Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
The Entra ID, Exchange Online, and sharing-configuration changes that close the most common gaps in a default Microsoft 365 tenant.
Most Microsoft 365 tenants are configured once, during onboarding, for convenience, and rarely revisited as the organization and its threat exposure grow. The good news is that most of the highest-impact hardening steps don't require new licensing, just turning on and correctly configuring controls that are often already available.
The single highest-value control on this list. Conditional Access policies should require multi-factor authentication for all users, with no standing exemptions, legacy break-glass accounts included, provided they're monitored separately. Privileged roles (Global Admin, Exchange Admin, and similar) deserve enforcement that can't be silently disabled by another admin without an audit trail.
Having a Conditional Access policy isn't the same as having adequate coverage, a common gap is a policy that covers the web login flow but doesn't apply to legacy authentication protocols (IMAP, POP, older Office clients) that bypass modern MFA prompts entirely. Blocking legacy authentication outright closes a path that's disproportionately targeted precisely because it's often overlooked.
Global Administrator, Exchange Administrator, SharePoint Administrator, and similar roles accumulate members over time, someone needed temporary access for a project, and the assignment outlived the project. Entra ID's Privileged Identity Management (PIM), where licensed, turns standing admin access into just-in-time, time-bound, and audited access instead.
Auto-forwarding rules that silently redirect a mailbox's incoming mail to an external address are a common persistence technique after an account compromise, and they're easy to set up quietly and easy to miss without specifically looking. A tenant-wide policy blocking automatic external forwarding, combined with periodic review of existing rules, closes an avenue that's otherwise invisible until someone notices mail going missing.
Anti-phishing controls only work if the domain's own email authentication is airtight, a domain without an enforced DMARC policy (p=reject or at minimum p=quarantine) is far easier to spoof convincingly, undermining every other anti-phishing control layered on top. Our free Domain Footprint Analyzer checks exactly this, passively, for any domain.
Default sharing settings are often more permissive than intended, "Anyone with the link" sharing enabled tenant-wide, rather than scoped to specific trusted domains or requiring explicit invitation. This is one of the more common ways sensitive files end up externally accessible, not through exploitation, but through a default nobody adjusted.
Secure Score gives a baseline, prioritized view of tenant configuration against Microsoft's own recommendations, but its value depends on someone actually reviewing and acting on it periodically, not just checking that it exists. Treat it as a starting checklist, not a certification.
Microsoft 365's native retention isn't a substitute for backup in every scenario, retention policies can have gaps around permanently deleted items, ransomware-encrypted files that get retained in their encrypted state, or accounts that get deleted before data is exported. Confirm what's actually covered, rather than assuming "it's in the cloud" means "it's backed up."
If you only do one thing from this list, enforce MFA with no exemptions and block legacy authentication, together they close the two most commonly exploited paths into a tenant. For a full review across identity, email, storage, and backup configuration, see our Microsoft 365 Assessment service. Two specific attack techniques legacy-auth and weak-MFA gaps enable directly: see our pieces on business email compromise and password spraying.
Tell us about your environment and goals, we'll help you scope the right engagement.