01
Microsoft 365 Security: What You Already Have
If your business uses Microsoft 365, you already have access to a significant security capability — most of which is not enabled by default. The gap between what Microsoft provides and what most organisations actually have configured is the primary cause of Microsoft 365-related incidents.
| Feature | Required Action | Where to Configure |
|---|
| MFA for all users | Enable and enforce | Entra ID > Security > Conditional Access |
| Safe Links and Attachments | Configure policy | Security.microsoft.com > Email & collab |
| Unified audit log | Enable | Compliance.microsoft.com > Audit |
| Microsoft Secure Score | Review and act | Security.microsoft.com > Secure Score |
| Device compliance | Deploy Intune | Intune.microsoft.com |
| DLP policies | Create policies | Compliance.microsoft.com > DLP |
Microsoft's default configuration is designed for broad compatibility, not security. Securing your tenant requires deliberate configuration changes beyond the defaults.
Conditional Access Policies
✓Require MFA for all users — no exceptions
✓Block legacy authentication protocols — these bypass MFA
✓Require compliant device for sensitive apps (when Intune is deployed)
✓Block access from high-risk sign-ins — Entra ID Identity Protection integration
✓Restrict admin portal access to managed devices only
Admin Role Security
✓Global Admin accounts separate from daily-use accounts — no mailbox on GA accounts
✓Use role-specific admin roles — not Global Admin for everything (Exchange Admin, Teams Admin, etc.)
✓Enable Privileged Identity Management — Just-in-Time admin role activation
✓Require MFA for all admin role activation
User Account Security
✓Self-Service Password Reset with MFA verification — reduce helpdesk burden
✓Entra ID Identity Protection — risk policies for users and sign-ins
✓Named locations — flag sign-ins from countries you don't operate in
✓Passwordless authentication for supported users
Exchange Online Protection (included in all licences)
✓Anti-spam policies — tune confidence thresholds
✓Anti-malware policy — block common malicious file types
✓Spoofing protection — built-in for your tenant domains
Defender for Office 365 (Business Premium / E3+addon)
✓Safe Links — time-of-click URL detonation
✓Safe Attachments — sandbox file detonation
✓Anti-phishing — impersonation protection for key users and domains
✓Spoof intelligence — cross-domain spoofing detection
Email Authentication
✓SPF record: publish and test
✓DKIM: enable for all sending domains, include marketing/automation tools
✓DMARC: start at p=none, monitor, move to p=quarantine, then p=reject
✓DMARC reporting: configure external reporting to review spoofing attempts
04
Device and Endpoint Security
Microsoft Intune
✓Enrol all company-owned devices — Windows, macOS, iOS, Android
✓Configure device compliance policies — encryption, OS version, screen lock, antivirus
✓Apply Conditional Access requiring compliant device for corporate data access
✓Deploy Intune Configuration Profiles — browser policies, Wi-Fi, VPN settings
Defender for Endpoint
✓Onboard all enrolled devices to MDE via Intune
✓Configure security baseline via Endpoint Security policies
✓Enable Tamper Protection — prevent attackers from disabling security
✓Attack Surface Reduction rules — at minimum enable in audit mode, then block mode after review
Application Management
✓Intune Application Protection Policies — protect corporate data in mobile apps without full MDM
✓Block copy/paste from corporate apps to personal apps
✓Remote wipe of corporate data from personal devices (MAM wipe)
05
Data Protection and Compliance
Microsoft Purview (Compliance portal)
✓Enable Unified Audit Log — required for any security investigation
✓Sensitivity labels — classify documents: Public, Internal, Confidential, Highly Confidential
✓DLP policies — prevent sensitive data leaving via email, Teams, or SharePoint sharing
✓Retention policies — define data lifecycle: how long to keep, what to delete
✓Communication compliance — optional, for regulated industries requiring message monitoring
Secure Score
Microsoft Secure Score (security.microsoft.com > Secure Score) is the single most actionable starting point for Microsoft 365 security improvement. It scores your current configuration, shows what's missing, and provides direct implementation guidance.
✓Target: 60%+ for SMB baseline
✓Each recommendation includes effort estimate and security impact
✓Prioritise: identity recommendations highest impact, email second, device third
06
De4sec Microsoft 365 Security Service
Tenant Audit
Review current configuration against security best practices. Identify gaps in identity, email, device, and data protection.
Secure Baseline
Implement Conditional Access, email security, Intune, DLP, sensitivity labels, and audit logging.
Secure Score Optimisation
Work through prioritised Secure Score recommendations. Target 65%+ within 90 days of engagement.
Ongoing Management
Monthly Secure Score review, alert monitoring, quarterly policy review, patch compliance reporting.
