1. Protect every identity
Enable Security Defaults for a small tenant where they are appropriate, or use properly designed Conditional Access policies where licensing and operational needs justify them. Enforce MFA, protect administrative roles and block legacy authentication.
Maintain at least two carefully controlled emergency-access accounts and monitor their use. Administrators should use separate privileged accounts rather than reading email or browsing with an administrative identity.
2. Control access lifecycle
Use a documented joiner, mover and leaver process. Remove departed users promptly, review guest accounts and examine privileged-role assignments regularly. Avoid permanent exceptions to MFA or access policies; where exceptions are necessary, assign an owner and expiry/review date.
3. Strengthen email and domain protection
Configure SPF, DKIM and DMARC for every sending domain. Review anti-phishing, anti-spam and malware policies. Protect high-risk users such as finance, administrators and senior leadership with stronger controls and specific awareness training.
4. Secure endpoints
Know which devices access company information. Apply supported operating systems, automatic security updates, disk encryption, screen locking and endpoint protection. For personal devices, define what data may be accessed and what management or application-protection controls apply.
5. Protect SharePoint, OneDrive and Teams
Review external sharing defaults, anonymous links, guest access and sensitive sites. Use the least permissive sharing method that still supports the business. Ensure that important files have an independent recovery strategy appropriate to the organization's needs.
6. Turn on logging and response visibility
Confirm that audit logging is available and retained for the required period. Review risky sign-ins, unusual mailbox rules, unexpected forwarding, privileged changes and application consent. Establish who will receive and investigate alerts.
7. Measure without chasing a score
Microsoft Secure Score can help identify recommended actions, but the score is not proof that the business is secure. Prioritize actions by actual exposure, licensing, compatibility and operational impact. Record accepted risks and compensating controls.
8. Test the operating process
Run a quarterly access review, a mailbox-compromise exercise and a file-restore test. A secure configuration that nobody monitors or tests degrades quietly.