Stackvora.tech

Microsoft 365 Tenant Hardening: 12-Point Checklist

Securing a Microsoft 365 tenant against an ever-evolving threat landscape requires proactive and continuous effort. This guide provides a twelve-point…

Securing a Microsoft 365 tenant against an ever-evolving threat landscape requires proactive and continuous effort. This guide provides a twelve-point checklist for hardening a Microsoft 365 environment, focusing on foundational security controls and best practices. These recommendations are applicable to tenants ranging from small businesses to large enterprises, considering various licensing tiers.

1. Enable Security Defaults or Configure Conditional Access

Multi-Factor Authentication (MFA) is the single most effective control against unauthorized access. Microsoft offers two primary mechanisms for enforcing MFA across a tenant:

  • Security Defaults: This baseline set of security policies is available for all tenants, including those with Microsoft 365 Business Basic/Standard, Microsoft 365 E3/E5, and Office 365 E1/E3/E5 licenses. Security Defaults automatically enables MFA for all users and administrators, blocks legacy authentication, and protects privileged activities. It's a "set and forget" solution ideal for organizations without Azure AD Premium licenses.
  • Conditional Access (CA): Requires Azure AD Premium P1 or P2 licenses (included in Microsoft 365 Business Premium, E3, E5). CA offers granular control over access policies based on user, device, location, application, and real-time risk. For example, you can enforce MFA only when users access sensitive applications from untrusted locations or non-compliant devices.

To configure Security Defaults:

  1. Navigate to entra.microsoft.com.
  2. Go to Identity > Overview > Properties.
  3. Select Manage Security defaults.
  4. Set Enable Security defaults to Yes.
  5. Save the changes.

For Conditional Access, a common policy would enforce MFA for all users, all cloud apps, and all device platforms, with specific exclusions for service accounts or trusted locations as necessary. A simple "Require MFA for all users" policy is a good starting point.

2. Block Legacy Authentication Protocols

Legacy authentication protocols (e.g., POP3, IMAP, SMTP AUTH, MAPI over HTTP, Exchange ActiveSync older than Exchange 2016 CU2, OWA for Exchange 2010) do not support modern authentication features like MFA and are highly susceptible to credential stuffing and brute-force attacks. Blocking them significantly reduces attack surface.

If Security Defaults are enabled, legacy authentication is blocked automatically. For Conditional Access, create a policy:

  • Users: All users
  • Cloud apps or actions: All cloud apps
  • Conditions > Client apps: Configure "Yes", then select "Exchange ActiveSync clients" and "Other clients" (which covers protocols like POP, IMAP, and older versions of Office clients).
  • Grant: Block access.

Alternatively, per-protocol blocking can be done via Exchange Online PowerShell for specific users or the entire tenant, though CA is generally preferred for broader coverage.

# Connect to Exchange Online PowerShell
Connect-ExchangeOnline -UserPrincipalName admin@yourdomain.com

# Disable Basic Auth for specific protocols tenant-wide (modern approach, supersedes individual protocols for most services)
Set-AuthenticationPolicy -Identity DefaultAuthPolicy -AllowBasicAuthPop:$false -AllowBasicAuthImap:$false -AllowBasicAuthSmtp:$false -AllowBasicAuthMapi:$false -AllowBasicAuthRest:$false -AllowBasicAuthRpc:$false -AllowBasicAuthWebServices:$false -AllowBasicAuthActiveSync:$false

# For legacy tenants without a 'DefaultAuthPolicy' or specific needs, disable individual protocols:
# For SMTP AUTH
Set-TransportConfig -SmtpClientAuthenticationDisabled $true

# For specific users, or to re-enable
Set-CASMailbox -Identity "user@yourdomain.com" -PopEnabled $false -ImapEnabled $false -ActiveSyncEnabled $false

Microsoft has progressively disabled legacy auth for new tenants and is phasing it out for existing ones. Verify your tenant's status.

3. Enable Unified Audit Log

The Unified Audit Log (UAL) records user and admin activities across Microsoft 365 services (Exchange Online, SharePoint Online, Teams, Entra ID, etc.). It's crucial for forensic investigations, compliance, and monitoring suspicious activity.

By default, the UAL is enabled for most organizations, but it's essential to confirm. Audit data retention varies by license: 90 days for most, 1 year for E3 (with add-on) and E5, and up to 10 years with Microsoft Purview Audit Premium.

To verify/enable:

  1. Navigate to compliance.microsoft.com.
  2. Go to Audit.
  3. If not enabled, click "Start recording user and admin activity".

Regularly search the UAL for activities like mailbox access by non-owners, changes to global admin roles, or mass file downloads.

