If you manage Microsoft 365 for a business, there's a reasonable chance some important security settings are switched off by default — and you might not know about it. This guide walks through the most important settings to check, in plain English, and explains why each one matters.
The short version: Microsoft 365 ships with sensible defaults, but not all of them are configured to match your organisation's risk level. A quick review of the settings below could stop an account takeover, a data breach, or an expensive ransomware recovery.
MFA means users need more than just a password to sign in — they also need to approve a notification on their phone, or enter a code. Without it, a stolen password is all an attacker needs.
Where to check: Microsoft 365 Admin Centre → Users → Active Users → Select a user → Multi-factor authentication. Or better, go to Entra ID → Security → Conditional Access and create a policy that requires MFA for all users.
Quick win: Enable Security Defaults in Entra ID if you don't have Conditional Access licences. It's one toggle that turns on MFA for all users and blocks legacy authentication.
Conditional Access goes further than basic MFA. It lets you define rules like "require MFA when signing in from outside the office" or "block sign-ins from risky countries." It requires Azure AD P1 licences (included in Business Premium and E3/E5).
Where to check: Entra ID → Security → Conditional Access → Policies. If you see no policies listed, or only a single "All users — require MFA" policy, there's room for improvement.
Key policies to add: block legacy authentication protocols (SMTP, IMAP, POP3 — these bypass MFA entirely), require compliant devices for access, and block sign-ins from high-risk locations.
By default, SharePoint allows anyone with a link to view files — including people outside your organisation. For most businesses, this is too permissive.
Where to check: SharePoint Admin Centre → Policies → Sharing. Set external sharing to "New and existing guests" at most, and ideally "Only people in your organisation" for sensitive sites.
Guest access in Teams lets external people join channels, see files, and participate in meetings. Whether this is appropriate depends on your business, but it should be a deliberate choice, not a default you haven't noticed.
Where to check: Teams Admin Centre → External Access and Guest Access.
DKIM and DMARC are email security standards that prevent attackers from spoofing your domain — sending emails that appear to come from your company. Without them, phishing emails that look like they're from your CEO are trivially easy to send.
Where to check: Exchange Admin Centre → Mail Flow → DKIM. Also check your DNS records for a DMARC TXT record on _dmarc.yourdomain.com.
Mailbox auditing records who accessed what in each mailbox — useful for forensic investigation if an account is compromised. It's enabled by default on E3/E5 but not always on Business plans.
Where to check: Exchange Admin Centre → Compliance → Audit log, or run Get-OrganizationConfig | Select-Object AuditDisabled in PowerShell.
Going through each of these settings manually takes time, and the Microsoft Admin Centre is not exactly known for its clarity. M365Clarity connects to your tenant via read-only Microsoft Graph API and scans all of the above — plus another 90+ settings — in about 30 seconds. Every finding is colour-coded red, amber, or green, with a plain-English explanation and step-by-step fix instructions.
Connect your tenant, run a scan, and get a clear view of what needs attention. Free plan available.
Connect your tenant free →Related articles