Microsoft 365 Security Best Practices Every Business Should Follow

Microsoft 365 is the most targeted cloud platform in the world, and default settings out of the box leave most tenants meaningfully exposed. These are the controls and configurations that actually close those gaps.

Start With Your Tenant-Level Foundations

Every Microsoft 365 security posture starts at the tenant level, and the Microsoft Secure Score dashboard in the Defender portal gives you a numbered baseline to work from. A score below 50% is a warning sign. The most impactful foundational steps:

• Disable legacy authentication protocols. Basic Auth (used by older SMTP, IMAP, and POP clients) cannot process modern MFA challenges. Attackers use it to bypass MFA entirely. Block it with Conditional Access policies targeting legacy authentication client types.
• Enable Security Defaults or build Conditional Access policies. Security Defaults are appropriate for very small organizations. Any business with more than a handful of users should move to Conditional Access, which lets you enforce MFA based on user role, location, device compliance, and sign-in risk.
• Audit your Global Administrators. Microsoft recommends no more than two to four Global Admin accounts. Every excess Global Admin is an attack surface. Use the Principle of Least Privilege and assign scoped admin roles (Exchange Admin, SharePoint Admin, etc.) instead.
• Require phishing-resistant MFA. SMS-based one-time codes are vulnerable to SIM-swapping. Prefer Microsoft Authenticator with number matching, FIDO2 hardware keys (YubiKey, Feitian), or Windows Hello for Business.

Lock Down Email With SPF, DKIM, and DMARC

Email is the primary attack vector against Microsoft 365 tenants. The three DNS-based controls that authenticate your outbound mail and block spoofing of your domain are SPF, DKIM, and DMARC. All three must be configured to work correctly.

• SPF (Sender Policy Framework): a DNS TXT record that lists the IP addresses and services authorized to send mail as your domain. An overly permissive SPF record (using +all) is as dangerous as having none.
• DKIM (DomainKeys Identified Mail): a cryptographic signature attached to outgoing messages. Enable it in the Microsoft 365 Defender portal under Email and Collaboration > Policies > DomainKeys Identified Mail.
• DMARC (Domain-based Message Authentication, Reporting, and Conformance): a policy that tells receiving mail servers what to do when SPF or DKIM fails. Start at p=none to collect reports, move to p=quarantine, then p=reject once you have confirmed all legitimate senders are covered.

For auto dealerships, this matters beyond internal communication. Deal desks and F&I departments send contracts, financing documents, and wire instructions by email. A spoofed email from your domain instructing a buyer or lender to send funds to a different account can cost six figures. DMARC at p=reject prevents your domain from being spoofed in those scenarios.

Configure Microsoft Defender for Office 365 Correctly

Microsoft 365 Business Premium and many enterprise plans include Defender for Office 365 Plan 1 or Plan 2. The default policies are not the same as hardened policies. Key configurations to verify:

1. Navigate to Microsoft 365 Defender portal > Email and Collaboration > Policies and Rules > Threat Policies.
2. Enable Safe Links and make sure “Do not rewrite URLs” is unchecked for internal links. Safe Links rewrites URLs at click time to check them against Microsoft’s threat intelligence.
3. Enable Safe Attachments in Dynamic Delivery mode so messages are delivered while attachments are scanned in a sandbox.
4. Configure Anti-phishing policies with impersonation protection. Add your CEO, CFO, and any executive whose name could be spoofed in a BEC (business email compromise) attempt. Set the action on impersonated user detection to “Quarantine.”
5. Enable Zero-hour Auto Purge (ZAP), which retroactively removes messages already delivered to inboxes when a new threat signature is issued.

Protect Identities With Conditional Access and Entra ID

Microsoft Entra ID (formerly Azure Active Directory) is the identity backbone of every Microsoft 365 tenant. Identity attacks, particularly password spray and credential stuffing, are the most common path into a tenant.

• Enable Entra ID Protection (requires Entra ID P2 or Microsoft 365 E5) to get sign-in risk and user risk policies that automatically block or challenge suspicious logins.
• Configure a Conditional Access policy that blocks sign-ins from high-risk countries your business has no reason to receive logins from.
• Enforce device compliance so that only Intune-enrolled and compliant devices can access corporate data.
• Enable Privileged Identity Management (PIM) for admin roles so elevated permissions are granted just-in-time, not permanently.

Govern Data Access in SharePoint and OneDrive

Oversharing is endemic in Microsoft 365. A single “Anyone with the link” share setting can expose sensitive documents publicly.

• Set the default sharing level for SharePoint and OneDrive to “Specific people” or “Only people in your organization” at the tenant level.
• Use Microsoft Purview sensitivity labels to classify and protect documents containing PII, financial data, or health records so protections travel with the file.
• Run a SharePoint sharing report in the Microsoft 365 admin center to identify externally shared files and sites.
• If you use Microsoft Copilot for Microsoft 365, apply sensitivity labels before rollout. Copilot respects label-based permissions, which means a user can only surface in Copilot what they already have access to. Labeling before deploying Copilot prevents the AI from aggregating data across permissions boundaries.

Get Help From COMNEXIA

Correctly configuring a Microsoft 365 tenant requires coordinating identity policies, email authentication, endpoint management, and data governance at the same time. COMNEXIA has helped businesses in the greater Atlanta area and beyond do this as part of our managed IT services and cybersecurity practices for 35 years. If your Secure Score is below 70% or you have not audited your Conditional Access policies recently, call us at (877) 600-6550 or contact us to schedule a Microsoft 365 security review.