A compromised Microsoft 365 account is rarely just an email problem. It can expose payroll data, supplier records, SharePoint files, Teams conversations and the systems employees use to run the organisation. Effective Microsoft 365 tenant security therefore needs to protect the identity behind the account, not simply filter suspicious messages.

For many small and mid-sized organisations, Microsoft 365 has become the operational centre of the business. That is useful, but it also means a poorly configured tenant can give an attacker a direct route into day-to-day operations. The answer is not to switch on every available setting. It is to apply the controls that reduce real risk while allowing staff to work productively.

Microsoft 365 tenant security starts with identity

The tenant is the boundary around your Microsoft 365 environment. It holds your users, devices, applications, policies, data-sharing settings and administrator permissions. When an attacker gains access to one account, the damage they can cause depends on how these elements are configured.

Identity is the first priority because passwords alone are no longer a dependable control. Phishing pages can capture them, users may reuse them, and stolen browser sessions can sometimes bypass them altogether. Multi-factor authentication, or MFA, should be required for every user, with stronger controls for administrators and anyone handling sensitive financial or personal information.

MFA needs to be implemented thoughtfully. App-based authentication and passkeys are generally more resistant to phishing than text messages. However, the right approach depends on the workforce. A school with shared devices, a manufacturing site with shift workers and a professional services firm with predominantly remote staff will have different practical requirements. The security policy must be strong enough to reduce risk and straightforward enough that people will follow it.

Conditional Access builds on MFA by setting rules around sign-in risk. For example, an organisation can require MFA when someone signs in from an unfamiliar location, block access from countries where it has no business activity, or prevent unmanaged devices from downloading sensitive files. These policies should be introduced in report-only mode first where possible. That gives IT teams the evidence to spot unintended disruption before enforcing a new rule.

Protect privileged accounts separately

Administrative accounts deserve particular attention. A global administrator can change security settings, create users, grant permissions and access data across the tenant. Giving this level of access to an everyday user account creates an unnecessary single point of failure.

Use separate administrator accounts, provide only the permissions required for the job, and review those permissions regularly. Emergency access accounts should also exist, but they must be tightly controlled, monitored and stored securely for use only when normal authentication services are unavailable. This may feel like extra administration, yet it can prevent a routine phishing incident becoming a full tenant compromise.

Secure email, Teams and file sharing together

Email remains a common entry point, but it is not the only route attackers use. Microsoft Teams messages, shared OneDrive links and third-party apps can all be used to persuade staff to disclose information or approve a harmful action. Security controls need to reflect how people actually collaborate.

Email protection should include anti-phishing policies, safe handling of attachments and links, and protection against impersonation of senior staff, customers and suppliers. Domain protection records such as SPF, DKIM and DMARC help reduce the risk of criminals sending messages that appear to come from your organisation. They are not a substitute for user awareness, but they strengthen the organisation’s overall position.

External sharing needs equally careful consideration. Teams and SharePoint make it easy to work with contractors, governors, clients and suppliers. A blanket ban may push staff towards personal email or consumer file-sharing services. Equally, unrestricted anonymous links can leave sensitive documents accessible long after a project ends.

A more balanced approach is to define who can share externally, which sites can be shared, whether recipients need to sign in and how long a link remains valid. Sensitive departments such as finance, HR and safeguarding may need tighter rules than general project teams. Review guest access at intervals, particularly after a supplier contract, construction project or consultancy engagement ends.

Treat third-party applications as a security decision

Users often connect applications to Microsoft 365 to improve reporting, automate work or add a convenient feature. Many request permission to read user profiles, files or mailboxes. That access can persist even after the original user leaves.

Control who can approve application consent, review existing enterprise applications and remove those that are no longer needed. Before approving a new tool, establish what data it needs, where that data is processed, whether it is appropriate for the organisation’s compliance obligations, and how access will be withdrawn. This is particularly relevant for public sector bodies, education providers and organisations holding special category data.

Device security affects tenant security

A secure sign-in from an unmanaged laptop is only part of the picture. If the device is unpatched, shared with family members or infected with malware, Microsoft 365 data can still be copied, intercepted or exposed.

Where budgets and working patterns allow, enrol company devices into a managed endpoint service. This gives IT teams the ability to enforce encryption, screen locks, operating system updates, endpoint protection and minimum device health standards. It also supports a safer response if a laptop or mobile phone is lost.

Bring-your-own-device arrangements can work, but they need clear boundaries. Rather than trying to control a personal device completely, organisations can use app protection policies to prevent work files being copied into personal applications and require a PIN before business data is opened. The trade-off is that some controls and user experiences will be less consistent than on a fully managed device.

Make data protection recoverable, not theoretical

Microsoft 365 provides valuable retention, versioning and service resilience, but that does not automatically mean every organisation has a complete recovery plan. Accidental deletion, malicious encryption, misconfigured retention policies and insider activity can all create difficult recovery scenarios.

Start by identifying information that would materially disrupt the organisation if it were lost or exposed. That may include contract documents, pupil records, design files, financial data, customer correspondence or operational procedures. Apply sensitivity labels and data loss prevention controls where they provide a meaningful benefit, rather than labelling everything and expecting staff to understand an overly complex scheme.

Retention policies should reflect legal, regulatory and business needs. Keeping all data forever creates unnecessary exposure and storage costs. Deleting information too quickly can create compliance, contractual or operational problems. The right retention period depends on the nature of the information and the sector, so it should be agreed by operational, legal and information governance stakeholders, not IT alone.

An independent backup may also be appropriate for critical Microsoft 365 data. Its value lies in providing a separate, tested recovery option. Before selecting one, be clear about what it covers, how quickly data can be restored, where it is held and who is authorised to perform a recovery.

Monitor what matters and rehearse the response

Security alerts are useful only when somebody is accountable for reviewing them and knows what action to take. A tenant can generate alerts for risky sign-ins, unusual mailbox rules, mass downloads, changes to administrator roles and suspicious applications. Without monitoring, these signals can be missed until a customer reports a fraudulent email or a member of staff cannot access their account.

A proportionate monitoring service should distinguish between background noise and events that require investigation. It should also document escalation routes. Who can disable an account? Who contacts an affected supplier? Who decides whether a reportable data breach has occurred? Clear answers reduce delay at the point it matters most.

A practical incident response plan should be rehearsed at least annually. Test a plausible situation, such as a finance employee approving an MFA prompt after a convincing phone call, or an administrator account being accessed from an unexpected location. The exercise often reveals gaps in contact details, authority levels, logging or recovery procedures that a written policy alone will not expose.

A sensible order for improvement

If your tenant has grown over several years, avoid trying to correct every setting in one project. Begin with the controls most likely to limit serious disruption:

• Enforce MFA for all users and stronger protection for privileged accounts.
• Remove unnecessary administrator roles and review dormant accounts.
• Assess Conditional Access, starting with policies that target high-risk sign-ins.
• Review email protection, external sharing and third-party application permissions.
• Bring managed devices to an agreed security baseline and test recovery arrangements.

This sequence will vary. An organisation with a recent phishing incident may need to prioritise identity and email. One handling significant volumes of confidential files may need to focus first on sharing controls, device management and data governance. The point is to make decisions based on operational risk rather than a generic checklist.

Microsoft 365 can support secure, flexible working without making every task harder. The strongest tenant security is usually the result of regular attention: understanding how people work, applying proportionate controls, reviewing changes and acting quickly when something does not look right. That is how technology continues to just work when the organisation needs it most.