How well defendedis your Microsoft 365?

Through Conditional Access or security defaults, rather than left to each person to set up.

Enforce it with Conditional Access, or security defaults if you don't have Entra ID P1, and remove every exclusion except your emergency access accounts.

Older sign-in methods can't do multi-factor authentication, so attackers use them to get round it.

Block legacy authentication with Conditional Access, and move printers, scanners and scripts that still use basic SMTP authentication to a modern method.

Codes and push approvals can be phished; passkeys and FIDO2 keys can't.

Require phishing-resistant authentication for admin roles with a Conditional Access authentication strength policy.

Microsoft recommends fewer than five Global Administrators, and admin accounts without mailboxes.

Give each admin a separate cloud-only account without a mailbox, reduce Global Administrators to between two and four, and use the least privileged role for each task.

So a Conditional Access mistake or an outage can't lock every admin out.

Create two cloud-only emergency access accounts protected with FIDO2 keys, store the details securely, and alert on any sign-in.

Privileged Identity Management needs Entra ID P2 or Entra ID Governance.

Use Privileged Identity Management so admin roles are activated for a set time, with a reason and, for the most powerful roles, approval.

Intune compliance policies, checked by Conditional Access at sign-in.

Enrol devices in Intune, set compliance policies, and require a compliant or Entra hybrid joined device to reach Microsoft 365.

For example Microsoft Defender for Endpoint, with tamper protection on.

Deploy endpoint detection and response everywhere, servers included, switch on tamper protection and make sure someone reviews the alerts.

Fourteen days is the Cyber Essentials requirement for critical and high-risk updates.

Use Windows Update for Business or Windows Autopatch with deadlines, patch third-party applications as well, and report on compliance every month.

BitLocker or FileVault, with the built-in admin password rotated by Windows LAPS.

Enforce BitLocker and FileVault through Intune, remove standing local admin rights and let Windows LAPS manage the built-in admin account.

Without enforcement, anyone can send email that claims to come from your domain.

Switch on DKIM signing, then move DMARC from none to quarantine and on to reject, watching the aggregate reports as you go.

Defender for Office 365, ideally through Microsoft's preset security policies.

Apply the Standard or Strict preset security policies, and check that they cover every user.

A favourite way for attackers to copy a mailbox quietly.

Block external automatic forwarding in the outbound spam policy, with named exceptions only where there is a business need.

For example, links limited to specific people, with expiry dates on anything shared outside.

Make specific people the default link type, restrict or expire anyone links, and review guest access regularly.

Microsoft Purview, starting with the data that matters most.

Start with a small set of sensitivity labels and one data loss prevention policy for your most sensitive data, then widen them.

Retention settings and recycle bins are not a backup.

Back up Exchange, SharePoint, OneDrive and Teams with a dedicated service, ideally with immutable copies held outside your tenant.

A successful backup job proves the job ran, not that the restore works.

Test restores on a schedule, record how long they take, and compare the times with your recovery objectives.

Who calls whom, who can make decisions, and the first ten things to do.

Write a short playbook with named people and first steps, then run a tabletop exercise at least once a year.

The unified audit log in Microsoft Purview.

Confirm auditing is on, and keep logs for a year or more if you might need them for an investigation.

Alerts nobody reads are the same as no alerts.

Send Defender and Entra ID Protection alerts to a monitored queue with a named owner and holiday cover.

It turns Microsoft's recommendations into a measurable backlog.

Review Secure Score monthly, treat its top recommendations as a backlog, and record a reason wherever you choose not to act.

Apps with consent to read mail or files can be as risky as a compromised account.

Limit user consent to verified publishers and low-risk permissions, and review the apps already consented.