Stealth Technology Group Team
A company signs up for Microsoft 365 in 2019, migrates its email over a weekend, and moves on to the next project. Years later nobody has looked at the tenant settings since. Former employees still have licenses. External sharing links created in 2021 still work. A handful of staff approved third-party apps that can read their mailboxes. Two people share the global admin role and use it for daily email. The environment functions perfectly, which is exactly why nobody has reviewed it.
Microsoft 365 is now the center of most mid-market companies: email, files, chat, meetings, identity, and often device management all live in one tenant. That concentration is efficient, and it also means one misconfigured setting can expose an enormous amount of business data. The platform is secure by Microsoft’s standards, but the configuration is the customer’s responsibility, and the defaults are tuned for easy onboarding rather than for resisting attackers.
This guide walks through the settings that matter most, in rough priority order, and explains why each one earns its place.
Why Defaults Are Not Enough
Microsoft operates a shared responsibility model. It secures the infrastructure, the datacenters, and the service itself. You are responsible for who can sign in, what they can access, how data can be shared, which devices are trusted, and what gets logged. Attackers know this and target the customer side: stolen passwords, phished sessions, malicious app permissions, and overly permissive sharing.
The defaults have improved over the years. New tenants often start with some baseline protections enabled. But tenants age, licenses change, and settings that were reasonable at setup drift out of date as threats evolve. A tenant that has been running for several years almost always has gaps, and the gaps tend to be the same ones across organizations.
Licensing also shapes what is possible. Many of the controls below depend on the plan you hold, and plans that include advanced identity, device management, and email protection features differ significantly from entry-level subscriptions. Before changing settings, confirm what your licenses actually include, because organizations frequently pay for protections they have never turned on.
Start With a Baseline: Secure Score and a Tenant Review
The quickest way to see where you stand is to measure. Microsoft’s Secure Score rates your tenant against a set of recommended actions and shows which ones would improve your posture. It is not a perfect measure, and chasing the number for its own sake is a mistake, but it provides a useful list of unaddressed items and a way to track progress.
For a more structured reference, the Cybersecurity and Infrastructure Security Agency publishes secure configuration baselines for Microsoft 365 through its SCuBA project, which describe recommended settings and the reasoning behind them. Use these as a checklist to compare against your tenant, adapting for your business needs.
Beyond tools, a review should answer a few plain questions. Who holds administrative roles? Which accounts lack multi-factor authentication? Which external parties have access? Which apps have been granted permissions? What gets logged, and for how long? The answers usually surface the most serious problems quickly.
Identity: Enforce Multi-Factor Authentication the Right Way
If you change only one thing, change identity. Most Microsoft 365 compromises begin with stolen credentials, and a compromised mailbox is the starting point for fraud, data theft, and further attacks. The CISA guidance on multi-factor authentication is clear that MFA blocks the large majority of automated account attacks.
The difference between having MFA and enforcing it is where tenants fail. Many organizations enable it for some users, exempt executives or service accounts for convenience, or rely on per-user settings that are easy to miss. Conditional Access is the mechanism that enforces authentication requirements consistently. Microsoft’s Conditional Access overview explains how policies combine signals such as user, device, location, and application to decide whether to allow, block, or require additional verification. A baseline policy requiring MFA for all users and all cloud apps, with narrowly scoped and documented exceptions, closes the most common gap. Where Conditional Access is not available on your plan, the platform’s security defaults provide a simpler baseline and are better than nothing.
Two related controls matter as much. Block legacy authentication protocols, which cannot perform MFA and are a favorite route for password attacks. And move beyond basic prompts for the accounts that matter most. Attackers now bombard users with approval requests until someone accepts, a technique described in our article on MFA fatigue attacks. Number matching and phishing-resistant methods, including the passkeys covered in our guide to passkeys vs. passwords, raise the bar for administrators, executives, and finance staff.
Add a few supporting measures. Create emergency access accounts, protected and monitored, so a policy mistake cannot lock everyone out. Define trusted locations carefully. And where your license supports it, use risk-based policies that challenge or block suspicious sign-ins automatically.
