Microsoft 365 Security Hardening: The 15-Point Checklist

Why M365 defaults are insecure

Microsoft ships M365 with permissive defaults to reduce onboarding friction. Legacy authentication protocols remain enabled, MFA is not enforced, and many security features in Business Premium are present but unconfigured. Most SME tenants are significantly below their licensed security capability.

The 15-point hardening checklist

1. Enable MFA for all users — Use Conditional Access policies, not the per-user MFA legacy portal
2. Block legacy authentication — Create a Conditional Access policy blocking Basic Auth. This eliminates a major attack vector for password spraying.
3. Enable Security Defaults (if not using Conditional Access) — Microsoft's minimum baseline for tenants not yet ready for full Conditional Access
4. Protect Global Admin accounts — Dedicated break-glass accounts, no email, FIDO2 key authentication only
5. Enable Unified Audit Log — Required for forensics and compliance. Enable in Security & Compliance Centre.
6. Configure DKIM and DMARC — Prevent email spoofing from your domain. DMARC policy should be p=reject once DKIM and SPF are validated.
7. Enable Microsoft Defender for Office 365 — Safe Links and Safe Attachments reduce phishing and malware delivery via email
8. Configure Intune device compliance policies — Require managed, compliant devices before granting M365 access
9. Deploy Windows Hello for Business — Phishing-resistant authentication for Windows endpoints
10. Enable Microsoft Secure Score — Baseline and track your security posture improvement
11. Restrict mail forwarding — Block automatic external forwarding rules. Business Email Compromise attackers routinely set these up.
12. Configure DLP policies — Prevent sensitive data (PII, financial data) leaving via email or Teams
13. Set retention policies — Ensure email and Teams data is retained for the required period and deleted after
14. Review and remove guest accounts — Audit Teams and SharePoint guest access quarterly
15. Enable Privileged Identity Management (PIM) — Just-in-time admin access rather than standing admin privileges (requires Entra ID P2)