Microsoft 365 sits at the heart of most organisations: email, files, chat and identity. It has powerful security features, but many of them need to be switched on or tuned. These are the settings we see missed most often when we review tenants.
1. Multi-factor authentication for everyone
Multi-factor authentication (MFA) stops most attacks that rely on stolen passwords. Make sure it’s enforced for every user, not just administrators, and that exceptions are rare, documented and reviewed. Where your licensing allows, conditional access policies give you finer control.
2. Legacy authentication still enabled
Older authentication protocols don’t support MFA, so attackers use them to bypass it. Check whether legacy authentication is still allowed anywhere in your tenant, and block it.
3. Too many global administrators
Global admin accounts are the keys to the kingdom. Keep them to a minimum, use separate admin accounts rather than everyday ones, protect them with strong MFA and review who holds them regularly.
4. Open external sharing
SharePoint and OneDrive make sharing easy, sometimes too easy. Review whether “anyone with the link” sharing is allowed, how long links last and which sites can share externally.
5. Automatic forwarding to external addresses
Attackers who compromise a mailbox often set up rules to forward email outside the organisation quietly. Block automatic external forwarding unless there’s a genuine business need, and alert on new forwarding rules.
6. Audit logging not reviewed
You can’t investigate what you didn’t record. Make sure audit logging is enabled and that someone, or something, is actually reviewing it.
7. Users approving risky apps
If users can grant third-party apps access to their data, a convincing consent request can hand an attacker persistent access without a password. Restrict user consent and set up an approval process.
8. Guest access in Teams
Guest access is useful for working with partners, but review who can invite guests, what guests can see and when inactive guests are removed.
9. Email authentication
Publish SPF, DKIM and DMARC records for your domains, and work towards a DMARC policy that tells receiving servers to reject spoofed email.
10. Assuming Microsoft 365 is your backup
Microsoft keeps the service running, but retention settings aren’t the same as a backup you control. Make sure you can recover data if it’s deleted, corrupted or encrypted.
How confident are you in your settings?
Every tenant is different, and settings drift over time. An independent configuration review checks your Microsoft 365 set-up against good practice and gives you a prioritised list of fixes. You can scope one in minutes with the AskQ Scope Builder.
How to prioritise
Not every change needs to happen at once. A sensible order is:
- Identity first: enforce MFA, block legacy authentication and lock down admin accounts.
- Email next: stop automatic external forwarding and publish SPF, DKIM and DMARC.
- Data and sharing: tighten external sharing and guest access.
- Visibility: make sure audit logs are captured and reviewed.
- Resilience: confirm you can recover data if the worst happens.
Test changes with a small group first, communicate with users and document what you’ve changed and why.
Want a second pair of eyes on your tenant?
Talk to our team about a Microsoft 365 configuration review.
