Microsoft 365 security spans identity, email, collaboration, endpoint access and information governance. Licensing determines which capabilities are available, so administrators should map controls to their actual subscriptions and validate current product documentation before deployment.
Secure tenant identity
Require MFA for users and stronger phishing-resistant methods for administrators where supported. Use Conditional Access to evaluate sign-in context and device compliance. Protect emergency access accounts, monitor privileged role assignments and remove legacy authentication paths where possible.
Exchange Online protection
Configure anti-phishing, anti-malware and spam policies appropriate to the organisation. Review accepted domains, connectors, transport rules, mailbox forwarding and external auto-forwarding. Enable DKIM and DMARC alignment for domains and investigate suspicious inbox rules or OAuth application access.
SharePoint and OneDrive governance
Set external sharing defaults according to data classification. Review anonymous links, guest access, site ownership and inactive sites. Use sensitivity labels and retention controls where licensed and appropriate. Monitor unusual downloads, mass sharing and access from unmanaged devices.
Endpoint and session controls
Use device management and compliance policies to establish a trusted endpoint baseline. Apply session controls and access restrictions for unmanaged devices where available. Ensure endpoint protection is reporting correctly and that mobile devices follow organisational security requirements.
Audit and incident readiness
Enable and retain audit data according to licensing and compliance needs. Establish alerting for risky sign-ins, privilege changes, suspicious mailbox activity and mass file operations. Document how to revoke sessions, disable accounts, preserve mailbox evidence and restore affected files.
Administration checklist
Review privileged roles monthly; test emergency access; check forwarding and mail flow rules; audit external sharing; verify MFA and device compliance; review app consent; and test recovery of important SharePoint and OneDrive content.
- Confirm the control has a named owner and documented business purpose.
- Validate configuration against current vendor guidance and organisational policy.
- Test expected and denied access paths; retain evidence of the result.
- Monitor exceptions, failures and configuration changes.
- Review the control after material infrastructure or business changes.
Secure Microsoft 365 by combining identity controls, mail protection, collaboration governance, endpoint compliance and audit-driven response.