Microsoft 365 security depends on which products you own, the accounts and workloads in scope, and how controls are operated. Do not assume Conditional Access, advanced identity protection, Defender features, PIM, or DLP are included in every licensing tier. Start with an entitlement and coverage inventory, then prioritize the gaps that expose important business data.
1. Treat Different Identities Differently
- Human users: protect sign-ins with appropriate MFA, preferably phishing-resistant methods where supported. Review registration, supported clients, and approved exceptions.
- Shared mailboxes: block direct sign-in; protect the named users who access them through delegation. Do not treat a shared mailbox as a person who can complete MFA.
- Workload identities: inventory applications, service principals, secrets, certificates, and owners. Use appropriately scoped non-human authentication and credential lifecycle controls instead of assuming interactive MFA applies.
- Emergency access: maintain tested cloud-only recovery accounts with strong authentication and monitoring. Avoid dependency on the normal access path they must recover, and evaluate exclusions from policies that could block emergency access.
See Microsoft’s shared-mailbox guidance and emergency-access recommendations. Do not remove protection to simplify administration.
2. Confirm Licensing Before Designing Enforcement
Scroll horizontally to compare all columns.
| Control | Verify first | Operating evidence |
|---|---|---|
| Conditional Access | Appropriate Microsoft Entra ID P1 entitlement for users in scope | Assignments, sign-in evaluation, exceptions, recovery test |
| User and sign-in risk policies | Entra ID Protection capabilities associated with P2 or an eligible bundle | Risk detection and approved remediation process |
| Privileged Identity Management | Applicable P2 or Identity Governance entitlement | Eligible roles, activation requirements, access review |
| Defender for Office 365 | Plan and feature coverage; do not assume every investigation or training feature is included | Mail policy tests and an alert owner |
| Purview labeling and DLP | Workload, users, feature tier, and any device or advanced capabilities | Approved handling rules, pilot results, exception review |
Use Microsoft Entra licensing and your purchased product terms during scoping. Security defaults can provide a baseline where appropriate. A move to custom Conditional Access needs a controlled transition: leaving new policies only in report-only mode after disabling the old protection can create a gap.
3. Evaluate the Existing Tenant Before Changing Access
Inventory enforced policies, exclusions, device compliance, service dependencies, and administrative roles. Test representative allowed and denied scenarios, including remote staff, mobile devices, guests, and recovery accounts. Conditional Access report-only helps evaluate a policy but does not suspend other enforced policies or make device configuration changes observational.
Agree a pilot group, success criteria, communications, exception expiry, and rollback. Check new compliance assignments against existing access rules before they change device status. Expand only after access and recovery tests pass.
4. Assign Operators for Email and Data Protection
Deploy supported email protections against phishing, malicious links, and attachments within the purchased plan. Name the person who reviews alerts and handles false positives. For data controls, identify the business-approved classification, repository owner, permitted sharing, retention decisions, and evidence required before enforcement.
DLP and sensitivity labels are controls, not a certification or guarantee against disclosure. Start with approved high-risk workloads, review results, and expand under change control. Do not collect unrestricted sensitive content in routine reports.
5. Use a Review Register Instead of a Universal 30-Day Promise
Scroll horizontally to compare all columns.
| Decision | Owner | Acceptance evidence |
|---|---|---|
| Priority and risk acceptance | Business sponsor | Approved scope and documented exceptions |
| Access and endpoint changes | Identity and endpoint operators | Pilot sign-ins, assignments, and recovery test |
| Data handling | Data owner with relevant advisers | Approved sharing and retention rules |
| Ongoing protection | Named service owner | Coverage gaps, unresolved actions, review date |
Secure Score can help organize improvement work, but a higher score is not proof that an environment is secure or compliant. Pair it with coverage, exceptions, incident lessons, and tested recovery. Timing depends on readiness and scope rather than a fixed four-week hardening promise.
Use the complete baseline checklist for a working tool, and Microsoft 365 Governance for recurring operating ownership.