Best Practices for Microsoft 365 Security
A practical guide to the most impactful Microsoft 365 security configurations, based on TrustCyber's analysis of thousands of M365 tenant assessments.
Based on TrustCyber's analysis of Microsoft 365 tenant assessments, the following configurations have the highest impact on security posture. Implementing all of these best practices will typically raise your TrustCyber Risk Score by 20-35 points.
Identity & Access
Enforce MFA for All Users
Multi-factor authentication is the single most effective control for preventing account compromise. Enable MFA for all users, not just administrators. Use Microsoft Authenticator (push notifications) rather than SMS-based MFA, which is vulnerable to SIM-swapping attacks.
# Enable Security Defaults (includes MFA for all users)
# Run in Azure AD PowerShell
$params = @{
IsEnabled = $true
}
Update-MgPolicyIdentitySecurityDefaultEnforcementPolicy -BodyParameter $paramsBlock Legacy Authentication
Legacy authentication protocols (Basic Auth, SMTP Auth, POP3, IMAP) do not support MFA and are a common attack vector. Block legacy authentication using a Conditional Access policy or by enabling Security Defaults.
Email Security
Configure DMARC, DKIM, and SPF
DMARC (Domain-based Message Authentication, Reporting, and Conformance) prevents email spoofing by verifying that emails sent from your domain are authorized. Configure SPF and DKIM first, then set DMARC to p=quarantine or p=reject.
# SPF record (add to DNS as TXT record)
v=spf1 include:spf.protection.outlook.com -all
# DMARC record (add _dmarc.yourdomain.com as TXT record)
v=DMARC1; p=quarantine; rua=mailto:[email protected]; pct=100Data Governance
Enable Sensitivity Labels
Microsoft Purview sensitivity labels allow you to classify and protect documents and emails based on their sensitivity level. Deploy labels for at least four levels: Public, Internal, Confidential, and Highly Confidential. Apply automatic labeling policies to classify existing content.
Restrict External Sharing
Review and restrict external sharing settings in SharePoint and OneDrive. At minimum, disable anonymous link sharing (Anyone links) and require authentication for all external sharing. Consider restricting sharing to specific trusted domains only.
Endpoint Protection
Deploy Microsoft Defender for Endpoint
Microsoft Defender for Endpoint provides endpoint detection and response (EDR) capabilities for Windows, macOS, iOS, and Android devices. Enroll all managed devices in Defender for Endpoint and configure compliance policies in Microsoft Intune to block non-compliant devices from accessing Microsoft 365.