Here’s the uncomfortable truth about a fresh Microsoft 365 tenant: it’s configured to be easy to adopt, not hard to attack. The security capabilities are genuinely excellent — much of what enterprises pay dearly for is sitting right there — but a meaningful share ships turned off, dialed down, or left at defaults that favor convenience. Most tenants we review were set up in a hurry during a migration years ago and never revisited. This is the revisit: the eight settings that matter most, in the order worth tackling them.
1. MFA — enforced, not available. The distinction that matters: MFA offered protects volunteers; MFA enforced protects the company. Security defaults enforce it bluntly for small tenants; Conditional Access (Business Premium) enforces it intelligently — and either way, the audit question is the exception list: which accounts skip it, and why does each still exist? Attackers find the exceptions.
2. Legacy authentication — blocked. The quiet giant. Older protocols (IMAP, POP, SMTP basic auth) predate MFA and can’t carry it — meaning any legacy path left open is a side door where password-only sign-in still works, MFA or not. Attackers specifically hunt these. Microsoft has been closing them by default, but tenants with history often carry exceptions; verify yours is fully blocked, then solve the one ancient scanner that squawks, rather than the reverse.
3. Mailbox auditing and unified audit logging — on, with retention checked. Not a defense — the flight recorder. When an account is compromised, these logs are how anyone determines what was read, sent, and taken — which decides your notification obligations. Mostly on by default now, but retention windows are short at lower license tiers; know yours before the day you’re counting backwards from discovery.
4. External forwarding — disabled by default. An auto-forward rule to an outside address is the classic first move inside a compromised mailbox — a silent tap on everything that arrives. One policy blocks it tenant-wide; legitimate needs become documented exceptions. While you’re there, alerting on new rule creation turns the attacker’s favorite move into your earliest warning.
5. App consent — admin approval required. Users can, by default, grant third-party apps standing access to mail and files — the consent-phishing door, and its own article. One setting routes those grants through approval; an hour’s audit revokes the ones already accumulated.
6. External sharing — deliberate, not default. SharePoint and OneDrive sharing scopes (“anyone with the link…”) default toward frictionless. Right-size them: links default to internal, “anyone” links expire, and sensitive libraries restrict external sharing entirely — the Restricted-data map says which. The goal isn’t blocking collaboration; it’s making “shared to the whole internet” a choice someone consciously makes.
7. The email protection layer — actually configured. Anti-phishing impersonation protection (flagging mail that resembles your executives and domains — the impersonation counter), Safe Links and Safe Attachments if you’re licensed for Defender for Office 365, and SPF/DKIM/DMARC on your own domain. Half-configured is the norm here; the layered-email article walks the full stack.
8. Admin accounts — few, separated, watched. The privileged-access rules, applied to the tenant: global admins countable on one hand, no mailboxes on admin accounts, MFA without exception, and sign-in alerts on all of them. The tenant’s admin roles are the keys to literally everything above — they get hardened first and audited twice.
How to actually do this
Three practical notes. Microsoft Secure Score (built into the admin center) is a decent map — a ranked list of exactly these gaps for your tenant; imperfect, occasionally pushy about licenses, but a fine starting inventory. Change with care: several of these settings can break legitimate workflows (the old scanner, the app someone relies on), so they deserve change-management treatment — announce, stage, keep a rollback — rather than a heroic Friday sweep. And make it a rhythm: Microsoft ships new capabilities and shifts defaults continuously, so a tenant review belongs on the annual calendar — it’s a standing item in our managed relationships for exactly that reason, and it’s also most of the evidence the insurance application asks you to attest to.
The bottom line
Your Microsoft 365 tenant almost certainly contains more security than you’ve turned on. Eight settings — enforced MFA, blocked legacy auth, audit logging, forwarding rules, app consent, sharing scopes, the mail-protection layer, hardened admins — close the gaps attackers actually use, mostly with licenses you already pay for. The capability was never the missing piece. The review was.