Microsoft 365 Security Baselines Every Business Should Enable

Most Microsoft 365 breaches we investigate start with a compromised mailbox—not a sophisticated zero-day. Default tenant settings favour convenience. Security baselines favour control. For SMBs, a practical middle ground is both achievable and overdue.

Start with identity: MFA and Conditional Access

Enable MFA for all users, then strengthen it with Conditional Access policies. At minimum: require MFA for all cloud apps, block legacy authentication, and require compliant or hybrid-joined devices for privileged roles.

• Block basic authentication (IMAP/POP/SMTP AUTH where unused)
• Require MFA for Azure portal and Microsoft 365 admin centres
• Restrict access from unfamiliar countries if your staff do not travel there
• Use risk-based policies (Identity Protection) where licensing allows

Lock down privileged roles

Global Administrators should be few, named, and unused for daily email. Enable Privileged Identity Management (PIM) where available so admin rights are just-in-time. Turn on audit logs and retain them long enough to investigate incidents (90+ days minimum; longer for regulated industries).

Email protection that matches modern threats

Configure anti-phishing policies, Safe Links, and Safe Attachments (Defender for Office 365) where licensed. Spoof intelligence, DMARC/DKIM/SPF for your domains, and user-reported phishing mailboxes close the loop between technology and people.

SharePoint and OneDrive sharing defaults

‘Anyone’ links are convenient and frequently abused. Prefer organisation-only or specific-people sharing by default. Disable anonymous sharing for sensitive sites. Review external sharing reports monthly.

Device and endpoint alignment

Microsoft 365 security is weaker if unmanaged personal devices sync corporate data. Use Intune or equivalent to require disk encryption, screen lock, and Defender Antivirus; block sync from non-compliant devices for high-risk users.

A baseline rollout sequence that works

1. Inventory admin accounts and enable MFA for admins first
2. Block legacy auth and enforce MFA for all users
3. Deploy Conditional Access and email protection policies in report-only, then enforce
4. Tighten sharing defaults and review Guest users
5. Enable logging, alerts, and a monthly security review cadence

CyberByte implements and manages Microsoft 365 security baselines for organisations that want hardened tenants without a full-time cloud security team. Ask us for a tenant health check.