A new Microsoft 365 tenant is not built to be secure. It is built to work. External sharing is open, legacy protocols are available, mail filtering sits at defaults, and every licensed user can create a Teams site that nobody will ever look at again. All of that is fixable, and most of it is free.
This is the order I work in. Identity first, because that is where the attacks land, then email, then devices, then data. Each control lists the licence it needs, so you can see what you already own.
Licence: any plan
Microsoft research published in 2023 found that MFA blocked more than 99.9 per cent of automated account compromise attempts, and reduced the chance of compromise by over 98 per cent even where credentials had already been stolen. Nothing else you do this month will move the needle as far.
Microsoft has also stopped treating it as optional. Mandatory MFA for the Microsoft 365 admin centre took full effect on 9 February 2026, with sign-in blocked without it. The Azure portal has required MFA since March 2025, and Azure CLI, PowerShell and API write operations since October 2025.
The accounts people forget: service accounts, shared mailbox owners, the external bookkeeper, the account the CCTV system emails from, and the director who insisted on an exemption two years ago.
Licence: any plan, best done with conditional access on Premium
POP, IMAP and SMTP AUTH predate modern authentication and do not support MFA. While they are enabled, an attacker with a valid password walks straight past every policy you wrote. This is consistently the largest single gap I find in inherited tenants. Full detail in disabling legacy authentication in Microsoft 365.
Check what is still using it before you switch it off. Sign-in logs will show you, and it is usually one multifunction printer that scans to email.
Licence: any plan
Licence: Entra ID P1, included in Business Premium
If you have Business Premium and you are still relying on Security Defaults, you are paying for a control you have not switched on. Turn Security Defaults off and build policies instead. A baseline set for a small business:
Deploy everything in report-only mode first and read the impact for a week. See setting up conditional access policies.
Licence: Entra ID P1
This is a security control as much as a helpdesk saving. A password reset process that runs through a receptionist and a phone call is a social engineering target. Two registered methods, no security questions.
Licence: Defender for Office 365 P1, included in Business Premium
Default policies catch commodity spam. They do not catch a targeted message claiming to be from your managing director asking the bookkeeper to change bank details. Configure:
Licence: Defender for Office 365 P1
Safe Links rewrites URLs and checks them at click time, which matters because a link that was clean at delivery is often weaponised hours later. Enable it for Teams, SharePoint and OneDrive as well as Outlook, not just email. Safe Attachments detonates attachments in a sandbox before delivery.
Licence: any plan with Exchange Online
Licence: any plan
This protects other people from being phished using your domain, and it protects your deliverability. DKIM signing is off by default for custom domains, so it is missing more often than not. Start DMARC at p=none with a reporting address, read the reports for a few weeks, then tighten to quarantine and reject. See the full DMARC, DKIM and SPF setup.
Licence: Intune and Defender for Business, included in Business Premium
Licence: any plan
Licence: third party, budget separately
Microsoft operates a shared responsibility model. They keep the platform running, you are responsible for your data in it. Retention and versioning give you a limited window, not a backup with independent retention.
The specific failure mode worth explaining to a business owner: a file encrypted by ransomware on a synced laptop replicates that encrypted state to OneDrive or SharePoint within seconds. Sync is not backup. See why cloud sync is not a backup.
And whatever you buy, restore something from it. An untested backup is a hypothesis, not a control.
| Week | Work | Disruption |
|---|---|---|
| 1 | MFA rollout, block legacy auth, cut admin count, create break-glass accounts | One staff comms email and a few enrolment questions |
| 2 | Conditional access in report-only, anti-phishing and Safe Links policies, external tagging, block auto-forwarding | Minimal, mostly invisible |
| 3 | Conditional access enforced, DKIM and DMARC at monitoring, sharing defaults tightened, guest review | Some sign-in prompts on unmanaged devices |
| 4 | Intune enrolment, BitLocker, Defender, update rings, LAPS, backup deployed and a restore tested | One reboot per device |
If you are certifying, the April 2026 scheme update matters. Version 3.3 of the Requirements for IT Infrastructure and the Danzell question set introduced two automatic failure conditions: no MFA on a cloud service that offers it, and high-risk security updates applied slower than 14 days. Cost is explicitly no longer an accepted reason for not enabling MFA, even where it sits behind a higher licence tier. Cloud services also got a formal definition and can never be excluded from scope.
In practice, controls 1, 2, 3 and 10 above cover most of what an assessor will fail you on. The five technical control families themselves are unchanged. What changed is how strictly they are marked.
Related: Microsoft 365 security health check, zero trust for small businesses, and what to do if an M365 account is compromised.
Our Security Health Check reviews nine areas and gives you a plain English traffic light report for a fixed price.
See the Security Health CheckMore in this series: all Klariq guides.