Microsoft 365 security for businesses: the complete guide
By Kike Gandia · Co-Founder & CEO, OSCP
Microsoft 365 concentrates your company's email, documents and identities in Entra ID, Exchange Online, SharePoint and Teams. That centralization makes it a priority target: compromising a misconfigured tenant can grant access to the whole business. This guide explains the real risks and how to protect your environment beyond the default settings.
Why Microsoft 365 is a priority target
Microsoft 365 and Entra ID are the identity and productivity backbone of millions of companies, which is why they're the favorite target of phishing and cloud-focused credential theft. Compromising an account —especially a global admin— can open access to years of email, to SharePoint and to apps federated via SSO. The impact of a compromise is usually total.
The shared responsibility model
Microsoft secures its platform, but the tenant configuration, access policies, app consents and detection of suspicious activity are your organization's responsibility. Most incidents don't exploit a Microsoft flaw, but a customer misconfiguration.
Identity and access: Entra ID and conditional access
The foundation of a secure Microsoft 365 is identity. Enforcing phishing-resistant MFA, defining conditional access policies without gaps, limiting and protecting global admins with PIM (Privileged Identity Management) and reviewing guest users are the measures that most reduce risk. The CIS Microsoft 365 Benchmark is the reference framework.
OAuth apps, Exchange and SharePoint sharing
Three vectors account for much of the incidents: apps with illicit consent (persistent access to email and files), forwarding rules in Exchange Online (persistence after a compromise) and external or anonymous sharing in SharePoint and OneDrive (data leakage). Controlling these three points is a priority.
What each licence gives you and what you will have to compensate for
A good share of Microsoft 365 security recommendations depend on the edition you have bought, and planning a policy your licence does not support is a common way to lose weeks.
| Capability | Where it comes from | If you do not have it |
|---|---|---|
| MFA and conditional access | Entra ID P1, included in Business Premium and E3 | You are left with security defaults, without granularity or controlled exceptions |
| PIM and just-in-time roles | Entra ID P2, in E5 or as an add-on | Privileged roles are permanent: compensate with separate admin accounts and role-change alerts |
| Defender for Office 365 | Included in Business Premium and E5, add-on for E3 | Less phishing and attachment detection: reinforce filtering, training and payment verification |
| Purview DLP, retention and labels | Varies considerably across editions and add-ons | Replace it with strict external sharing control and periodic review |
| Long audit log retention | Depends on the edition and add-ons | Export logs to your own storage if you need to keep them longer |
The practical takeaway: check your edition before designing the plan, and where a capability is missing, decide which control compensates for it instead of leaving the gap open.
Signs the tenant is already compromised
Before hardening anything it is worth ruling out that the problem is already inside. A handful of indicators, in our experience, give away most Microsoft 365 compromises.
- App registrations or service principals with a credential added recently, especially where nobody knows what they are for.
- Consent granted to applications with broad permissions over mail or files.
- Inbox rules that move messages into low-visibility folders, or filters on words like "invoice", "IBAN" or "transfer".
- External forwarding enabled on specific mailboxes, outside any formal request.
- Successful sign-ins from unusual locations or network providers, followed by mailbox search activity.
- Changes to the federation configuration or to federated domains.
- New guest users with permissions over sites or teams.
- The audit log disabled, or showing gaps.
The uncomfortable caveat is that almost all of this is only visible if the unified audit log was already on. If it was not, there is no way to look backwards: turn it on today, even if the rest of the plan takes longer.
FAQ
Is Microsoft 365 secure by default?
It has a solid baseline, but the default configuration isn't the most secure. For a business environment it must be hardened (phishing-resistant MFA, conditional access, OAuth consent control, restricted external sharing) following a framework such as the CIS Benchmark.
How often should I review my Microsoft 365 security?
At least once a year, and always after major changes (migration, growth, new integrations) or any suspicion of unauthorized access, phishing or CEO fraud.
What is the scope of a Microsoft 365 security review?
The tenant configuration, identity and conditional access policies, privileged roles, applications and granted consents, Exchange Online, sharing in SharePoint, OneDrive and Teams, and the real detection capability. The size of the work is driven by the number of users, of domains and, above all, of accumulated policies and exceptions.
Does it affect users while it runs?
Configuration and log review is read-only, so nobody notices anything. Tests that do generate visible activity —a phishing simulation, the practical validation of a conditional access policy— are agreed in writing beforehand and run whenever suits you.
What do you need to get started?
A read-only role over the tenant (global reader or security reader), access to audit and sign-in logs, the list of domains and integrations, and knowing who holds privileges today. None of that requires privileged credentials or changes to your environment.
Does Secure Score replace an audit?
No. Secure Score is a good compass for prioritising settings, but it scores configurations one by one according to Microsoft’s weighting. It does not chain vectors, does not check whether a policy has an exclusion that voids it in practice, and does not see what has already happened in your logs. It is a useful complement, not a substitute.