The Microsoft 365 Security Baseline We Apply to Every Client

A baseline is not a substitute for checking your tenant. Older settings, custom policies, application dependencies and changes made over time can affect protection. Confirm what is enforced rather than relying on a product label.

Review these areas:

• Legacy authentication attempts and remaining application dependencies
• Anonymous sharing links, guest access and site-specific sharing settings
• External forwarding rules and the process for reviewing exceptions
• Device compliance requirements for sensitive workloads
• Administrator authentication, role assignments and emergency recovery

Record the current state, approved target, responsible owner and test evidence for each change. Preserve a recovery path before enforcing policies that could interrupt access.

Legacy authentication protocols bypass MFA. Block them on day one with a Conditional Access policy targeting all users and all apps, with the Legacy Authentication client apps condition selected. This will break some line-of-business applications that use basic auth, fix those applications, don't leave legacy auth enabled to accommodate them.

Check what broke by monitoring the Conditional Access sign-in logs for a week after the policy goes to enforcement. Applications that fail will appear in the logs. Each one needs to be assessed: modernise the app, replace it, or document a risk-accepted exception.

Require MFA for routine user access, including executives and administrators. Stage Conditional Access changes in report-only mode and test them before enforcement. Workload identities need their own controls; do not assume an interactive user MFA policy secures an unattended application.

Maintain separately protected emergency administrator accounts. Microsoft recommends excluding them from Conditional Access policies that block or restrict sign-in, using phishing-resistant authentication, monitoring every use and testing access regularly. This is a controlled recovery path, not an exemption for everyday work. Follow Microsoft's emergency-access guidance.

For admin accounts: require phishing-resistant MFA (FIDO2 keys or Microsoft Authenticator with FIDO2). Enable Microsoft Authenticator number matching for all users to prevent MFA fatigue attacks. Block SMS-based MFA for any privileged role.

Five to seven well-tuned Conditional Access policies cover most SMBs:

1. Block legacy authentication (as above)
2. Require MFA for all users
3. Block sign-ins from countries where you have no business
4. Require MFA always (no trusted locations that bypass it)
5. Require compliant device for access to sensitive data and admin portals
6. Evaluate risk-based sign-in policies if licensed: these require Entra ID P2. Base Microsoft 365 Business Premium includes Entra ID P1, not P2; verify any additional subscriptions against Microsoft's licensing table.

Don't create dozens of policies. Overlapping policies generate unexpected conflicts and blocks. Start minimal and add only when there's a specific requirement.

Default SharePoint and OneDrive sharing allows "Anyone with the link", anonymous sharing with no account required. Set the tenant-wide default to "New and existing guests" (authenticated external access only). Allow per-site anonymous sharing overrides only where it's genuinely required for a specific workflow.

Review existing sharing links. Run the SharePoint sharing report to identify what has been shared externally and to whom. Revoke anonymous links that have no ongoing business purpose.

Enrol every company device in Microsoft Intune. Set compliance policies requiring:

• Disk encryption (BitLocker)
• Screen lock with PIN or biometric
• Current OS version (within the last major release)
• EDR (Defender for Business) running and reporting healthy

Tie compliance to Conditional Access: non-compliant devices cannot access company data. This ensures that unmanaged or compromised devices don't maintain access even if credentials are valid.

Auto-forwarding rules to external addresses are one of the most common post-compromise indicators. An attacker who gains access to an email account often sets an auto-forward rule to exfiltrate email silently, then comes back later for data they've accumulated.

Run the Exchange admin centre report for auto-forwarding rules. Block all auto-forwarding to external domains via transport rule, with a documented exception process for specific legitimate use cases (rare). Review inbox rules on high-risk accounts (executives, finance, admin) for unusual redirect rules.

Reduce standing privileges for routine administration. Microsoft Entra Privileged Identity Management (PIM) supports time-limited role activation, but requires Entra ID P2 or Entra ID Governance licensing; base Business Premium alone does not include it. Check licensing for eligible users, approvers and reviewers before implementation. Without PIM, use separate admin identities, narrowly scoped roles and documented access reviews.

At minimum: no permanent Global Administrator assignments except for break-glass accounts. Day-to-day admin work done via role-eligible activation, not standing admin sessions. Break-glass accounts stored in a physical safe with monitored access logging.

Teams external access and guest access controls are separate from SharePoint. Review:

• External access (federation with other M365 tenants): restrict to specific trusted domains if possible
• Guest access: ensure guests cannot enumerate other guests or access channels they haven't been explicitly added to
• Meeting settings: anonymous join for external meetings should require a lobby hold for non-guests

• Cybersecurity and compliance
• Microsoft 365 migration
• Managed IT services
• Cloud and Microsoft 365

Talk to us about your project