The 5 Microsoft 365 Security Settings Most Companies Miss

Microsoft 365 is powerful, but it is not secure out of the box. The default configuration prioritizes usability over security, leaving many organizations with an attack surface they are unaware of. Here are the five settings we most often find missing when we review a new customer's environment.

The Core Security Layers

1. MFA for All Users: No Exceptions

Multifactor authentication is the single measure that prevents the most compromises. According to Microsoft's own figures, MFA blocks over 99.9% of automated account attacks. Yet we regularly see M365 environments where MFA is only enabled for administrative accounts, or not enabled at all.

Enable MFA for all users via Microsoft Entra ID (formerly Azure AD) under Security Defaults or via Conditional Access policies. SMS-based MFA is better than nothing, but an authenticator app with push notifications is clearly preferable. FIDO2 keys are the gold standard for administrative accounts.

2. Block Legacy Authentication

Legacy authentication protocols such as IMAP, POP3, and older SMTP connections do not support modern MFA. An attacker using these protocols can bypass your MFA completely, even if it is enabled. This is not a theoretical risk; it is an active attack method.

Block legacy authentication via a Conditional Access policy that denies access from clients using these older protocols. First check your sign-in log in Entra ID to see if any users or systems are still using them: typically it is older printers, scanners, or local mail clients that need upgrading or reconfiguring.

Access Control and Privileges

3. Conditional Access Policies

Conditional Access is M365's engine for intelligent access control. Instead of allowing everyone to log in from anywhere at any time, you can define conditions: require MFA from unknown locations, block login from countries your organization never operates in, require the device to be managed and compliant, or require additional verification when accessing sensitive applications.

A simple starter policy is to require MFA from all untrusted locations and block login from geographies that are irrelevant to your business. These policies are found under Entra ID → Protection → Conditional Access and require at minimum a Microsoft Entra ID P1 license, which is included in Business Premium.

4. Dedicated Administrative Accounts

It is common practice to use your regular work account (the one you use for Teams meetings and email) to manage the M365 tenant. This is a security risk. If that account is compromised via phishing or malware, the attacker immediately gains global admin access to the entire tenant.

Instead, create dedicated administrative accounts without an Exchange mailbox that are used exclusively for administrative tasks. These accounts must have MFA and strong passwords, and ideally should only be used from trusted, hardened devices. A daily work account and an admin account should never be the same.

Visibility and Auditability

5. Unified Audit Log Enabled

Microsoft 365 can log almost everything: who logged in when, who shared which files, who deleted emails, when a mail rule was created. But this logging is not always enabled by default, and without it you are blind if an incident occurs.

The Unified Audit Log is enabled in Microsoft Purview Compliance Portal → Audit. Verify that it is turned on and that the retention period is set to at least 90 days, preferably 180 days or more, as many attacks are discovered long after the actual breach. The audit log is your primary investigation tool and source of documentation in the event of a security breach.

These five settings are not complex to implement, and most can be set up in an afternoon. Yet we consistently see them missing, even in organizations that otherwise invest in IT. Review them today, and your M365 tenant will be significantly better protected than it was this morning.