Administrator Accounts: Fewer, Separate, and Least Privileged
Administrative roles are the keys to the tenant, and they are frequently over-distributed. A common pattern is several staff holding the global administrator role permanently, using the same account for email and browsing. A single phished admin session then hands an attacker everything.
The better pattern has a few components. Keep the number of global administrators small. Give people the narrowest role that fits their task, since Microsoft provides many specific roles for tasks such as managing users, email, or devices. Use separate, cloud-only accounts for administration, with no mailbox and no daily use. Require strong, phishing-resistant authentication for those accounts. And where available, use just-in-time elevation so privileges are granted only when needed and only for a short period.
Review role assignments regularly. Staff change jobs, contractors finish projects, and permissions accumulate. A quarterly review that removes unneeded assignments is inexpensive and catches the quiet creep of excess privilege.
Email: Authentication, Filtering, and Forwarding
Email is both the most attacked and the most abused service in the tenant. Several settings deserve attention.
Authenticate your own domain. SPF, DKIM, and DMARC together help prevent others from impersonating you, and a DMARC policy moved from monitoring to enforcement stops spoofed mail that appears to come from your exact domain. Configure DKIM signing for your domains in Exchange Online, since it is not always on by default for custom domains.
Turn on and tune the protections your license provides. Anti-phishing policies with impersonation protection, safe link scanning, and attachment detonation catch many threats that basic filtering misses. Add a visible tag for external senders so employees can see when a message claiming to be from an executive originates outside.
Control forwarding. Attackers who compromise a mailbox often create rules that silently forward or hide messages, and outbound auto-forwarding to external addresses is a common data exfiltration path. Confirm that your outbound policies block automatic external forwarding, and monitor for new inbox rules, particularly ones that delete, move, or forward mail. These are the footprints of the fraud described in our guide to business email compromise.
Make sure mailbox auditing is on and that you can see who accessed what. Auditing is enabled by default in current tenants, but verify it, and check retention against your needs.
Sharing, Teams, and Data Protection
SharePoint, OneDrive, and Teams make collaboration easy, and that ease is the risk. Sharing settings that are loose by default let anyone with a link, inside or outside the company, open files. Links created years ago may still work, and they rarely expire.
Review the tenant-level sharing configuration. Many organizations are better served by limiting external sharing to authenticated guests rather than allowing anonymous links, or at least by restricting anonymous links to a short expiry and view-only access. Set guest access to expire or be reviewed, and clean up guests who no longer need access. In Teams, review external access and guest settings, and decide deliberately which domains may collaborate with you.
Sensitivity labels and data loss prevention policies add a content-aware layer. Labels can classify documents and enforce encryption or sharing limits, while DLP rules can block or warn when sensitive information such as financial details or personal data is shared outside the organization. They require some design effort, but even a simple scheme covering the most sensitive categories reduces accidental exposure. The wider problem of employees moving data into unapproved tools, covered in our article on shadow AI and employee data exposure, makes these controls more relevant every year, and an AI usage policy tells staff what is acceptable.
Third-Party Apps and OAuth Permissions
Every time an employee signs into an outside application with their Microsoft account, they may grant that app permission to read mail, files, or contacts. Those permissions persist after the employee stops using the app, and a malicious or compromised application can use them to access data without ever needing a password.
Restrict who can consent to apps. A tighter setting requires administrator approval for apps requesting sensitive permissions, with an approval workflow so legitimate requests are not blocked indefinitely. Review the list of enterprise applications and their granted permissions, remove ones that are unused or unrecognized, and look for apps with broad access. Our guide to SaaS sprawl explains how these connections accumulate and why they deserve a periodic audit.
Devices: Make Access Depend on Device Health
Strong identity controls work best when paired with device awareness. Intune and Defender for Endpoint, where licensed, allow you to define what a compliant device looks like: encrypted, patched, protected, and managed. Conditional Access can then require a compliant device for sensitive apps, so a stolen password used from an unknown machine fails.
For personal devices, application-level protection is often more appropriate than full device management, keeping work data in protected apps that can be wiped on departure without touching personal content. Make sure laptops have disk encryption enabled, operating systems are kept current, and endpoint protection is active and monitored. Local administrator rights should be limited, since they make malware far more damaging.
