Microsoft 365 security for UK SMEs

Microsoft 365 security hardening means checking how your organisation controls access to email, documents, devices and administration, then testing the changes that close the important gaps. Microsoft supplies security features, including baseline protection through Security Defaults, but your tenant's configuration and licences determine what is active.

For a UK SME, start with the accounts that can change the tenant or approve payments. Then check ordinary user access, sharing, email protection and the logs you would need during an incident. A higher dashboard score is useful evidence of configuration work, but it is not a certificate or a measure of your probability of being breached.

Establish the tenant's actual starting point

Record your subscriptions, assigned licences, administrator roles, authentication policies, connected applications and device-management coverage. Check the tenant itself. Do not assume that a feature is enabled because it is available, or absent because nobody remembers configuring it.

Microsoft's Security Defaults documentation describes baseline controls available without a premium licence. New tenants can already have these controls enabled. They require MFA registration, protect administrator sign-ins, require MFA for users when Microsoft determines it is necessary and block legacy authentication. That is different from a claim that every default tenant has no security protection.

Before changing access policies, establish tested emergency access and a recovery route. List applications, service accounts and devices that could be affected. A sudden block on an old authentication method can stop a business process as well as an attacker.

Use Secure Score to find work, not to prove compliance

Microsoft Secure Score records progress against recommended actions. Microsoft explicitly says it is not an absolute measure of how likely your systems are to be breached and does not guarantee protection.

There is no Secure Score threshold in this guide that establishes Cyber Essentials compliance. Remove that shortcut from board reports and assessment plans. Certification requires evidence against the scheme's actual requirements and scope.

Keep a baseline and review recommended actions against risk, user impact, cost and implementation dependencies. Some recommendations may need licences you do not own. Others may already be addressed by an alternative control.

Report the completed control and its remaining exceptions alongside the score. A number alone hides the decisions that matter.

Choose an authentication policy that fits your licences

Security Defaults can be a useful starting point for an organisation without premium identity features. It is an organisation-wide baseline rather than a policy you can customise for each department. Its documented registration uses Microsoft Authenticator notifications; OATH TOTP applications can also provide codes. Do not describe SMS as its supported registration route.

Conditional Access provides more control and requires at least Microsoft Entra ID P1 for the relevant capabilities. Risk-based policies and privileged identity features can have additional licensing requirements. Check the full product name: Office 365 E3 and Microsoft 365 E3 are different subscriptions. "E3 includes it" is not a reliable purchasing rule.

Security Defaults and Conditional Access are alternative approaches to enforcing the baseline. Prepare and test the replacement design before disabling Security Defaults, then enable the replacement policies without leaving an unprotected gap. Use Microsoft's deployment guidance, a pilot group where appropriate and tested emergency access.

For a hypothetical 60-person firm, the first decision might be to retain Security Defaults while documenting devices and applications. A later move to Conditional Access could introduce a compliant-device requirement for finance access after the pilot succeeds. The organisation should not disable its working baseline simply because it purchased a new licence.

Protect administrative access separately

Use separate accounts for administration and ordinary email or document work. Assign the narrowest role needed for the task. Keep Global Administrator assignments limited and review them regularly.

Emergency accounts have a different purpose from everyday administrator accounts. Microsoft's guidance recommends two cloud-only emergency access accounts with permanent Global Administrator assignments, protected and monitored for emergency use. Do not interpret "minimise admins" as an instruction to remove the recovery mechanism.

Prefer phishing-resistant authentication for privileged access where supported. Protect enrolment and recovery with the same care as routine sign-in. A strong sign-in method does not make a stolen session, compromised endpoint or weak recovery procedure harmless.

If you use Privileged Identity Management, verify its licensing and coverage. Time-limited role activation reduces standing privilege, but the team must still review eligible assignments, approval rules, logs and emergency procedures.

Find legacy authentication before blocking it

Distinguish an email protocol from the authentication mechanism used with it. IMAP, POP and SMTP can have modern authentication configurations; the protocol name alone does not prove that a connection uses basic authentication.

