Microsoft 365 security
Identity, email, collaboration and data protection settings in Microsoft 365, explained. Every guide notes licensing dependencies and links to Microsoft’s own documentation, which is the authoritative source.
Start here
- Microsoft 365 security baseline: the settings Microsoft's guidance coversA Microsoft 365 security checklist based on Microsoft's documentation: MFA, legacy sign-in, admin accounts, email, sharing, audit logs and licence notes.
- Security defaults vs Conditional Access: how they differMicrosoft 365 security defaults vs Conditional Access: what each enforces, the licences Microsoft lists, and the steps Microsoft describes for switching.
- Microsoft 365 MFA methods compared, from SMS to passkeysPhishing-resistant MFA in Microsoft 365: the sign-in methods Microsoft calls phishing-resistant, those it calls prone to phishing, and ASD's view of SMS.
Monitoring
- Audit logs, alerts and Secure Score in Microsoft 365, explainedMicrosoft 365 audit log retention as Microsoft lists it: Audit Standard vs Premium, auditing defaults, alert policies, Entra sign-in logs and Secure Score.
- What changed in Microsoft 365 security: October 2026Microsoft 365 security changes for October 2026: a summary of updates Microsoft announced for Defender, Purview, Intune and Teams, with links.
Exchange Online and email
- Compromised Microsoft 365 account: what Microsoft's response guide describesThe steps Microsoft, ASIC and the ACSC describe for a compromised Microsoft 365 (Office 365) account: contain it, remove the foothold, investigate, report.
- SPF, DKIM and DMARC for Microsoft 365, explainedHow SPF, DKIM and DMARC work in Microsoft 365, the setup order Microsoft describes, and its DMARC rollout for custom, onmicrosoft.com and parked domains.
- Suspicious inbox rules and forwarding in Microsoft 365, explainedSuspicious inbox rules and forwarding in Microsoft 365: the signs Microsoft lists, where it checks for rules, and the forwarding settings it describes.
Copilot and AI
- Defender for Office 365 and built-in email protection, explainedDefender for Office 365 Plan 1 vs Plan 2 and built-in protection (EOP) as Microsoft describes them: Safe Links, Safe Attachments, quarantine.
- Shared mailbox security in Microsoft 365, explainedWhy Microsoft says to block sign-in for shared mailbox accounts, how Full Access and Send As permissions work, and how mailbox auditing records their use.
Identity and access
- Guest access and external identities in Microsoft 365How Microsoft 365 guest access works, as Microsoft describes it: B2B guest users, who can invite guests, Teams and SharePoint settings, and access reviews.
- Microsoft 365 admin roles and least privilege explainedMicrosoft 365 admin roles and least privilege as Microsoft describes them: Global Administrator limits, break-glass and separate admin accounts, and PIM.
- Microsoft 365 MFA methods compared, from SMS to passkeysPhishing-resistant MFA in Microsoft 365: the sign-in methods Microsoft calls phishing-resistant, those it calls prone to phishing, and ASD's view of SMS.
- Microsoft Entra ID basics for Microsoft 365 tenantsWhat Microsoft Entra ID is and how it works in a Microsoft 365 tenant, in plain English: users, groups, admin roles, sign-in logs and Conditional Access.
- Privileged Identity Management (PIM) in Microsoft Entra, explainedPrivileged Identity Management in Microsoft Entra explained: eligible vs active roles, just-in-time activation, approval, alerts and licensing.
- Security defaults vs Conditional Access: how they differMicrosoft 365 security defaults vs Conditional Access: what each enforces, the licences Microsoft lists, and the steps Microsoft describes for switching.
- Token theft and session security in Microsoft 365How Microsoft 365 token theft and AiTM phishing work, why MFA alone may not stop them, and the mitigations Microsoft documents, such as token protection.
- App consent in Microsoft Entra ID and consent phishing, explainedHow Entra ID user consent settings and the admin consent workflow work, and how consent phishing gets malicious apps access to Microsoft 365 data.
Devices
Administration
- Microsoft 365 licensing and security features: a referenceMicrosoft 365 Business Premium vs E3 security features, plus E5, Basic and Standard, as listed in Microsoft's service descriptions, with common add-ons.
- Microsoft 365 security baseline: the settings Microsoft's guidance coversA Microsoft 365 security checklist based on Microsoft's documentation: MFA, legacy sign-in, admin accounts, email, sharing, audit logs and licence notes.
- Staff offboarding in Microsoft 365: removing access when someone leavesOffboarding a user in Microsoft 365: the steps Microsoft documents to block sign-in, revoke sessions, handle the mailbox and OneDrive, and remove licences.
Data protection
Teams, SharePoint and OneDrive
- SharePoint and OneDrive sharing settings, explainedSharePoint and OneDrive external sharing settings as Microsoft describes them: sharing levels, Anyone links, default links, guest expiry, inheritance.
- Teams external access and guest access, explainedTeams external access vs guest access: how Microsoft describes each, the controls for external domains, and phishing through external Teams chats.
Microsoft 365 Copilot and agents
Microsoft 365 security: questions people ask
How do I secure Microsoft 365 for a small business?
Start-up priorities in Microsoft's guidance include multi-factor authentication for every user, protected admin accounts, blocking legacy sign-in and email protection. Microsoft 365 security checklist
Security defaults or Conditional Access?
Security defaults are a free baseline; Conditional Access needs Entra ID P1. Our guide explains the difference and when each fits. Security defaults vs Conditional Access
What do I do if a Microsoft 365 account is hacked?
Our guide follows Microsoft's response steps: block sign-in, reset the password, revoke sessions and check for rules and app consents. Compromised account response