4. Configure DKIM & DMARC for Email Security

Alongside SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail) and DMARC (Domain-based Message Authentication, Reporting, and Conformance) are critical for preventing email spoofing and phishing attacks originating from your domain.

  • DKIM: Adds a digital signature to outgoing emails, verifying the sender's identity and ensuring messages haven't been tampered with in transit.
  • DMARC: Builds upon SPF and DKIM, telling receiving email servers how to handle messages that fail authentication checks (e.g., quarantine, reject) and provides reporting on DMARC failures.

To configure DKIM in Microsoft 365:

  1. Navigate to security.microsoft.com.
  2. Go to Email & collaboration > Policies & rules > Threat policies > DKIM.
  3. Select your custom domain and click "Create DKIM keys". You'll be provided with two CNAME records to add to your DNS provider.

For DMARC, you need to add a TXT record to your DNS zone. A recommended starting DMARC policy is v=DMARC1; p=quarantine; fo=1; ruf=mailto:dmarc_rua@yourdomain.com; rua=mailto:dmarc_ruf@yourdomain.com. Gradually move from p=none to p=quarantine and eventually p=reject as you gain confidence in your email sending infrastructure.

5. Review and Improve Secure Score

Microsoft Secure Score is a quantitative measure of your organization's security posture within Microsoft 365. It provides recommendations (actions) to reduce risk, categorized by identity, data, devices, apps, and infrastructure.

  1. Navigate to security.microsoft.com.
  2. Go to Secure Score.

Prioritize actions with higher scores, especially those marked as "High impact". Regularly review and implement recommendations, as your score can fluctuate with new features and changing threats. Aim for a score above 80% and continuously monitor for improvements.

6. Deploy Defender for Office 365 (Plan 1 or 2)

Microsoft Defender for Office 365 (MDO) provides advanced protection against sophisticated phishing, business email compromise (BEC), and zero-day malware attacks that bypass standard Exchange Online Protection (EOP). It is included in Microsoft 365 Business Premium, E5, and as an add-on for other licenses.

  • Plan 1: Includes Safe Attachments (detonates attachments in a sandbox), Safe Links (rewrites URLs at click time), Anti-phishing policies, and spoof intelligence.
  • Plan 2: Adds Threat Trackers, Threat Explorer, Automated Investigation and Response (AIR), and Attack Simulation Training.

Key configurations for MDO:

  • Safe Attachments: Configure policies to block attachments and dynamically deliver emails while attachments are scanned. Apply to all users.
  • Safe Links: Enable for all users and ensure it applies to internal emails as well.
  • Anti-Phishing: Create and refine policies to protect specific users/domains and enforce advanced anti-phishing thresholds.
  • Impersonation Protection: Add executives and high-value targets to user and domain impersonation lists.

7. Disable User Consent to Risky Applications

Users granting consent to third-party applications (often via OAuth) can inadvertently provide broad permissions (e.g., "Read all mailboxes", "Read all files") to malicious apps, leading to data exfiltration or tenant compromise. Unless specifically required, restrict user consent.

To configure user consent settings:

  1. Navigate to entra.microsoft.com.
  2. Go to Identity > Applications > Enterprise applications > Consent and permissions > User consent settings.
  3. Choose one of the following:
    • Do not allow user consent: Most restrictive. Requires admin approval for all apps. Recommended for high-security environments.
    • Allow user consent for apps from verified publishers, for selected permissions: A balanced approach. Define custom permission classifications if needed.
  4. Consider implementing an admin consent workflow for unapproved applications.

8. Enforce Password-less Authentication (e.g., Passkeys, FIDO2, Microsoft Authenticator)

Passwords are a leading cause of breaches. Implementing password-less authentication significantly enhances security and improves user experience. Options include FIDO2 security keys, Microsoft Authenticator app (phone sign-in), and Windows Hello for Business.

To enable password-less methods:

  1. Navigate to entra.microsoft.com.
  2. Go to Identity > Protection > Authentication methods > Policies.
  3. Configure the desired method (e.g., FIDO2 Security Key, Microsoft Authenticator). Enable for all users or a phased rollout group.
  4. Communicate clearly with users on how to register and use these methods.

For FIDO2, you'll need compatible hardware keys. For Microsoft Authenticator phone sign-in, users must enable notifications and approve sign-ins via the app.

9. Restrict Guest Sharing (SharePoint Online, OneDrive, Teams)

External sharing is a powerful collaboration feature but can be a significant data leakage risk if not properly controlled. Configure sharing policies to balance collaboration needs with security requirements.

