How to Secure Microsoft 365 for Your Business

1. Enable Multi-Factor Authentication (MFA)

MFA is the single most effective security measure. It blocks 99.9% of account compromise attacks.

2. Enable Security Defaults (Free)

If you have Business Basic or Standard, enable Security Defaults:

Azure Portal → Azure Active Directory → Properties

Manage Security defaults → Enable

3. Block Legacy Authentication

Older email protocols (POP, IMAP, SMTP) bypass MFA. Block them:

Conditional Access → New policy → Block legacy authentication

Or enable Security Defaults (does this automatically)

Microsoft Defender for Business

Endpoint protection that replaces your antivirus:

Go to security.microsoft.com

Endpoints → Device inventory

Onboard all company devices

Configure attack surface reduction rules

Safe Links (Email)

Scans URLs in emails in real-time:

Security portal → Policies → Threat policies

Safe Links → Create policy for all users

Enable "Track user clicks" and "Do not allow users to click through"

Safe Attachments (Email)

Detonates attachments in a sandbox before delivery:

Threat policies → Safe Attachments

Enable for all users

Choose "Dynamic Delivery" (delivers email immediately, scans attachment)

Anti-Phishing

Protects against impersonation attacks:

Threat policies → Anti-phishing

Enable impersonation protection for executives

Enable mailbox intelligence

1. Require MFA for all users

Users: All users (exclude break-glass admin account)

Cloud apps: All cloud apps

Grant: Require MFA

2. Block access from risky locations

Users: All users

Conditions: Locations → Exclude trusted locations

Grant: Block (for high-risk countries you don't do business with)

3. Require compliant devices for sensitive apps

Users: All users

Cloud apps: SharePoint, Exchange

Grant: Require device to be marked as compliant

4. Block risky sign-ins automatically

Users: All users

Conditions: Sign-in risk → Medium and above

Grant: Block or require MFA + password change

5. Require app protection for mobile

Users: All users

Cloud apps: Office 365

Conditions: Device platforms → iOS, Android

Grant: Require app protection policy

Data Loss Prevention (DLP)

Prevent sensitive data from leaving your organization:

Compliance portal → Data loss prevention

Create policies for credit cards, SINs, health info

Apply to Exchange, SharePoint, OneDrive, Teams

Sensitivity Labels

Classify and protect documents:

Compliance portal → Information protection

Create labels: Public, Internal, Confidential, Highly Confidential

Configure encryption and access restrictions

Train users to apply labels

Retention Policies

Keep data for compliance, delete when no longer needed:

Compliance portal → Data lifecycle management

Set retention periods by content type

Configure for email, SharePoint, Teams

Audit Logging

Track what's happening in your environment:

Compliance portal → Audit

Ensure unified audit logging is enabled

Set up alerts for suspicious activities

Security Awareness Training

Your employees are your biggest vulnerability AND your first line of defense:

Use Attack Simulation Training (included in Business Premium)

Run monthly phishing simulations

Provide training on identifying suspicious emails

Create a culture where reporting is encouraged, not punished

Ongoing Security Hygiene

Review sign-in logs weekly for anomalies

Check Secure Score monthly and improve

Review external sharing settings quarterly

Audit admin accounts quarterly

Test backup restoration annually

Microsoft Secure Score

Track your security posture:

security.microsoft.com → Secure Score

Aim for 80%+ (most SMBs start at 30-40%)

Work through recommended actions

Compare against similar organizations