Microsoft 365 security: the 10 controls that are yours

• Four fronts belong to the business Information, identities, permissions and devices.
• The threat lives in the configuration Accounts without MFA, public links and active former employees cause more damage than any Microsoft failure.
• More than 99.9% The share of common account attacks that Microsoft says are stopped by MFA plus blocking legacy protocols.
• Ten quarterly checks Enough to cover the essentials.

Microsoft recognises three cloud service models. In SaaS, where Teams, SharePoint, OneDrive and Exchange Online live, it takes on almost the entire technical component. Even so, in every model, information and identities always belong to the customer.

Think of a top-tier office building: security at reception, CCTV, solid walls. That is Microsoft's role. Who gets a copy of the key to your floor and what is left lying on the desk is down to you. If the copies circulate, reception will never know.

In the past, reaching documents meant being inside the office network. Today all it takes is an email address and a password, on any computer connected to the internet.

Microsoft's security defaults, at no extra cost, force every user to register MFA (usually approving a prompt on their phone), require MFA for every administrator session and shut off legacy authentication protocols. Many tenants created from 22 October 2019 already have them switched on, though not all, and we often find organisations that disabled them because they were "a nuisance". The options are set out in our guide to MFA for businesses.

Three answers your team should be able to give within minutes:

1. How many global administrators are there? The right number is around two or three, never ten.
2. Do all accounts have MFA? Including shared mailboxes and service accounts, or else they are blocked from signing in.
3. Can people who left still get in? Accounts of anyone who left the company in the last year must be disabled.

Microsoft states that, out of the box, SharePoint and OneDrive allow sharing outside the organisation. Working with clients and partners this way is practical, provided it is a decision and not an accident.

The main danger lies in "Anyone" links: they open the document without authentication, and every forward carries it further.

• Anonymous links Switched off or given an expiry date.
• Guests Access only for those who sign in.
• Critical areas No external sharing for finance, HR and the board.
• Clean-up The list of external guests reviewed every quarter.

Email has its own risks: automatic forwarding to outside addresses, rules planted by attackers, domains that are easy to spoof. Details in where email protection fails in Microsoft 365.

Picture a laptop without disk encryption, with Outlook and OneDrive synced, left on the back seat of a taxi: it is a data leak with a battery. Microsoft does not manage it; the documentation places device protection on the customer's side. That requires an encrypted disk, an up-to-date system, managed antivirus and, ideally, policies that block non-compliant devices.

When it comes to information, the business has two choices to make: which information is confidential and who can see it; and how long it is kept. Backup is part of the second and, contrary to what many assume, it is not included. We explain why in Microsoft 365 backup. Some protections depend on the licence; see Microsoft 365 licensing and security for SMEs.

Around 50 mailboxes at the União das Freguesias de Massamá e Monte Abraão were moved by DataRoad to Exchange Online, keeping their history and folder structure. Once the move was complete, workstations and phones were reconfigured and validated, with email, calendar and contacts syncing without errors. The organisation also gained control, retention and auditing over its email. The full project is in the parish council case: migrating email to the cloud.

Management of Microsoft 365 for business, covering identities, MFA, sharing and devices, is included in the IT Unlimited plans. In IT Unlimited Essential, designed for organisations from 10 workstations, support is remote and by phone and covers almost all of these tasks, without site visits.

We analyse accounts, MFA, administrators, sharing, forwarding, devices and backups, and deliver fixes in order of risk. Request a no-commitment proposal.

More than 10 workstations · support contract · remote, on-site and phone support.

Call +351 211 459 950 * or write to sales@dataroad.pt.

*Call to a Portuguese landline.

• Shared responsibility in the cloud (Microsoft documentation)
• Entra ID security defaults (Microsoft documentation)
• External sharing in SharePoint and OneDrive (Microsoft documentation)