Microsoft 365 security hardening
We check and fix the security settings of your Microsoft 365 and Entra ID tenant: authentication, Conditional Access, sharing, email, and logging.
Assessment areas
What we examine in the tenant
We review five groups of settings. We covered common tenant mistakes in our article on Microsoft 365 security.
Authentication
Which accounts have multi-factor authentication, which method they use, and whether admin accounts get stronger protection than the rest.
Conditional Access
The policies screen sign-ins from unknown devices or unusual locations. A noncompliant device, for example, can be given only limited access with no downloads.
External sharing
Who users can share documents with outside the organization, and with what kind of link.
Email
Automatic forwarding to external addresses, and tagging of messages that arrive from outside. That tag is one of the most effective controls against phishing disguised as instructions from management.
Logging
Cloud logging is often not on by default, or the logs are kept only for a short time. We check whether the creation of mailbox rules, bulk downloads, and administrative actions are recorded. A new mailbox rule is a classic sign that the account has been taken over.
Exceptions and workarounds
Where multi-factor authentication leaves gaps
An MFA rollout breaks down wherever it leaves a gap. When we set up the policies, we pay particular attention to these points.
Legacy protocols
Older mail authentication methods (POP3, IMAP, SMTP with basic authentication) do not support MFA. If they stay enabled, attackers sign in through them, so they have to be blocked.
Service accounts
Interactive MFA cannot be used here. Instead of an exception, these accounts are protected by a long, unique, stored password and by tightly restricted permissions and sign-in locations.
“Just not for management”
Executive accounts fall under the same policy as everyone else’s. Management is the most targeted group, so a convenience exception carries the most risk here.
Trusted network
A rule like “no MFA from the internal network” assumes the internal network is safe. In a typical incident, that is exactly where the attacker is working from.
MFA fatigue
With the password in hand, the attacker keeps sending push notifications until the user approves one. Number matching practically eliminates this, and in most systems it can be turned on with a single switch.
Deliverables
What you get at the end
items handed over
- Assessment of the tenant’s security posture
- Configuration of multi-factor authentication and Conditional Access policies
- Tightening of external sharing and email settings
- Documentation of the changes made
Related services
Beyond the tenant
These services cover the areas around the tenant.
Email security
Protection against phishing emails and malicious attachments and links, including sorting out SPF, DKIM, and DMARC authentication for your mail domain.
Identity and access management (IAM)
Who can access what, with which kind of authentication, and what happens when people join, change roles, and leave.
Data loss prevention (DLP)
Identifying sensitive data and stopping it from leaking through email, cloud storage, printers, and removable media.
SIEM
Once copied into the SIEM, the tenant’s logs survive even if the attacker erases their tracks inside the tenant.
Frequently asked questions
The questions we hear most
Does it matter which kind of multi-factor authentication we use?
Yes, it does. A code received by SMS or in an app gets typed into a fake sign-in page just as easily, and the attacker relays it in real time. A FIDO2 key or a passkey is cryptographically bound to the domain, so it does not respond on any other domain. A passkey is stored in the biometric module of a phone or laptop and needs no separate hardware. Admin accounts should have a hardware key wherever possible. You will find a comparison of the methods in our article on MFA types.
Will tighter settings make work harder for users?
If security creates too much friction, users find ways around it. With risk-based authentication, a low-risk sign-in from a familiar context asks for no extra step. Every user also needs a backup method, or the first time a phone is lost, the helpdesk has no choice but to switch MFA off. We wrote about the principle in our Zero Trust guide.
How is this different from the IT security assessment?
The IT security assessment audits the entire IT environment, from access management through patching, backup, and the network to user security. Microsoft 365 hardening is limited to the tenant, and after the assessment we also fix the settings.
