// Guide · Updated November 2026
Microsoft 365 Security Explained: Best Practices, Features and Assessment Checklist
Microsoft 365 is where most businesses keep their email, documents and conversations, so it is also where most attacks start. This guide explains how Microsoft 365 security works, which built-in features matter most, the best practices we apply for clients, and a checklist you can use to assess your own tenant.
The shared responsibility model
Microsoft is responsible for the security of the cloud: its data centres, networks and the Microsoft 365 services themselves. You are responsible for security in the cloud: who your users are, how they sign in, which devices they use, what they can share and who can change settings.
Default settings favour ease of use. A new tenant may allow legacy authentication protocols that bypass MFA, let users consent to third-party apps, and allow anonymous sharing links. None of these is a flaw in Microsoft 365; they are choices each organisation needs to make deliberately.
Built-in Microsoft 365 security features
Which features you have depends on your licence. Microsoft 365 Business Premium, E3 and E5 include progressively more. These are the ones that matter most:
Microsoft Entra ID
Identity for every user and app: MFA, Conditional Access (P1), and risk-based sign-in and user risk policies with Identity Protection (P2). Privileged Identity Management (P2) gives admins just-in-time access.
Defender for Office 365
Protection for email and collaboration: Safe Links rewrites and checks URLs at click time, Safe Attachments detonates files in a sandbox, and anti-phishing policies catch impersonation of your executives and domains.
Microsoft Intune
Device management for Windows, macOS, iOS and Android: compliance policies, encryption, app protection for personal devices, and the device signal Conditional Access uses.
Defender for Endpoint / Defender for Business
Endpoint detection and response on your laptops and servers, with automated investigation and the ability to isolate a device.
Microsoft Purview
Sensitivity labels, data loss prevention, retention, eDiscovery and insider risk tools to protect and govern your data.
Microsoft Secure Score
A score and a list of recommended actions in the Defender portal, showing how your configuration compares with Microsoft’s guidance.
Unified audit log
A record of user and admin activity across Exchange, SharePoint, OneDrive, Teams and Entra ID, needed for any investigation.
12 Microsoft 365 security best practices
- Require MFA for every account. Prefer the Microsoft Authenticator app with number matching, or FIDO2 security keys and passkeys for admins. Avoid SMS where you can.
- Block legacy authentication. Older protocols such as POP, IMAP and basic SMTP authentication can’t do MFA, so attackers use them to bypass it.
- Use Conditional Access, not just security defaults. Build policies for admins, risky sign-ins, unmanaged devices and locations, and test them in report-only mode first.
- Keep admin accounts few and separate. Two to four Global Administrators at most, cloud-only admin accounts without a mailbox, and least-privilege roles for everyone else. Add two break-glass accounts, excluded from Conditional Access and monitored.
- Protect email properly. Turn on Safe Links, Safe Attachments and impersonation protection, and publish SPF, DKIM and DMARC for every domain you send from.
- Control external sharing. Set SharePoint and OneDrive sharing to “new and existing guests” or stricter, make “specific people” the default link type, and set expiry on guest access.
- Stop users consenting to risky apps. Require admin approval for third-party app consent and review existing OAuth app permissions regularly.
- Manage and secure devices. Enrol company devices in Intune, require encryption and a supported OS, and use app protection policies for personal phones.
- Label and protect sensitive data. Start with a few sensitivity labels (Public, Internal, Confidential) and add DLP rules for the data types you care about most, such as Emirates ID or card numbers.
- Turn on and use audit logging. Make sure the unified audit log is enabled and mailbox auditing is on, and decide who reviews alerts.
- Train your users. Short, regular guidance on phishing and MFA fatigue works better than an annual course. Attack simulation training is included in Defender for Office 365 Plan 2.
- Check continuously, not yearly. Settings drift every time someone adds a user, an app or an exception. Daily checks catch problems while they are still small.
Microsoft 365 security assessment checklist
Use these questions to assess your own tenant. If you can’t answer one confidently, treat it as a finding.
Identity and access
- Does every user, including admins and service accounts, have MFA?
- Is legacy authentication blocked tenant-wide?
- How many Global Administrators do you have, and are they cloud-only accounts?
- Do Conditional Access policies cover all users and all cloud apps?
- Are inactive and guest accounts reviewed and removed?
