The Microsoft 365 Settings Most Phoenix Businesses Never Turned On

Microsoft 365 ships in a configuration designed to work immediately for the widest range of customers. That is a reasonable default for a software vendor and a poor security posture for your business. Most of the controls you need are already included in the license you own. They are simply off.

Here is the baseline we apply, in the order we apply it, with the practical warnings that come from having broken things by moving too fast.

Identity, first and always

Block legacy authentication. Older protocols bypass modern authentication entirely and will accept a username and password with no second factor. This is the single highest-value change on the list. Before you flip it, run the sign-in logs filtered to legacy auth for two weeks and find out what is still using it. It is usually a multifunction printer that scans to email and one accounting integration nobody remembered.

Enforce MFA for every account, including the service accounts and the break-glass administrator. Break-glass accounts need their own careful handling: excluded from conditional access, credentials in a physical safe, monitored for any use at all.

Reduce global administrators to two or three, and give day-to-day work a separate standard account. Administrative privilege attached to the account someone reads email with is how most tenant compromises escalate.

Restrict user consent to applications, so employees cannot grant a third-party tool standing access to their mailbox without review. Pair it with an admin consent request workflow so the answer is not simply no.

Email, where the money is lost

Publish SPF, DKIM, and DMARC for every domain you own, including the ones you do not send from. Unused domains are attractive precisely because nobody is watching them. Move DMARC to quarantine and then reject on a schedule rather than leaving it at none forever, which is monitoring without enforcement.

Disable automatic external forwarding at the tenant level. Setting a forwarding rule is the first thing an attacker does after taking a mailbox, because it survives a password reset and continues copying messages. If a department genuinely needs forwarding, allow it by exception with a documented owner.

Turn on external sender identification so a message from outside the organization is visibly marked. It is a small thing and it stops a meaningful share of impersonation attempts.

Enable anti-phishing impersonation protection for your executives and your domain. Configure the protected user list by hand, because the default list is empty.

Turn on mailbox auditing and confirm the retention period. If you have an incident, this is the evidence, and by default the retention may be shorter than the time it takes to notice a problem.

Files and sharing

Set the default sharing link to specific people rather than anyone with the link. Most accidental exposure is a link that was correct at the time and forwarded twice afterward.

Set expiration on anonymous links if you allow them at all. Thirty days is a reasonable starting point.

Restrict external sharing by domain where your business model allows it. A firm that only shares with a known set of clients and partners can allowlist them.

Turn on versioning and confirm the retention. Versioning is a meaningful part of ransomware recovery in cloud file storage and it is frequently set too low.

Devices and data

Set conditional access to require a compliant or hybrid-joined device for administrative operations, and for access to your most sensitive sites.

Configure retention policies for mail and files. Both directions matter: keeping what you must and disposing of what you should not still be holding.

Turn on unified audit logging if it is not already on, and check how long the logs are kept under your license. Extending retention is often cheap and always worth it before you need it.

What breaks and how to avoid it

The three changes that generate help desk tickets are blocking legacy auth, disabling external forwarding, and restricting sharing links. All three are survivable if you communicate first and stage the rollout, and all three cause a bad week if you do them on a Friday afternoon with no notice.

Our sequence is to run everything in report-only or audit mode for two weeks, publish a list of what will change and when, pilot with the IT-adjacent staff, then enforce by group over three weeks. Nothing on this list needs to be done in a single night.

Get the checklist

The M365 Hardening Checklist covers every setting above with the exact navigation path, the recommended value, the risk it addresses, the license tier required, and a column for your current state so you can measure the gap. It is written for a competent generalist, not a specialist.

We also run a free external scan of your domain's email authentication posture, which is the part of this that anyone on the internet can already see. Whatever we can check from outside, an attacker can check too.

Frequently asked questions

What is the most important Microsoft 365 security setting?

Blocking legacy authentication. Older protocols bypass modern authentication entirely and will accept a username and password with no second factor. Audit sign-in logs filtered to legacy auth for two weeks first, because it is usually a scan-to-email printer and one accounting integration still using it.

Why should external email forwarding be disabled?

Setting a forwarding rule is the first thing an attacker does after taking a mailbox, because it survives a password reset and continues copying messages. Disable it at the tenant level and allow exceptions only with a documented owner.

Which Microsoft 365 changes cause help desk tickets?

Three: blocking legacy authentication, disabling external forwarding, and restricting sharing links. All three are survivable with communication and staged rollout, and all three cause a bad week if done on a Friday afternoon with no notice.

Do I need a premium license to secure Microsoft 365?

Most of the baseline is available in the license small businesses already own. Some conditional access and identity protection features require a higher tier, but blocking legacy authentication, MFA, consent restrictions, forwarding controls, and sharing defaults are all available broadly.

Related reading

• Your AI Tools Have Logins Now, and Nobody Is Managing Them
• The Voice on the Phone Is Not Your CFO
• MFA Stopped Being Enough About Two Years Ago
• Anyone Can Send Email as Your Company Until You Fix This
• Your Weakest Security Control Belongs to Somebody Else
• Offboarding an Employee in 60 Minutes

Change one control with a rollback plan

I have seen sensible security settings create avoidable disruption because nobody checked legacy workflows or emergency access. Test with a small group, watch the sign-in evidence, document the exception, and keep a controlled rollback path.

Hardening should reduce exposure while preserving the work. A green configuration report means little if employees route around the control the next morning.