Most Microsoft 365 tenants we audit are not misconfigured. They are unconfigured, which is a different problem and a more common one. Nobody made a bad decision. The tenant was set up years ago to get email working, it did work, and the settings that shipped with it were never revisited because nothing appeared to be wrong.
That matters more than it used to, because Microsoft has spent several years tightening what a brand new tenant gets by default. The result is a split that surprises people: two companies with identical licences and identical admin centres can run materially different security baselines purely because one tenant was created in 2018 and the other last quarter. Your exposure tracks tenant age, not company size or spend, and nothing in the portal announces which side of that line you are on.
This Microsoft 365 hardening guide covers the seven defaults we find most often, why each one exists, and the order we fix them in.
Why Defaults Are Loose in the First Place
It helps to understand the reasoning, because it tells you which settings will bite. Microsoft ships defaults that favour a working tenant over a locked one. If a new customer’s mail client cannot connect, or a shared file will not open for a client, that is a support call and a bad first week. So the out-of-box posture leans permissive, on the assumption that an administrator will tighten it later.
For a large organisation, someone does. For a ten to two hundred person company with no dedicated security staff, “later” often never arrives, and the tenant runs its first five years on setup-day settings. Most account takeovers we investigate at that size involve no malware at all. They involve a tenant behaving exactly as configured.
1. Security Defaults Are Off and Nothing Replaced Them
The single most common finding. Microsoft’s Security Defaults bundle enforces multi-factor authentication for administrators and users and blocks the weakest sign-in paths, and it is enabled automatically for tenants created after late 2019. Older tenants never received it. Worse, plenty of tenants had it switched off deliberately during a migration or a mail-client problem, and it was never switched back.
The trap is the gap. Security Defaults is an all-or-nothing bundle, so the usual reason for disabling it is to gain the granularity of Conditional Access. That is the right destination, but only if the Conditional Access policies actually get built. We regularly find tenants where Security Defaults was turned off in preparation for policies that were never written, leaving a baseline weaker than either option.
Check which of three states you are in: Security Defaults on, Conditional Access policies genuinely covering sign-in, or neither. The third is far more common than people expect.
2. Legacy Authentication Still Gets Answered
Legacy protocols such as POP3, IMAP, and SMTP AUTH predate modern authentication and cannot present an MFA prompt. A sign-in over those paths gets in with a username and password alone, which means an attacker with valid credentials bypasses your MFA entirely rather than defeating it.
Microsoft has been retiring these protocols tenant by tenant for years, and the work is genuinely well advanced. It is not finished everywhere, and any tenant where an administrator re-enabled a protocol for an old scanner, a line-of-business application, or a copier that emails scans may still accept it today. Those exceptions are usually granted for one device and left tenant-wide.
Two things to establish: whether legacy authentication is blocked at the tenant level, and if any exception exists, whether it is scoped to the single mailbox that needs it. An MFA rollout that leaves legacy authentication answering is not an MFA rollout.
3. External Sharing Is Set to Anyone
SharePoint and OneDrive default to the most permissive sharing level, which allows anonymous links. A user shares a document, the link works for whoever holds it, and no sign-in is required. Forwarded into a personal mailbox or pasted into a thread with an external party, that link keeps working indefinitely and appears in no access review, because from the platform’s perspective there is no user to review.
The fix is not to ban external sharing, which breaks real work and pushes people to personal file services where you have no visibility at all. Set the tenant default to require sign-in, allow anonymous links only where a business case exists, and give anonymous links an expiry. Most teams do not notice the change, because “anyone with the link” was rarely the intent.
Firms handling client documents feel this most sharply. Our notes on Microsoft 365 management for professional services firms and for accounting firms go into the confidentiality side in more detail.
4. Users Can Approve Third-Party Apps Themselves
By default, users can grant a third-party application access to their own Microsoft 365 data. Somebody signs up for a scheduling tool or an AI note-taker, clicks accept on a consent screen, and that application holds a durable token to read their mail and files.
This is the exposure that has grown fastest, because the number of tools asking for exactly that access has grown fastest. It is also the hardest to spot after the fact. Nothing is installed on a laptop, no password is shared, and the connection survives a password reset because the token is separate from the credential. The user genuinely believes they clicked accept on a calendar tool.
Requiring administrative consent for third-party access is the control, ideally paired with an admin-consent request workflow so people can still ask rather than being silently blocked. Also review what is already connected. Most tenants have consented applications nobody can account for, some belonging to people who left.
