🔐 Microsoft 365
Is your Microsoft 365 really locked down? The security checklist
The settings worth checking to harden your Microsoft 365 tenant. By the Foxcomm team, October 7, 2026.
⚡ The 30-second version
Most attacks on Microsoft 365 begin with a stolen password, so identity settings come first.
• Require multi-factor authentication for every user, not only administrators
• Block legacy authentication protocols
• Block automatic forwarding of mail to external addresses
🪪 Start with identity
Most attacks on Microsoft 365 begin with a stolen password. Identity settings are therefore the first thing to check.
• Require multi-factor authentication for every user, not only administrators
• Block legacy authentication protocols that cannot use multi-factor authentication
• Use separate, dedicated accounts for administration, and keep the number of global administrators small
• Review sign-in and risk reports regularly
Microsoft's security defaults are a free baseline that turns on several of these protections. Conditional Access gives finer control, such as requiring compliant devices or blocking sign-ins from unexpected countries, and requires Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium.
📧 Protect email
• Publish SPF, DKIM and DMARC records for your domain to make spoofing harder
• Turn on anti-phishing and anti-malware policies, and Safe Links and Safe Attachments if your plan includes Microsoft Defender for Office 365
• Block automatic forwarding of mail to external addresses, a common sign of a compromised mailbox
• Add a visible warning for external senders
Train staff to report suspicious messages using the built-in report button, and review what is reported.
📂 Secure files and sharing
• Set sensible external sharing limits in SharePoint and OneDrive, and prefer links for specific people over links for anyone
• Set expiry on guest access and review guests periodically
• Use sensitivity labels or data loss prevention policies where your plan includes them
• Keep the audit log turned on so that you can investigate incidents
Check who can create Teams and sites, and archive old ones. Forgotten shared spaces are a quiet source of exposure.
💡 Myth: “Microsoft backs up my data”
Microsoft protects the Microsoft 365 service, but your data is your responsibility. Retention settings are not the same as a backup, and deleted items eventually disappear.
• Consider a third-party backup for email, SharePoint, OneDrive and Teams
• Test your restores
💻 Manage devices
• Enroll company laptops and phones in Microsoft Intune or another device management tool
• Require encryption, a screen lock and up-to-date operating systems
• Install endpoint protection and monitor alerts
• Decide whether personal devices are allowed and how company data is protected on them
Pair device compliance with Conditional Access so that unmanaged or out-of-date devices cannot reach company data.
💾 Do not forget backup
Microsoft protects the Microsoft 365 service, but your data is your responsibility. Retention settings are not the same as a backup, and deleted items eventually disappear. Consider a third-party backup for email, SharePoint, OneDrive and Teams, and test restores.
Foxcomm configures and manages Microsoft 365 security for businesses across New York. Read about our Microsoft 365 services, or request a free IT and security audit to see how your tenant measures up.
Get started
🔎 Want your Microsoft 365 reviewed?
Speak to Foxcomm IT Services in New York about managed IT, Microsoft 365 or cybersecurity.
Get a free quote