Microsoft 365, email and cloud
Who do we call to tighten up our Microsoft 365 security settings?
Short answerUs, and a good deal of what you need is already included in your licensing and switched off.
The default configuration of a Microsoft 365 tenant is built to work for everyone, which means it is permissive. The settings that matter most are not on by default and cost nothing to enable.
What we look at first:
- Multi factor authentication with no exceptions, and legacy authentication protocols disabled so it cannot be bypassed. An exception for one executive or one service account is where attackers get in.
- External auto-forwarding blocked. This is how a compromised mailbox quietly exfiltrates mail, and it is a single tenant-wide setting.
- Who holds administrative rights. Frequently more people than anyone expects, sometimes including a previous IT provider.
- Audit logging on and retained, because without it you cannot answer what happened after an incident.
- Sharing defaults, particularly whether anyone can create links that work for anyone on the internet.
Most of this is included in licensing you already pay for. When we do find something genuinely worth buying, we will say so and say why, but the first pass is usually about turning on what you own.