M365 Security: How to Secure Your Microsoft 365 Tenant

Securing your Microsoft 365 tenant starts with the assumption that someone is already trying to break in. According to the ACSC Annual Cyber Threat Report 2024-25, identity fraud was the top reported cybercrime in Australia last year. The average small business lost $56,600 per incident, up 14%, and medium businesses lost $97,200, a 55% jump on the previous year. Overall business cybercrime costs rose 50% to $80,850 per report, and ASD’s Australian Cyber Security Centre received one cybercrime report every six minutes across the financial year. 

Behind almost every one of those attacks sits an identity, an inbox, or a cloud file. In other words, Microsoft 365. This guide walks through what M365 security actually looks like in 2026: what to turn on, in what order, and what to stop doing. It’s written for the owners, directors, and IT leads of Australian professional services businesses with somewhere between 10 and 200 users, the size where the target is worth attacking but a dedicated security team usually isn’t in the budget. If you use Microsoft 365, you can follow the whole thing yourself. The last section explains where you should think about calling in help instead.

Why your Microsoft 365 tenant is the number one target right now

The Australian Signals Directorate issued a public warning on 16 May 2026 about a technique called device code phishing that specifically targets Microsoft 365 users. In an ordinary phishing attack, the attacker steals your password. Device code phishing skips that step. The attacker starts a legitimate Microsoft sign-in on their own device, receives a code from Microsoft, and then tricks you into approving it, usually inside what looks like a Teams invite or a document share. You enter your credentials and your MFA code on a real Microsoft page. You just signed in on the attacker’s device. MFA didn’t help.

That attack works because M365 is the connective tissue of most modern businesses. One tenant holds the email, the files, the identity system, the video calls, the calendars, and increasingly the AI. Compromise it, and you have everything. Verizon’s 2025 Data Breach Investigations Report found identity was involved in 82% of breaches, and Microsoft’s own security research shows the M365 tenant is now the primary target for both criminal groups and state actors.

The gap is that most businesses believe they’re already fine. CoreView’s 2025 State of Microsoft 365 Security Report found 62% of organisations rate their M365 security maturity as high, while 54% are still missing at least one foundational identity control. In our own audits across Brisbane and Sunshine Coast businesses, the pattern repeats. MFA is turned on for admins but not the average user. Conditional access exists but has never been reviewed. Nobody is looking at the audit logs. The rest of this guide is what fixing that actually looks like.

Lock down identity: MFA, conditional access, and privileged access

If you only ever do one thing, do this section. Identity is where the money either stays inside your business or walks out.

Multi-factor authentication (MFA) on every account

MFA blocks over 99% of automated account takeover attempts, which is why the ACSC lists it as one of the Essential Eight controls. The trick isn’t turning it on. It’s turning it on for everyone, and turning it on with the right second factor.

• Use an authenticator app or FIDO2 hardware key, not SMS: SIM swap attacks are common enough now that SMS-based MFA is regarded as weak. Microsoft Authenticator with number-matching, or a physical key like a YubiKey, are the current defaults.
• Roll out to admins first, then to everyone within 30 days: Global admins and finance staff are the highest-value targets. Get them covered inside a week.
• Track adoption in Microsoft Secure Score: If you don’t measure it, half your users will “get around to it.” Set a compliance deadline and enforce it via conditional access.

Conditional access policies (Microsoft Entra ID P1 or P2)

Conditional access is the layer that decides who gets in, from where, and under what conditions. Security Defaults are the free starting point and cover the basics. They’re not enough on their own for any business handling client data. Custom conditional access policies let you block or challenge risky sign-ins based on real signals.

A working baseline for most 10 to 200 user businesses:

• Require MFA for all sign-ins, with an allow list for known office IP addresses if the team is mostly on-site.
• Block sign-ins from anonymous IP addresses (Tor, known VPN exits used by attackers).
• Block sign-ins from countries you don’t do business in. Almost no Australian professional services firm needs sign-ins from Russia, North Korea, or Iran, and blocking them removes an entire attack surface.
• Enforce device compliance. Only devices that are managed and up to date can access company data.
• Test new policies in report-only mode first. Roll live once you can see who they would have affected and why.

Privileged Identity Management (PIM): stop being a global admin all day

The single most dangerous account in your tenant is the one with the Global Administrator role. Anyone signed in as global admin, all day, with a browser open, is one phishing click away from handing the entire tenant over. PIM (part of Microsoft Entra ID P2) fixes this by making privileged roles just-in-time: the account is a normal user by default, and you elevate to global admin for a defined window, with a reason, when you need it.

