Microsoft 365 baseline

You pay for the security features. The baseline is switching them on.

Most tenants we review hold licences with Conditional Access, device management and endpoint protection, then leave them half configured. Here is the baseline we apply, what each licence actually includes, and a tool that shows what you can switch on today.

Licence details and dates from Microsoft Learn, checked 31 October 2026.

Book a tenant review Check your licence 07 3114 2808

Baseline by licence
Conditional Access set
Safe rollout order

Reviewed by Blake Bath, General Manager, on 31 October 2026.

An IT administrator works at two monitors showing security dashboards, with a hardware security key plugged into a laptop beside him. — **Report-only first**Every Conditional Access policy is tested in report-only mode before it is enforced.

What we find

Five gaps in most tenants we review.

Each one is a setting, not a purchase.

MFA but no Conditional Access

Security defaults or per-user MFA, with legacy sign-in still open somewhere.

Conditional Access
Legacy blocked
Break-glass set

Baseline by licence

What can you switch on with the licence you have?

Pick your licence and devices. You get the controls available today and what needs an add-on.

Pick the licence you have. You get the baseline controls you can switch on today and the ones that need an add-on.

Which licence do most staff have?

What devices do staff use?

Do admins have separate admin accounts?

Your baseline

7 of 11 controls

available on Business Premium today.

Switch on now

MFA for every account. A Conditional Access policy for all users, with two break-glass accounts excluded.
Block legacy sign-in (POP, IMAP, SMTP AUTH). One Conditional Access policy.
Device-based access rules. Admins and sensitive apps only from managed, compliant devices.
Device management and compliance (Intune). Encryption, updates and a compliance policy on every device.
Endpoint detection and response. Defender for Business on every device.
Safe Links, Safe Attachments and impersonation protection. Defender for Office 365 preset security policies.
Sensitivity labels and data loss prevention. Labels for confidential files, DLP rules for email and files.

Needs an add-on or upgrade

Risk-based sign-in blocking. Defender Suite for Business Premium.
Just-in-time admin access (PIM). Defender Suite for Business Premium.
Attack simulation training. Defender Suite for Business Premium.
One-year audit log retention. Purview Suite for Business Premium.

Whatever the licence

Give every admin a separate admin-only account, and use specific roles rather than Global Admin.
Back up Exchange, OneDrive, SharePoint and Teams separately. No plan here includes a backup you control.
Set SPF, DKIM and DMARC, and move DMARC to reject.

Review our tenant

Where the policy lives

A starting Conditional Access set.

Deploy each one in report-only mode, check what it would block, then enforce one at a time.

Policy	What it does	Licence needed
Require MFA for all users	Challenges every sign-in, with two break-glass accounts excluded	Entra ID P1
Block legacy authentication	Blocks POP, IMAP and SMTP AUTH, which cannot do MFA	Entra ID P1
Phishing-resistant MFA for admins	Passkeys or security keys for admin roles	Entra ID P1
Compliant device for admins	Admin sign-in only from managed, compliant devices	Entra ID P1 and Intune
Block countries you do not work in	Named locations for sign-in	Entra ID P1
Block high-risk sign-ins	Uses Identity Protection risk signals	Entra ID P2

Without Entra ID P1 (Business Basic and Standard), security defaults are the option: MFA for everyone and legacy sign-in blocked, but no exceptions or device rules.

Who holds the keys

Admin roles and break-glass accounts.

Separate admin accountsAdmins get a second account used only for admin work, never for email.
Specific roles, not Global AdminExchange, Intune or Security Admin for daily work. Few Global Admins.
Just-in-time accessWith Entra ID P2, roles are granted for a set time with approval.
Two break-glass accountsExcluded from Conditional Access, long random passwords and security keys kept safe, alerts on any sign-in.

The rest of the baseline

Devices, email and data.

Device complianceEncryption, a minimum OS version and active protection. Non-compliant devices blocked.
App protection on phonesWork data kept in managed apps on personal phones, wipeable on its own.
Endpoint detection and responseDefender for Business or Defender for Endpoint Plan 2 on every device.
Mail protectionDefender for Office 365 preset policies, impersonation protection for leaders and finance.
Email authenticationSPF, DKIM and DMARC, with DMARC moved to reject.
Labels and DLPSensitivity labels for confidential files, DLP rules for the obvious leaks first.

When something goes wrong

Audit logs and backup.

Item	What you get	What to do
Audit (Standard)	180 days of audit records, on by default	Confirm it is on; alert on new forwarding rules and role changes
Audit (Premium)	One year for Entra, Exchange, OneDrive and SharePoint	E5 or an add-on; or send logs to a SIEM
Mailbox auditing	On by default for newer tenants	Check older tenants
Backup	Not included in any of these plans	Separate backup of Exchange, OneDrive, SharePoint and Teams, restores tested

Our view

Most of the risk is closed by settings you already pay for.

On Business Premium, the baseline is almost entirely configuration: Conditional Access, Intune enrolment, Defender on every device, mail presets and labels. Those settings close the paths we see used in most account takeovers.

We roll it out slowly on purpose. Report-only first, one policy at a time, break-glass accounts tested. A baseline that locks out the finance team on payroll day is not a success.

The order

How we apply the baseline.

Step 1Assess the tenant
Licences, Conditional Access, admin roles, devices and logs. A gap report.
Step 2Identity first
Conditional Access in report-only, then enforced, break-glass in place.
Step 3Devices and mail
Intune, Defender, mail presets, DMARC.
Step 4Data and logs
Labels, DLP, alerts on risky changes.
Step 5Backup and review
Separate backup, quarterly baseline review.

Related guides

The baseline in depth. One area at a time.

Conditional Access, devices, admin access and mail.

Get help your way

Six ways to reach us. Pick whichever suits you.

Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.

Questions

What people ask about the Microsoft 365 baseline.

Is a new Microsoft 365 tenant secure by default?

Not fully. Microsoft now enforces MFA on its admin portals and security defaults cover the basics, but Conditional Access starts empty, devices are unmanaged and external sharing is open. The baseline is what you switch on, not what ships.

Is Business Premium enough, or do we need E5?

Business Premium covers the baseline for most businesses up to 300 users: Conditional Access, Intune, endpoint detection and response, Defender for Office 365 Plan 1, sensitivity labels and DLP. Add the Defender Suite for Business Premium if you want risk-based sign-in blocking, just-in-time admin access and attack simulation.

Does Microsoft 365 E3 include Defender for Office 365?

From 1 July 2026, Microsoft 365 E3 and Office 365 E3 include Defender for Office 365 Plan 1, which adds Safe Links, Safe Attachments and anti-phishing. E3 includes Defender for Endpoint Plan 1, which does not include endpoint detection and response.

Does Microsoft require MFA for admins now?

Yes. Microsoft enforces MFA for the Azure portal, Entra admin centre and Intune admin centre from October 2024, and the Microsoft 365 admin centre from February 2025. Command-line tools and APIs followed from 1 October 2025. That covers admin portals only, not every user.

How long are Microsoft 365 audit logs kept?

Audit (Standard) keeps records for 180 days. Audit (Premium), in E5 or an add-on, keeps Entra, Exchange, OneDrive and SharePoint records for one year by default. If you need longer, send logs to a SIEM or archive.

Is Microsoft 365 a backup?

No. Microsoft keeps the service running and holds deleted items for limited periods. It does not give you an independent copy you control. Back up Exchange, OneDrive, SharePoint and Teams separately and test restores.

Next step