SharePoint & OneDrive:

  1. Navigate to admin.microsoft.com.
  2. Go to SharePoint > Policies > Sharing.
  3. Set the sharing level:
    • Existing guests only: Most restrictive, users can only share with people already in your directory.
    • New and existing guests: Default, allows inviting new guests.
    • Anyone with the link: Least restrictive, anonymous links. Limit this or disable it entirely unless specific business needs require it.
  4. Disable "Allow guests to share items they don't own" and restrict sharing with anonymous access links.
  5. Consider setting expiration for anonymous links.

Microsoft Teams:

  1. Navigate to admin.teams.microsoft.com.
  2. Go to Users > Guest access.
  3. Configure guest access settings, including allowing/disallowing guest calls, meetings, and messaging.

Implement a guest review process and periodically audit external shares.

10. Configure Data Loss Prevention (DLP) Policies

Microsoft Purview Data Loss Prevention (DLP) policies identify, monitor, and protect sensitive information (e.g., credit card numbers, national ID numbers, health records) across Microsoft 365 services (Exchange, SharePoint, OneDrive, Teams). DLP helps prevent accidental or intentional sharing of sensitive data.

To configure DLP policies:

  1. Navigate to compliance.microsoft.com.
  2. Go to Data loss prevention > Policies.
  3. Choose "Create policy". You can start from templates (e.g., Financial, Medical, Privacy) or create a custom policy.
  4. Define sensitive info types (SITs) to detect.
  5. Choose locations (Exchange, SharePoint, OneDrive, Teams) and apply conditions (e.g., content contains sensitive info type, shared with external users).
  6. Configure actions (e.g., Block content, Block with override, Notify users/admins). Start in "Test mode" with policy tips before enforcing.

DLP requires Microsoft 365 E5 or an equivalent compliance add-on.

11. Implement Third-Party Backup for Microsoft 365 Data

While Microsoft provides service availability and geo-redundancy, their shared responsibility model does not cover data loss scenarios due to user error, malicious activity, or ransomware. A third-party backup solution for Microsoft 365 data is crucial for comprehensive data protection and granular recovery.

Key considerations for a third-party backup solution:

  • Coverage: Ensure it backs up Exchange Online, SharePoint Online, OneDrive for Business, and Teams data (including channel messages, files, and calendar).
  • Recovery Granularity: Ability to restore individual emails, files, sites, or entire mailboxes/sites, often to a specific point in time.
  • Retention: Flexible retention policies that go beyond Microsoft's default.
  • Immutability: Protection against backup data tampering.
  • Security: MFA for backup console, encryption at rest and in transit.
  • Discovery: E-discovery capabilities for compliance.

Examples of reputable third-party backup vendors include Veeam Backup for Microsoft 365, AvePoint Cloud Backup, and Commvault Metallic.

12. Configure Microsoft Purview eDiscovery

Microsoft Purview eDiscovery (Standard or Premium) allows organizations to search, preserve, collect, and export content from Microsoft 365 for legal or compliance investigations. While not strictly a "hardening" feature, it's vital for an organization's security posture to be able to respond effectively to legal holds and data requests.

eDiscovery Standard:

  • Content search across Exchange mailboxes, SharePoint sites, OneDrive accounts, and Teams.
  • Place legal holds on specific users or content.
  • Export search results.

eDiscovery Premium (requires E5 or add-on):

  • Adds advanced capabilities like custodian management, legal hold workflows, collection of non-Microsoft 365 data, advanced indexing, and analytics (e.g., near-duplicate detection, email threading).

To configure eDiscovery permissions:

  1. Navigate to compliance.microsoft.com.
  2. Go to Permissions > Microsoft Purview solutions > Roles.
  3. Assign users to the "eDiscovery Manager" or "eDiscovery Administrator" roles as appropriate, following the principle of least privilege.

Common Pitfalls and Troubleshooting

  • Overly Restrictive Conditional Access: Policies that block all access can lock out administrators. Always test new CA policies with a small group of users and ensure emergency access accounts are excluded.
  • Ignoring Secure Score: Secure Score is dynamic. What's a good score today might not be tomorrow. Regularly revisit recommendations.
  • Incomplete DKIM/DMARC Configuration: Incorrect DNS records can lead to legitimate emails being marked as spam. Use tools like MXToolbox to verify your SPF, DKIM, and DMARC records.
  • Neglecting Guest User Lifecycles: Guests can accumulate over time. Implement a guest access review process to remove unneeded external accounts.
  • Lack of Communication for New Policies: Rolling out MFA or password-less methods without proper user communication and support can lead to helpdesk overload and user frustration.
  • Reliance Solely on Microsoft's Default Retention: Understand the difference between Microsoft's operational backup for service availability and your responsibility for data retention against accidental deletion or malicious acts.

Back to the knowledge base · Ask the AI assistant