CoreView’s research found organisations using PIM experience 64% fewer security incidents. That’s not a marginal improvement. That’s the difference between “we had a scare” and “we lost the tenant.” Set up PIM, cap standing global admins at two (with break-glass accounts stored offline), and require justification for every elevation.

Guest and external access: not set-and-forget

External sharing and guest accounts are useful and, left unmanaged, dangerous. Contractors, ex-clients, and one-off collaborators accumulate in Entra ID for years. A guest account with delegated access to a SharePoint site is a door left unlocked. Set guest expiry, require MFA for guest sign-ins, and run quarterly access reviews to remove stale accounts.

Note: In audits we run across Brisbane firms, the most common finding is not that MFA is missing. It’s that MFA is turned on but with SMS as the second factor, conditional access has never been touched since Microsoft’s defaults were applied, and someone left three ex-employee accounts active as global admins six months ago. All fixable in a day. All catastrophic if left alone. Our managed security services practice starts with exactly this audit.

Turn on the threat protection you already paid for

If you’re on Microsoft 365 Business Premium, Microsoft 365 E3, or E5, you already own most of the tools you need. The problem is they’re not all switched on by default, and the ones that are on are usually not tuned. Here’s what to configure.

Microsoft Defender for Office 365

Defender for Office 365 is the layer that scans email, files, and links for threats. It comes bundled with Business Premium (Plan 1) and E5 (Plan 2). Enable it in the Microsoft 365 Defender portal, then configure these three policies at minimum:

• Safe Attachments: Files coming into email, SharePoint, OneDrive and Teams are opened in a sandbox before delivery. If they detonate, they get blocked. Set the policy to “dynamic delivery” so users get the email body while the attachment is scanning.
• Safe Links: Every URL in incoming email is rewritten so Microsoft can rescan it at click time, not just at delivery time. This defeats the common trick of sending a benign link that goes malicious after delivery.
• Anti-phishing policies with mailbox intelligence: Turn on user and domain impersonation protection. Add your senior staff to the impersonation list (CEO fraud is one of the highest-value attacks against Australian SMEs).

Email authentication: SPF, DKIM and DMARC

SPF, DKIM and DMARC are the three DNS records that prove an email actually came from your domain. Without them, anyone can spoof your address. Configuring them costs nothing and shuts down most spoofing attacks against your brand.

• SPF (Sender Policy Framework): publish an SPF record that lists every server allowed to send email as your domain. End it with “-all” once you’re confident, so unauthorised servers get rejected.
• DKIM (DomainKeys Identified Mail): enable DKIM signing in Exchange Online for your custom domain (it’s off by default). Every outbound message then carries a cryptographic signature receiving mail servers can verify.
• DMARC (Domain-based Message Authentication): start with a “p=none” policy for a month while you check the reports, then move to “p=quarantine” and finally “p=reject.” A DMARC reject policy stops your domain being used to phish your own customers.

The small settings that stop the loud attacks

• Disable external auto-forwarding: Attackers who compromise an inbox often set up a hidden rule that forwards everything to an external address. Blocking auto-forward at the transport rule level kills the exfiltration path.
• Enable zero-hour auto purge (ZAP): This is on by default for most tenants; check yours. ZAP retracts malicious messages from mailboxes after delivery if Microsoft’s back-end scanners flag them later.
• Block risky file types at the transport layer: .exe, .scr, .vbs, .js and .iso attachments almost never have a legitimate business reason to arrive by email.

If you’re on an older M365 plan or unsure what your subscription covers, our Microsoft 365 support team can audit your licence entitlements and turn on what you’re already paying for.

Protect the data itself

Identity keeps attackers out. Data protection contains the damage when someone gets in anyway, or when a legitimate user makes a mistake. In our client base, “user error” still causes more data leaks than external attackers do.

Sensitivity labels via Microsoft Purview

Sensitivity labels classify content and enforce protection wherever the file goes. Label a document “Confidential,” and it can carry encryption, watermarks, and restrictions with it even if someone downloads it to a personal laptop. Start with three or four labels: Public, Internal, Confidential, Highly Confidential. Don’t create fifteen levels. Nobody will use them.

Data Loss Prevention (DLP) policies

DLP policies watch for sensitive information (Australian Business Numbers, Medicare numbers, credit card data, patient names next to Medicare details) as it moves through Exchange, SharePoint, OneDrive and Teams. When a policy triggers, the message or file can be blocked, quarantined, or an alert sent. Microsoft Purview ships with pre-built DLP templates for Australian regulated data, including a Notifiable Data Breach template that aligns with the Privacy Act 1988.