Email and collaboration
- Are Safe Links, Safe Attachments and anti-phishing policies on for all users?
- Do all your domains have SPF, DKIM and an enforced DMARC policy?
- Is automatic forwarding to external addresses blocked?
- What are your SharePoint, OneDrive and Teams external sharing settings?
Apps and integrations
- Can users consent to third-party apps on their own?
- Which apps have high-privilege permissions such as Mail.ReadWrite or Files.ReadWrite.All?
- Do app registrations have expired or long-lived secrets?
Devices
- Are company devices enrolled in Intune and compliant?
- Is disk encryption required?
- Can unmanaged personal devices download company data?
Data and compliance
- Are sensitivity labels published and used?
- Do DLP policies cover email, SharePoint, OneDrive and Teams?
- Are retention policies in place for the records you must keep?
Monitoring and response
- Is the unified audit log on, and who reviews alerts?
- Do you know your current Secure Score and what changed recently?
- Do you have written steps for a compromised account?
How to run a Microsoft 365 security assessment
1. Start with Secure Score. In the Microsoft Defender portal, Secure Score lists recommended actions with their impact. It is free and quick, but it only covers Microsoft’s own recommendations and doesn’t show change over time in detail.
2. Compare against the CIS benchmark. The CIS Microsoft 365 Foundations Benchmark is the most widely used independent baseline. Many of its recommendations can be checked from tenant configuration; others need a manual review.
3. Make it continuous. A one-off assessment is out of date within weeks. Automated daily checks show exactly what changed and when, which also gives you evidence for audits.
Mito by Virtual Petals
See your Microsoft 365 security every day, not once a year
Mito is our own Microsoft 365 security assessment service. It runs read-only checks against your tenant every day across Entra ID, Exchange Online, SharePoint, Teams, Defender and Intune, ranks what it finds by severity, and shows what changed since the last run. Results map to the CIS Microsoft 365 Foundations Benchmark, ISO/IEC 27001:2022 Annex A and the UAE IA Regulation, so you have evidence to work from. It uses read-only access that you can revoke at any time.
Signs of a compromised Microsoft 365 account, and what to do
Watch for sign-ins from unexpected countries, MFA prompts the user didn’t trigger, new inbox rules that forward or delete mail, sent items the user doesn’t recognise, and new app consents. If you see these:
- Reset the password and revoke all sessions for the user in Entra ID.
- Check and remove suspicious inbox rules, forwarding and app consents.
- Review sign-in logs and the unified audit log to see what was accessed.
- Re-register MFA methods and check for new devices registered to the user.
- Warn contacts if phishing was sent from the account, and fix the gap that let it in.
If you need help with a suspected compromise, contact us or call +971 2 409 3026.
Microsoft 365 security FAQ
What is Microsoft 365 security?
Microsoft 365 security is the set of settings, policies and tools that protect your Microsoft 365 tenant: user identities, email, files, Teams and the devices that connect to them. Microsoft provides the tools; your organisation decides how they are configured.
What are the most important Microsoft 365 security settings?
Start with MFA for every account, blocking legacy authentication, a small number of protected admin accounts, Conditional Access, anti-phishing and Safe Links in Defender for Office 365, controlled external sharing, and audit logging that is switched on and reviewed.
How do I check my Microsoft 365 security posture?
Microsoft Secure Score in the Defender portal is a good first view. For a fuller picture, assess your tenant against the CIS Microsoft 365 Foundations Benchmark, either manually, with free community tools, or with a service such as Mito that runs the checks every day.
Does Microsoft 365 include Zero Trust capabilities?
Yes. Entra ID Conditional Access, device compliance from Intune, risk-based sign-in policies in Entra ID P2, and sensitivity labels together let you verify every sign-in and limit access to what each user needs, which is the core of Zero Trust.
How often should we review Microsoft 365 security?
Settings drift as admins add users, apps and exceptions. A full review once or twice a year is the minimum; continuous checks catch risky changes within a day instead of months later.
Related: Microsoft 365 security services in the UAE · Microsoft 365 migration · Security services
Talk to us
Tell us about your Microsoft 365 or Azure environment and what you want to achieve. We reply within 24 hours on business days.
Phone: +971 2 409 3026
Email: contactus@virtualpetals.com
Office: Level 36, Etihad Towers 3, Abu Dhabi, UAE
Branch: Chennai, India