Logging, Monitoring, and Alerting
Settings that prevent compromise are only half the picture. You also need to know when something is going wrong. Microsoft 365 produces rich logs: sign-ins, administrative actions, mailbox activity, file access, and security alerts. The unified audit log, sign-in logs, and risk detections hold the evidence you would need to investigate an incident.
Verify that auditing is enabled, check how long logs are retained under your license, and extend retention if your obligations require it, since the default window may be shorter than an investigation needs. Configure alerts for the events that matter: new inbox rules, impossible-travel or risky sign-ins, role changes, mass downloads, and unusual sharing. Logs nobody reads protect nothing, which is where a monitoring service helps. Our guides to managed SOC service providers and types of managed security services explain how to get real investigation, and our overview of zero trust vs. traditional network security shows how identity-centered monitoring fits a modern security model.
Backup: Microsoft 365 Is Not a Backup
One of the most expensive misunderstandings in Microsoft 365 is the belief that the service backs up your data in the sense that matters. Microsoft keeps the platform available and offers retention features such as recycle bins and recovery windows, but these are not the same as an independent backup. If a user deletes a mailbox, ransomware encrypts a SharePoint library, or an attacker removes data with administrative access, recovery options may be limited or time-bound.
An independent backup of mail, files, and Teams content, stored outside the tenant and protected from modification, closes the gap. The principles are the same as for any critical data, and our guides to immutable backups and backup and data recovery explain what resilient backup looks like and why recovery must be tested rather than assumed.
Compliance Considerations and Government Tenants
For regulated organizations, security best practices intersect with compliance requirements. Healthcare organizations need appropriate agreements and safeguards for protected health information. Financial and legal firms carry confidentiality obligations. Defense contractors face the most prescriptive rules.
Controlled unclassified information generally requires a tenant that meets specific authorization and security requirements, which is why many defense contractors use Microsoft’s government cloud offerings rather than commercial tenants. The requirements flow from NIST SP 800-171 and the CMMC program, and choosing the wrong tenant type is a costly mistake because it can require migrating later. Our CMMC compliance and compliance programs help organizations decide which environment fits their data, and our cloud transformation work supports the migration. Healthcare, finance, and legal organizations should document their configuration decisions as evidence of due care.
Common Mistakes
The same errors show up repeatedly. Exempting executives from MFA. Leaving legacy authentication enabled. Using global administrator accounts for daily work. Allowing anonymous sharing links with no expiry. Never reviewing app permissions. Assuming licenses include protections that were never configured. Forgetting about backup. Turning on policies without testing them. And treating the initial configuration as permanent rather than something to revisit as the tenant and the threat landscape change.
Another is ignoring the broader environment. A well-configured tenant still depends on the endpoints, networks, and people around it. Our guide to network segmentation for mid-market businesses explains how containment on the network side complements the identity controls described here.
Who Keeps It Configured
Hardening a tenant is a project. Keeping it hardened is an operation, because licenses change, features are added, and new threats appear. Many mid-market companies lack the staff to review settings regularly alongside everything else.
Stealth Technology Group’s managed IT services and cybersecurity programs include Microsoft 365 configuration, monitoring, and periodic review, delivered under the model described in our article on virtual managed services. A co-managed IT arrangement lets internal staff keep daily administration while an external team handles baselines and monitoring, and a vCIO helps leadership prioritize changes and track progress. Organizations in Boston, Tampa, and Sarasota can read the client results from businesses that have made these changes.
Conclusion
Microsoft 365 is secure when it is configured to be. The settings that matter most are not exotic: enforced MFA through Conditional Access, tightly controlled administrator roles, domain authentication and mail protection, sensible sharing limits, control over app permissions, device-aware access, useful logging, and an independent backup. Most businesses never revisit them, which is why the same gaps appear tenant after tenant.
Start with a baseline, change things in a sensible order, test before you enforce, and review on a schedule. A tenant that has been reviewed this way is a very different target from one that has run unchanged since the day it was set up.
If your organization is planning its CMMC compliance journey, contact Stealth Technology Group today at (617) 903-5559 or visit the website to learn how modern cybersecurity infrastructure can accelerate your path toward certification readiness.
