Skip to main content
Edge SecureSECURE IT · PRIVATE AI · FASTER BUSINESS
Microsoft 365 Guide

Microsoft 365 Security Basics

The security settings that matter most for protecting your Microsoft 365 environment — written for business owners and administrators without a security background.

7 min read · Last reviewed September 2026

Note: Microsoft 365 security settings change as Microsoft updates the platform. Verify each setting in your current admin center. Some features require specific licensing tiers. This guide was reviewed against Microsoft documentation in September 2026 — consult Microsoft documentation or a qualified administrator before making changes.

Why M365 security requires attention beyond the defaults

Microsoft 365 provides baseline protections, including Security Defaults for eligible tenants. Existing tenants, exclusions, licensing, and custom policies can differ. Review effective settings against your business risks rather than assuming defaults are sufficient.

Identity, email, sharing, and recovery settings deserve deliberate review. Start with configuration gaps, then identify where additional licensing or a different service is needed.

Priority 1 — Identity and access

Critical

Enable MFA for all users

Require MFA for interactive user and administrator accounts, prioritizing phishing-resistant methods. Block direct sign-in to shared mailbox accounts; grant delegated access through licensed users protected by MFA. Non-interactive applications and service identities need appropriate workload authentication, least privilege, and credential lifecycle controls rather than an ordinary user MFA prompt.

Critical

Block Basic authentication; review protocol use

POP, IMAP, and SMTP AUTH support OAuth with compatible applications. Basic authentication is the legacy username/password method that cannot satisfy MFA challenges; it is not the same as the protocol. Disable unused protocols and SMTP AUTH, inventory required applications, and migrate supported clients to OAuth. Delegated and app-only flows have different controls; test the chosen flow with your administrator.

High

Review admin accounts and global administrator access

Global Administrator is the most privileged role in M365. This role has broad tenant privileges. Keep standing Global Administrator access limited to justified needs and plan controlled emergency access. Use dedicated admin accounts separate from daily-use accounts. Require MFA on all admin accounts.

High

Configure Conditional Access policies

Conditional Access can require MFA, authentication strength, or a compliant device, or block access based on configured conditions. It requires Microsoft Entra ID P1 for covered users, included in Microsoft 365 Business Premium. User-risk and sign-in-risk policies require Entra ID P2 entitlement, not P1 alone. Pilot in report-only mode, plan emergency access, and verify license coverage before enforcement.

Priority 2 — Email security

Configure DMARC, DKIM, and SPF for your domain

These email-authentication mechanisms help reduce direct domain spoofing. SPF authorizes sending servers; DKIM signs messages; DMARC evaluates alignment with the visible From domain and publishes handling policy. They do not stop lookalike domains or compromised legitimate accounts.

Enable Microsoft Defender for Office 365 — Safe Links and Safe Attachments

Safe Links rewrites URLs in email and scans them at click time. Safe Attachments detonates suspicious attachments in a sandbox before delivery. Both features require Microsoft Defender for Office 365 Plan 1 or higher (included in Business Premium).

Review the anti-spam and anti-phishing policies

Default anti-phishing policies provide some protection, but reviewing the impersonation protection settings and enabling mailbox intelligence-based protection provides significantly better coverage against targeted attacks.

Enable external sender warnings

Adding a banner to email from external senders helps employees recognize when an email claiming to be from a colleague or known contact is actually coming from outside the organization — a common BEC pattern.

Priority 3 — Data and backup

Choose backup coverage against recovery requirements

Retention, recycle bins, and version history have workload-specific recovery limits. Native Microsoft 365 Backup is a separately configured, usage-billed option for Exchange Online, SharePoint, and OneDrive. Compare it with third-party solutions for retention, restore granularity, data separation, supported content, and cost. Verify Teams coverage separately and test recovery rather than assuming every object is protected.

Review sharing and external collaboration settings

External sharing depends on tenant, site, and account settings; review the effective configuration. Review who can share, what they can share, and whether anonymous links are permitted. Overly permissive sharing settings are a common data exposure path.

Enable Microsoft Purview audit logging

Verify that unified audit logging is enabled, that required events are captured, and that retention meets your investigation needs. It is enabled by default for many eligible subscriptions, but availability and retention depend on licensing and configuration. Check access to search and export logs before an incident.

A word on licensing

Licensing is feature-specific, not a single upgrade ladder. Business Premium includes Entra ID P1, Defender for Business, and Defender for Office 365 Plan 1; these protect different workloads. Risk-based Conditional Access needs additional entitlement. Audit retention and advanced Purview features also depend on licensing. Microsoft 365 Backup is billed separately. Confirm the exact SKU, covered users and workloads, and current terms with your administrator.

Microsoft source documentation

Related Tools and Resources

ToolMicrosoft 365 Security CheckToolBackup Readiness AssessmentServiceCybersecurity Services

Ready for a professional review of your current situation?

Request a Microsoft 365 Security Review

Edge Secure / Privacy

Your privacy, simply.

We’d like to use Google Analytics to improve this site and understand what leads to an inquiry. Optional analytics measures page views, referrers, tool starts and completions, contact-button clicks, and accepted inquiries—not your form answers. No advertising tracking.

Your local tool history still works either way. Change or withdraw your choice anytime in Privacy settings. Closing changes nothing.