A Microsoft 365 security baseline for mid-market organizations
Most organizations pay for Microsoft 365 security features they have never turned on. This baseline covers the changes that close the most common gaps.
Microsoft 365 is the most common platform in the organizations we work with, and the most common source of incidents: compromised mailboxes, over-shared files, forgotten guest accounts, and legacy protocols that quietly bypass MFA. Almost all of it is preventable with features included in common license tiers.
This baseline is the set of configurations we check first in a Microsoft 365 security audit. It is not exhaustive, and some items depend on licensing. It is the list that closes the most exposure for the least effort.
Identity and access
Enforce multi-factor authentication for every account. No exceptions for executives, shared mailboxes with sign-in enabled, or service accounts. Use Conditional Access policies rather than per-user MFA settings so the requirement is consistent and auditable.
Block legacy authentication. Protocols like basic SMTP, POP, IMAP, and older Office clients can authenticate with a password alone, bypassing MFA entirely. Block them with Conditional Access and confirm nothing breaks. Something old usually does; fix it rather than re-enabling the protocol.
Move high-risk roles to phishing-resistant MFA. Finance, executives, and administrators should use FIDO2 security keys, passkeys, or Windows Hello for Business. Push-based MFA can be relayed or fatigued.
Separate administrative accounts. Global Administrators and other privileged roles should use dedicated accounts that are not used for email or everyday work, protected by the strongest MFA available. Keep the number of Global Administrators small and review it quarterly.
Review guest and external access. Guests accumulate. Inventory them, remove the ones no longer needed, and set an expiration policy for new ones.
Turn on the security defaults you have not used. Sign-in risk and user risk policies (where licensed), self-service password reset with registration enforcement, and a banned password list.
Publish SPF, DKIM, and DMARC, and move DMARC to enforcement. SPF and DKIM are usually present. DMARC at p=none is monitoring only; move to p=quarantine and then p=reject once reports show legitimate mail is aligned. This stops attackers from sending mail as your domain.
Configure anti-phishing and impersonation protection. Protect your executives’ display names and your key vendors’ domains from impersonation. Enable mailbox intelligence where available.
Enable Safe Links and Safe Attachments (or your email security platform’s equivalent) so malicious URLs and files are detonated before users reach them.
Alert on inbox rules and forwarding. Block automatic external forwarding at the tenant level. Alert on new inbox rules that forward, delete, or move messages, because that is the first thing an attacker does in a compromised mailbox.
Audit shared mailboxes. Disable sign-in for shared mailboxes, and review who has delegated access.
Data and sharing
Set sharing defaults deliberately. “Anyone with the link” sharing should be off by default, or restricted to specific sites with a business reason. Default new links to internal, specific people.
Review external sharing by site. Some SharePoint sites exist to share with outsiders. Most do not. Configure them differently.
Apply sensitivity labels and retention where it matters. Start with the content that would hurt most if it leaked: contracts, financials, personal data, client files. Full-scale labeling can come later.
Inventory third-party app permissions. Users grant applications access to their mail and files without understanding what they are approving. Review consented applications, restrict user consent to verified publishers or low-risk permissions, and require administrator approval for the rest.
Monitoring and logging
Confirm unified audit logging is on and that retention meets your requirements. Investigations are impossible without it.
Route alerts somewhere a person will see them. Microsoft’s alerts are useful only if someone receives and acts on them. For organizations without a security team, this is where a managed program with 24/7 monitoring fits.
Review Secure Score monthly. It is not a perfect measure, but it is a prioritized list of recommendations tuned to your licensing, and the trend tells you whether configuration is drifting.
Backup
Microsoft 365 is not a backup. Retention policies and the recycle bin protect against some mistakes, not against ransomware that encrypts synced files, a malicious insider, or a deletion that outlives the retention window. A separate backup of Exchange, SharePoint, OneDrive, and Teams, stored outside the tenant, is a standard control. Sidechain’s Data Vault for Microsoft 365 is one option.
Where to start
If you do nothing else: enforce MFA through Conditional Access, block legacy authentication, and block external auto-forwarding. Those three changes stop the majority of mailbox compromises we investigate.
A Microsoft 365 security audit covers all of the above plus threat protection, governance, and licensing, with prioritized recommendations and a debrief with your team. It is scoped as a standalone engagement, and remediation can follow. Details are on the assessments page.
