10 Best Practices to Secure Microsoft 365 (Office 365) –
The 10 best practices
1. Enforce MFA for every user, phishing-resistant for admins
Why: MFA blocks the vast majority of password-based account takeovers.
How:
- Turn on Security defaults (small tenants, no Entra ID P1) or a Conditional Access policy requiring MFA for all users and all cloud apps.
- Use Microsoft Authenticator with number matching; avoid SMS and voice where possible.
- Require phishing-resistant methods (FIDO2 security keys, passkeys, Windows Hello for Business) for admin roles via Authentication strengths.
2. Block legacy authentication
Why: Legacy protocols (POP, IMAP, basic SMTP AUTH, older Office clients) can’t do MFA, so attackers use them for password spraying.
How:
- Create a Conditional Access policy that blocks the Exchange ActiveSync clients and Other clients client-app conditions.
- Disable SMTP AUTH tenant-wide in Exchange Online and enable it only for specific mailboxes that truly need it (e.g. a scanner or app).
- Check Entra sign-in logs (filter by client app) for remaining legacy usage before enforcing.
3. Lock down privileged accounts
Why: One compromised Global Admin means a compromised tenant.
How:
- Keep Global Admins to between 2 and 4; assign least-privilege roles (Exchange Admin, User Admin, Helpdesk Admin) instead.
- Use separate, cloud-only admin accounts with no mailbox, not admins’ daily user accounts.
- Use Privileged Identity Management for just-in-time, time-limited role activation with approval. License: Entra ID P2.
- Create two emergency (break-glass) accounts with long random passwords or FIDO2 keys, excluded from Conditional Access, stored securely, and alerted on any sign-in.
4. Use Conditional Access with device and risk signals
Why: A correct password and MFA prompt isn’t enough if the device or sign-in looks wrong.
How:
- Require compliant (Intune) or hybrid-joined devices for access to company data, or limit unmanaged devices to browser-only access.
- Block or require re-authentication for medium/high sign-in and user risk. License: Entra ID P2.
- Block countries you never operate in with named locations.
- Roll out every new policy in Report-only first, then enforce.
5. Harden email against phishing, malware and spoofing
Why: Email is the top initial-access vector into Microsoft 365.
How:
- Apply the Standard or Strict preset security policies in Microsoft Defender (EOP and Defender for Office 365). License: Defender for Office 365 Plan 1+ for Safe Links and Safe Attachments.
- Enable impersonation protection for executives and your own domains.
- Publish SPF, enable DKIM signing, and move DMARC from
p=nonetop=quarantinethenp=reject. - Block automatic forwarding to external domains in the outbound spam policy.
6. Control third-party app consent
Why: Consent phishing tricks users into granting a malicious app access to mail and files, bypassing MFA.
How:
- In Entra ID > Enterprise apps > Consent and permissions, allow user consent only for verified publishers with low-impact permissions, or disable it.
- Turn on the admin consent workflow so users can request apps.
- Review existing enterprise apps and OAuth grants quarterly and remove unused or over-privileged ones.
7. Protect data and tighten external sharing
Why: Oversharing in SharePoint, OneDrive and Teams is a common cause of data leaks, and is amplified by AI tools such as Copilot that surface whatever users can access.
How:
- Set SharePoint/OneDrive external sharing to New and existing guests or stricter; disable Anyone links or give them an expiry.
- Make Specific people the default sharing-link type.
- Deploy Microsoft Purview sensitivity labels and Data Loss Prevention policies for sensitive data (financial, health, PII). License: varies by feature; E3 vs E5.
- Review guest accounts regularly with access reviews.
8. Turn on auditing, logging and alerts
Why: You can’t investigate what you didn’t log.
How:
- Confirm unified audit logging is on in Microsoft Purview and mailbox auditing is enabled.
- Set audit retention to match your incident-response and compliance needs (longer retention needs higher licenses).
- Enable alert policies for events such as new inbox forwarding rules, mass file deletion and admin role changes.
- Forward logs to a SIEM (e.g. Microsoft Sentinel) if you have one.
9. Track posture with Microsoft Secure Score and Defender XDR
Why: Secure Score gives a measurable, prioritized list of what’s still misconfigured.
How:
- Review Secure Score in the Microsoft Defender portal monthly and assign owners to open recommendations.
- Triage incidents in Defender XDR rather than individual alerts.
- Compare your settings against an external baseline such as the CIS Microsoft 365 Foundations Benchmark or CISA SCuBA.
10. Train users and make reporting easy
Why: Users are the last line of defense against phishing that gets through filters.
How:
- Run regular phishing simulations with Attack simulation training. License: Defender for Office 365 Plan 2 / E5.
- Deploy the built-in Report button in Outlook and route reports to your security team.
- Enable self-service password reset with MFA and Entra Password Protection to block weak or banned passwords.
Rollout checklist
Do the first week’s items before anything else; they stop the most common attacks.
Week 1: stop account takeover
- Create two break-glass accounts and an alert on their sign-ins
- Enforce MFA for all users (Security defaults or Conditional Access)
- Block legacy authentication and disable SMTP AUTH
- Reduce Global Admins to 2–4 and move admins to separate accounts
Month 1: harden email and apps
- Apply Defender preset security policies (Standard or Strict)
- Configure SPF, DKIM and DMARC; block external auto-forwarding
- Restrict user app consent and enable the admin consent workflow
- Confirm audit logging and key alert policies are on
Quarter 1: mature the posture
- Require phishing-resistant MFA for admins; enable PIM if licensed
- Add device-compliance and risk-based Conditional Access
- Tighten external sharing; deploy sensitivity labels and DLP
- Launch phishing simulations and the Outlook Report button
- Baseline Secure Score and set a target
Review cadence and references
Revisit this article and your tenant settings at least quarterly, and after any major Microsoft 365 licensing or feature change.
- Monthly: Secure Score, risky sign-ins, new admin role assignments, break-glass sign-in alerts.
- Quarterly: Conditional Access exclusions, enterprise apps and OAuth grants, guest accounts, external sharing reports.
- Annually: full review against the CIS Microsoft 365 Foundations Benchmark or CISA SCuBA baselines; re-test incident response.
Microsoft renames portals and menus often (for example Azure AD is now Microsoft Entra ID), so verify exact menu paths in Microsoft Learn before following steps.