Review sign-in evidence to identify legacy clients and authentication methods. Record each dependency, its owner and the supported replacement. Security Defaults blocks legacy authentication. A Conditional Access design needs equivalent protection and a plan for any remaining exceptions.

Do not create a permanent bypass because a printer, scanner or business application is inconvenient to change. Give the exception an owner, compensating controls and a migration date. Confirm delivery and business operation through an authorised test plan rather than assuming a successful policy save proves compatibility.

Match email protection to the licensed product

Exchange Online's baseline protection and Microsoft Defender for Office 365 are not interchangeable names for the same entitlement. Check whether your subscription includes the Defender features you intend to configure, such as Safe Links and Safe Attachments. Consult the Microsoft security licensing guidance for the exact service.

Review anti-phishing settings for the people and domains an attacker is likely to impersonate. Define quarantine handling, alert ownership and a way to release legitimate messages. A policy that quarantines important business mail without an owner creates a different operational problem.

For SPF, DKIM and DMARC, inventory every authorised sender first. SPF describes permitted sending infrastructure, DKIM supplies a signature, and DMARC evaluates alignment with the visible From domain. Stage an enforcement change and examine reports so legitimate invoicing or marketing services are not inadvertently blocked. These controls reduce particular spoofing opportunities; they do not prevent every deceptive message.

Introduce device requirements without locking out the business

If your licences and device estate support Intune, use it to manage and assess devices. Define the supported operating systems, encryption, update and endpoint-protection requirements relevant to each platform.

Pilot a Conditional Access requirement before applying it broadly. Include a newly enrolled device, a non-compliant device, a contractor and a legitimate recovery scenario. Record the expected result for each.

For personal devices, app protection may be suitable for supported applications. Explain what the organisation can see or control and agree the policy with the relevant people. Do not assume app management provides the same coverage as managing the entire device.

Review sharing at the right level

Inspect organisation-level and site-level SharePoint and OneDrive settings, default link types and existing links. These are separate controls. Changing a default does not necessarily revoke links already issued.

Prefer authenticated sharing for sensitive material, with an owner, an appropriate expiry or review date and a clear revocation process. Test the intended partner experience. A domain restriction that blocks a real supplier needs a managed exception, not an undocumented workaround.

Teams external access and guest access are also different. Review each against the collaboration your business needs. Confirm the applicable restriction mechanism rather than assuming one setting covers every route.

Retain logs and assign someone to act

Microsoft Purview Audit Standard normally retains audit records for 180 days for records generated from 17 October 2023. The earlier 90-day default no longer describes current Audit Standard retention. Premium retention varies by workload, licensing and policy. Microsoft Entra sign-in logs are a separate dataset with separate retention rules.

Verify that the events you need are present and searchable. Choose retention based on your investigation needs and obligations, then confirm that the relevant users and workloads are licensed for it. Do not assume purchasing a higher tier restores records that have already expired.

Assign owners for alerts involving privileged-role changes, suspicious forwarding rules, unusual access and large data movements. Agree response coverage and escalation. Monthly review is useful for trends; it is not an adequate response plan for an urgent alert.

Build a manageable hardening plan

Use an evidence-based sequence rather than a promised four-week completion date:

1. Confirm ownership, licences, emergency access and the current authentication baseline.
2. Close urgent account and legacy-authentication gaps with a tested change plan.
3. Review email protection and authorised senders.
4. Review sensitive sharing routes and existing access.
5. Pilot device controls and expand after acceptance.
6. Verify audit coverage, retention and alert response.

For each change, retain the old configuration, expected behaviour, test results and rollback instructions. Map the resulting evidence to your Cyber Essentials assessment where relevant. Hardening helps support compliance; it does not independently establish certification, GDPR compliance or an insurance discount.

Get a tenant review tied to business risk

If you need help deciding which changes matter first, book a consultation. My security consulting and IT compliance services can help review access, licensing gaps, policy dependencies and the evidence needed to verify a change. Start with your tenant's actual configuration and the services that would hurt the business most if access failed or data escaped.