Microsoft 365 security baseline: the settings Microsoft's guidance covers

Securing Microsoft 365 for a small business, as Microsoft’s documentation describes it, centres on MFA for every user, blocking legacy sign-in, few and well-protected admin accounts, email protection and audit logging. Many security problems in small Microsoft 365 tenants involve a password that has been phished or reused, sign-in without a strong second check, and a mailbox that is then misused. Microsoft’s documentation describes a set of settings that address those risks. This Microsoft 365 security checklist summarises what that documentation covers, in roughly the order the topics build on each other, and links to the Microsoft page behind each item.

It is a general explanation for business owners and the people who look after a tenant. It isn’t an assessment of any particular tenant. The Microsoft 365 Security Readiness Checklist lets you record which of these topics you’ve reviewed.

Testing and safe change, as Microsoft describes it

Microsoft’s Conditional Access documentation describes report-only mode, which shows the effect of a policy on users before it is enforced. Its example policy for blocking legacy authentication starts in report-only mode “so administrators can determine the impact”. Microsoft also describes emergency access accounts (below) as the way back in if a policy is misconfigured. What Microsoft Entra ID is and how its parts fit together covers the identity service these settings live in.

1. Emergency access accounts

Emergency access accounts, often called break-glass accounts, are highly privileged accounts kept for situations where normal administrator accounts can’t be used. Microsoft’s emergency access documentation describes:

• creating two or more emergency access accounts that are cloud-only, use the onmicrosoft.com domain and hold the Global Administrator role
• excluding them from any Conditional Access policy that blocks or restricts sign-in
• protecting them with a passkey (FIDO2), which Microsoft marks as recommended, or certificate-based authentication where a PKI already exists
• configuring alerts for every use of an emergency access account
• storing credentials in secure, separate locations, and checking the accounts still work at least every 90 days.

Microsoft’s mandatory MFA documentation states that break-glass or emergency access accounts are also required to sign in with MFA to its admin portals, and that a passkey (FIDO2) or certificate-based authentication satisfies that requirement.

2. Multifactor authentication for every user

Microsoft describes two ways to require multifactor authentication (MFA) across a tenant:

• Security defaults are a fixed set of protections. Microsoft’s documentation lists six: requiring all users to register for MFA, requiring administrators to do MFA, requiring users to do MFA when necessary, blocking legacy authentication, blocking device code flow, and protecting privileged activities such as access to the Azure portal. Microsoft describes them as suiting organisations that want to improve security but don’t know where to start, and organisations on the free tier of Microsoft Entra ID.
• Conditional Access policies set rules for who, what and when. Microsoft states that organisations with Microsoft Entra ID P1 or P2 licences may find security defaults are “probably not right” for them.

Microsoft’s security defaults page says the setting is under Entra ID > Overview > Properties > Manage security defaults in the Microsoft Entra admin center, for someone signed in as at least a Conditional Access Administrator. Security defaults vs Conditional Access explains how the two differ.

3. Legacy authentication

Legacy authentication refers to older sign-in protocols that can’t do MFA. Because they only check a password, Microsoft’s documentation links them to password-based attacks such as credential stuffing and password spray, and says those attacks “would stop with basic authentication disabled or blocked.”

Security defaults block legacy authentication. For tenants with Conditional Access, Microsoft publishes an example policy that blocks it (created under Entra ID > Conditional Access > Policies in the Microsoft Entra admin center), which starts in report-only mode and excludes emergency access accounts to prevent lockout. Microsoft notes that customers without licences that include Conditional Access can use security defaults to block legacy authentication.

4. Administrator accounts

Microsoft’s best practices for Entra roles describe:

• least privilege, meaning administrators get exactly the permissions they need to do their job
• assigning the Global Administrator role to fewer than five people
• turning on MFA for all administrator accounts
• using access reviews to find and remove role assignments that are no longer needed
• avoiding on-premises synced accounts for Entra role assignments.

Microsoft 365 admin roles and least privilege explains these roles, separate admin accounts and Privileged Identity Management in more detail.

Microsoft’s authentication methods documentation recommends phishing-resistant methods, such as Windows Hello for Business, passkeys (FIDO2) and FIDO2 security keys, or certificate-based authentication. Microsoft 365 MFA methods compared explains the differences.

5. App consent

By default, Microsoft states, users can consent to apps for permissions that don’t require administrator consent. Microsoft’s documentation recommends allowing user consent only for apps published by a verified publisher, and describes an admin consent workflow for requests users can’t approve themselves. How Entra ID user consent settings and consent phishing work covers these settings.

6. Email protection

• Preset security policies. Microsoft describes Standard protection as “a baseline profile that’s suitable for most users” and Strict protection as a more aggressive profile for selected users. Microsoft states that until they are turned on and users are assigned, the Standard and Strict presets are assigned to no one. With Defender for Office 365 (Microsoft states these policies are in organisations with Microsoft 365 E5 or Defender for Office 365 add-on subscriptions), the presets also include Safe Links, Safe Attachments and impersonation settings. Microsoft gives the location as Email & collaboration > Policies & rules > Threat policies > Preset Security Policies in the Microsoft Defender portal (security.microsoft.com).
• Automatic external forwarding. The default setting in the outbound spam filter policy is “Automatic - System-controlled”. Microsoft explains that its behaviour can differ by organisation, and its documentation says to configure On or Off instead. The setting is in the outbound anti-spam policy in the Defender portal; the steps for finding the automatic forwarding setting are in the inbox rules guide.
• SPF, DKIM and DMARC. Microsoft describes these as interdependent standards for every domain that sends email. See SPF, DKIM and DMARC for Microsoft 365.

