins from unexpected countries.
3. Limit and protect admin roles
Keep the number of Global Administrators to two to four. Give people the narrowest role they need, and use separate admin accounts that are never used for email.
4. Harden email
Configure SPF, DKIM and DMARC for your domains, enable Microsoft Defender for Office 365 safe links and attachments, and turn off automatic forwarding to external addresses.
5. Protect data
Use sensitivity labels and data loss prevention for confidential information, and review external sharing settings in SharePoint and OneDrive.
6. Back up Microsoft 365
Microsoft keeps your service running, but recovering deleted or encrypted data is your responsibility. An independent Microsoft 365 backup protects mailboxes, SharePoint and OneDrive.
Need help applying a baseline? Our Microsoft 365 and Azure support team can review your tenant and implement these controls with minimal disruption.