Remote SupportOverview
A fresh Microsoft 365 tenant is not secure. Defaults are lenient, Conditional Access is empty, audit logging needs enabling, and Intune is inactive. This baseline covers what every business M365 tenant should have enabled.
Identity and Access
- MFA on every user account, no exceptions (except documented break-glass)
- Legacy authentication blocked (SMTP AUTH, POP, IMAP, basic auth)
- Self-service password reset enabled with secure registration
- Password hash sync or cloud-native identity (no on-prem password dependencies)
- Sign-in logs retained for 90+ days
- Risk-based sign-in policies (Entra ID P2) for medium and high risk
Conditional Access Policies
The backbone of modern M365 security. Recommended minimum set:
Require MFA for all users
Blanket policy, break-glass excluded.
Require MFA for admins (stronger)
Phishing-resistant where possible.
Block legacy authentication
Basic auth, SMTP AUTH, POP, IMAP.
Require compliant or hybrid-joined device
Start in report-only, then enforce.
Block high-risk sign-ins
Entra ID Protection with P2.
Country blocks
Block countries you never sign in from. AU, NZ, common travel destinations allowed.
Session controls for SharePoint / OneDrive
Unmanaged devices = limited access, no download.
Require app protection for mobile
Intune App Protection policies enforced.
Break-Glass Accounts
Two Global Admin accounts excluded from all Conditional Access and MFA policies. Long random passwords. FIDO2 keys stored physically in a safe. Used only when everything else is broken. Monitored with alerting on any sign-in.
Admin Roles
- No more than 2-4 Global Admins (plus break-glass)
- Use specific role assignments (Exchange Admin, Intune Admin) instead of Global Admin
- Privileged Identity Management (PIM) for just-in-time elevation
- Separate admin accounts from daily-use accounts
- Admins use FIDO2 or passkeys for MFA
- Quarterly admin role review
Intune and Device Compliance
- Compliance policy: encryption, patching, AV active, no jailbreak
- Configuration profiles: security baselines, Edge hardening, Office settings
- App Protection Policies for mobile (even on BYOD)
- Autopilot for new Windows deployments
- Mac, iOS, Android enrolment for managed devices
- See the Intune detailed look for detail
Defender and Data Protection
- Defender for Office 365 Plan 1 minimum (Plan 2 for larger orgs)
- Safe Links and Safe Attachments enabled
- Anti-phishing and impersonation protection on executives
- Defender for Endpoint or Defender for Business on every device
- Sensitivity labels for confidential documents
- DLP policies for obvious exfil paths (external email, USB, public cloud)
- Email authentication: SPF, DKIM, DMARC at p=reject (see Email Auth Guide)
Audit and Logging
- Unified audit logging enabled (90 days default, 1 year with E5)
- Mailbox audit logging on by default
- Alerts on suspicious inbox rules, impossible travel, privilege escalation
- SIEM or SOAR integration for enterprise tenants
- Monthly audit log review even without SIEM
Backup
Microsoft is not a backup. See the Backup and DR Guide. At minimum: Veeam Backup for M365, Afi, or Datto SaaS Protection with 7+ year retention for compliance.
Common Mistakes
No Conditional Access at all
Default policies enforce little. CA is where security actually lives.
Too many Global Admins
Every Global Admin is a major target. 2-4 max plus break-glass.
No audit log retention plan
Incident investigation needs 6-12 months of logs. Plan E5 or SIEM accordingly.
External sharing wide open
Default "anyone with the link" should be disabled or restricted.
No mobile app protection
Staff use personal phones for mail. Without App Protection, work data lives on unmanaged devices forever.
Secure Your Microsoft 365 Tenant
We apply full security baselines to M365 tenants including Conditional Access, Intune, Defender for Office 365, and backup with ongoing managed services.