7. Devices

Microsoft describes Intune device compliance policies as rules managed devices must meet, such as a minimum operating system version or not being jailbroken or rooted. Microsoft’s documentation explains that a Conditional Access policy set to “Require device to be marked as compliant” uses that status to grant or block access to email and other resources. Intune and device security basics explains compliance policies and what each Business plan includes.

8. Sharing

Microsoft’s SharePoint and OneDrive sharing documentation describes:

• organisation-level external sharing settings, from Anyone (links that don’t require sign-in) through New and existing guests and Existing guests to Only people in your organization; individual sites can be more restrictive, but not more permissive
• an option to make Anyone links expire after a set period, and to limit them to view access
• a setting that makes guest access expire automatically after a set number of days.

Microsoft’s documentation advises against the “Existing guests” setting, because guests can be added to the directory in other ways. SharePoint and OneDrive sharing settings explains each sharing level and Anyone links. Organisations planning Microsoft 365 Copilot can read SharePoint oversharing and Copilot.

9. Visibility

• Audit logging. Microsoft states that audit logging is on by default for Microsoft 365 organisations, with an important exception: it isn’t enabled by default for small and medium business licences, including Microsoft 365 Business Basic, Business Standard and Business Premium, or for unmanaged enterprise trial tenants. In those cases Microsoft says auditing has to be turned on manually. Microsoft’s steps: in the Microsoft Purview portal (purview.microsoft.com), open the Audit solution and, if auditing is off, select the Start recording user and admin activity banner. Microsoft notes it can take up to 60 minutes to take effect. Microsoft 365 audit logs, alerts and Secure Score explains the unified audit log and alert policies.
• Microsoft Secure Score. Microsoft describes Secure Score as a measurement of security posture, where a higher number means more recommended actions taken. Microsoft also states that it “isn’t an absolute measurement of how likely your system or data could be breached” and isn’t a guarantee against a breach.

10. Recovery

Microsoft’s support pages describe built-in restore features with time windows. Restoring a OneDrive can undo actions on files and folders from the last 30 days, and restoring a shared SharePoint library can undo actions from the last 30 days. Microsoft 365 backup: what’s built in explains these features and how separate backup services are described.

Summary of the areas covered

How this relates to the Essential Eight

The Australian Signals Directorate’s Essential Eight explained publication lists multi-factor authentication, restrict administrative privileges and regular backups among its eight mitigation strategies. Several Microsoft settings above relate to those strategies. This page doesn’t measure Essential Eight maturity; the Essential Eight explained for small businesses covers the framework.

Common questions

How do I secure my Microsoft 365 account?

From an administrator’s view, Microsoft’s documentation starts with MFA for every user, blocking legacy authentication, and fewer than five Global Administrators, each with MFA. Its authentication methods page recommends phishing-resistant methods such as passkeys (FIDO2). These are tenant settings made by whoever administers Microsoft 365. For your own everyday sign-ins, how to secure your online accounts covers passphrases, password managers and MFA. Administrator accounts has Microsoft’s list.

How do I secure Microsoft 365 for a small business?

Microsoft’s documentation covers a set of priority settings for a small tenant: two emergency access accounts, MFA for everyone, blocking legacy authentication, few Global Administrators, the Standard preset email policy, the automatic forwarding setting and audit logging. Each one supports the next. The numbered sections on this page follow that order with Microsoft’s admin-centre paths, starting with emergency access accounts.

Can I turn on MFA without paying for Conditional Access?

Yes. Microsoft describes security defaults as available at no extra cost; they require all users to register for MFA and block legacy authentication. Conditional Access requires Microsoft Entra ID P1, which Microsoft says Business Premium customers also have access to. Multifactor authentication for every user has the admin-centre path, and security defaults vs Conditional Access compares the two.

Is audit logging turned on by default in Microsoft 365?

Not for every plan. Microsoft states audit logging is on by default for Microsoft 365 organisations, except small and medium business licences, including Business Basic, Business Standard and Business Premium, and unmanaged enterprise trial tenants. In those, Microsoft says auditing has to be turned on manually in the Purview portal’s Audit solution, and it can take up to 60 minutes to take effect. See Visibility.

Does a high Secure Score mean my tenant is safe?

Not on its own. Microsoft describes Secure Score as a measurement of security posture, where a higher number means more recommended actions taken. Microsoft also states that it “isn’t an absolute measurement of how likely your system or data could be breached” and isn’t a guarantee against a breach. Visibility covers Secure Score alongside audit logging.

What do I do if a Conditional Access policy locks admins out?

Microsoft describes emergency access accounts as the way back in if a policy is misconfigured. Its documentation describes two or more cloud-only Global Administrator accounts, excluded from policies that block sign-in, protected by a passkey (FIDO2) and checked at least every 90 days. Microsoft also describes report-only mode for seeing a policy’s effect before enforcing it. See emergency access accounts.