5. Nobody Is Watching Mailbox Rules
When a mailbox is taken over, the intruder’s first move is usually a rule: forward everything to an external address, or move messages matching “invoice” or “payment” into an obscure folder so the real user never sees the conversation being run in their name. This is why fraud can continue for weeks inside a mailbox whose owner is at their desk.
Auditing exists in Microsoft 365, but a default tenant is not alerting anyone about it. The specific alerts worth having are new external forwarding, creation of a rule that moves or deletes inbound mail, and sign-in from an unusual location for an account that never travels. Each is cheap to enable and each catches a real takeover early.
Decide who receives those alerts before enabling them. An alert routed to a shared mailbox nobody reads is not a control, and that is the state we find most often when auditing tenants that do have alerting configured.
6. Anyone Can Create Teams, Groups, and Invite Guests
Self-service group and Teams creation is on by default, along with reasonably open guest invitation. That default is deliberate and mostly good, because gating collaboration behind IT tickets is how shadow tools get adopted.
The cost is accumulation. Two years in, a tenant has Teams nobody owns, containing files nobody has reviewed, with guests from projects that ended and vendors no longer engaged. Each one is a live access path attached to no current business relationship, which makes it exactly the kind of thing that never comes up in a review.
Keep self-service on and add lifecycle: an owner required for every group, expiry with a renewal prompt, and a quarterly guest review. Companies whose projects naturally involve outside parties should look hardest here, which is a theme in our piece on Microsoft 365 management for manufacturers.
7. Retention and Recovery Are Assumed Rather Than Configured
The last one is not a breach path, it is a recovery gap, and it shows up at the worst moment. Microsoft 365 keeps deleted items for a limited window and its native retention is not a backup in the sense most people mean. There is no default configuration that lets you restore a mailbox or a document library to a point in time weeks after a deletion or an encryption event.
Teams discover this while trying to recover, which is when the answer costs the most. Two questions settle it: how far back could we restore a single mailbox or site today, and has anyone actually performed that restore rather than assuming it works. An untested restore is a plan, not a capability. Smaller organisations with limited administrative cover feel this hardest, something we cover in Microsoft 365 management for nonprofits.
The Order We Fix Them In
Sequence matters, because some of these changes are invisible and some generate support calls.
- First, the invisible wins. Block legacy authentication, require admin consent for third-party apps, and enable the mailbox-rule and forwarding alerts. These rarely affect anyone’s day and each closes a path that needs no user error to exploit.
- Second, identity. Get to a real MFA baseline, whether Security Defaults or genuine Conditional Access, and confirm no legacy exception undercuts it.
- Third, the changes people notice. Tighten external sharing defaults and add group lifecycle. Announce these, because someone’s habit will change.
- Fourth, prove recovery. Configure retention deliberately, then perform a test restore and write down how long it took.
Ordering it this way front-loads the reduction in risk and puts the disruptive items after the tenant is already meaningfully safer. Most of this is a few days of careful work rather than a project, and none of it requires new licensing beyond what a typical Business Premium tenant already includes.
If you want a second pair of eyes on where your tenant sits, our Office 365 services team runs this exact review, and it pairs naturally with a migration or with Microsoft 365 training so the changes hold. Book a free strategy call and we will walk your current settings with you.
Frequently Asked Questions
Are Microsoft 365 default settings secure enough for a small business?
They are built to get a tenant working rather than to lock it down, and they have changed over time. A tenant created recently starts from a noticeably stronger baseline than one created several years ago, so the honest answer depends on when yours was created and what has been adjusted since.
What is the difference between Security Defaults and Conditional Access?
Security Defaults is a fixed bundle that enforces multi-factor authentication and blocks the weakest sign-in paths with no configuration. Conditional Access is rule-based and far more precise, but it only protects you once the rules are actually written. The dangerous state is having disabled the first without completing the second.
Why does blocking legacy authentication matter if we already have MFA?
Legacy protocols cannot display an MFA prompt, so a sign-in over one of those paths succeeds with just a username and password. Leaving them enabled gives an attacker a route around your MFA rather than through it, which means the MFA rollout is incomplete until they are blocked.
Should we turn off external sharing in SharePoint entirely?
Usually not. Blocking it outright tends to push people toward personal file-sharing accounts where you have no visibility or control at all. Requiring sign-in instead of anonymous links, and setting an expiry on links, keeps the workflow while removing the part that leaks.
How often should we review these settings?
Treat identity and third-party app consent as a quarterly review, and guest and group cleanup as quarterly too. Everything else is worth revisiting annually or whenever your licensing changes, since new licences often bring controls you are already paying for but have not enabled.