Retention and litigation hold

Retention policies decide how long content is kept, and when it must be deleted. Legal, medical, and financial firms have statutory retention obligations that can range from seven years to indefinite. Apply retention labels to the relevant SharePoint sites and Exchange folders. Enable Litigation Hold on any mailboxes that could be subject to legal discovery.

Change your default sharing settings

SharePoint and OneDrive default to “Anyone with the link” for shared files. That’s convenient. It’s also how confidential documents end up indexed by Google, or forwarded to competitors. Change the tenant default to “Specific people” and require sign-in for external shares. If you must allow anonymous links, set them to expire in 30 days and to be view-only.

Watch out for: One of the fastest ways to lose control of your data is a well-meaning employee sharing a Teams file with “Anyone with the link” and posting the link into an external group chat. Sensitivity labels plus tightened default sharing settings stop this being a career-ending click.

Back up your tenant. Microsoft doesn’t do it for you

This is the single biggest gap we find. Microsoft’s Shared Responsibility Model is clear: Microsoft runs the platform and keeps the lights on. Your data is your problem. What that actually means, in day-to-day terms:

• Deleted emails go to Recoverable Items for 14 days by default (extendable to 30). After that, they’re gone.
• SharePoint and OneDrive keep deleted items for 93 days in the recycle bin. After that, gone.
• Microsoft’s own retention policies apply to the platform, not to a granular restore of your business’s data. If a user deletes a critical folder and it isn’t caught inside the recycle window, or if ransomware encrypts every file the user has access to, native M365 is not going to hand it back.

This is why every business we work with runs a third-party M365 backup solution. Backups run nightly, cover Exchange, SharePoint, OneDrive and Teams, and let us restore individual items back to the point in time before the accident. If this isn’t in place today, our cloud backup service is the fastest way to close the gap.

The bigger gap: your tenant configuration

Microsoft has no native backup for your tenant configuration. Not for your conditional access policies, DLP rules, sensitivity labels, Teams settings, Exchange transport rules, or your Entra ID structure. CoreView’s 2025 research found roughly half of businesses don’t realise this, and only 18% back their configuration up manually.

The scenario this protects against: a compromised admin account, or a well-meaning consultant, changes a critical conditional access policy at 4 pm on a Friday. By Monday morning, your users can’t sign in. Without a configuration snapshot, you’re rebuilding from memory. With one, you restore the last known good state in minutes.

For a business of 10 to 200 users, this is usually done with a purpose-built tool (CoreView, AvePoint, or similar) that snapshots the tenant configuration nightly and detects drift. If you don’t have that, at minimum, document your configuration in a version-controlled workbook and update it every time you change something material.

Harden the devices and apps that connect to your tenant

A locked-down tenant reached from an unpatched laptop is only as secure as the laptop. Microsoft Intune (bundled with Microsoft 365 Business Premium and E3/E5) is the device management layer that ties everything together.

Device compliance baseline

• Require full disk encryption: BitLocker on Windows, FileVault on macOS. Prevents a stolen laptop turning into a data breach.
• Enforce OS and patch compliance: Set a maximum age for pending security patches. Devices out of compliance lose access via conditional access.
• Require Secure Boot and TPM 2.0 on Windows: Blocks a range of firmware-level attacks.
• Auto-remove stale devices: Any device that hasn’t signed in for 90 days gets disabled. Reduces the attack surface of ex-employee laptops that were never handed back.

BYOD without giving up control

If your team uses personal phones or laptops to access M365, deploy Intune App Protection Policies. These sit on the individual app (Outlook, Teams, OneDrive) rather than the whole device, so you can require PIN protection, prevent copying company data into personal apps, and wipe just the corporate data when someone leaves. The employee’s personal photos stay put. For businesses with fully remote or distributed teams, our managed IT services for remote companies cover this end-to-end.

SharePoint, Teams and Exchange hardening

• Restrict Teams and SharePoint site creation to approved groups. Otherwise you end up with hundreds of orphaned sites and no owner.
• Disable external Teams chat unless there’s a business need. Attackers use Teams external messages to bypass email filtering.
• Block file types that don’t belong in SharePoint: .exe, .msi, .iso, .bat. Nobody uploads these for legitimate reasons in a professional services firm.
• Require admin consent for third-party OAuth apps: OAuth phishing (where a user is tricked into granting a malicious app permission to read their mailbox) is now one of the top three attack vectors we see. Requiring admin approval for third-party consent shuts it down.

Monitoring and incident response

Most breaches are detected weeks after they happen, not during. The reason is simple: nobody was looking at the audit logs. M365 gives you the visibility for free. You just have to actually use it.

Turn on and retain the unified audit log

The unified audit log records every meaningful action taken inside your tenant: sign-ins, file accesses, admin changes, sharing events. It’s on by default in most tenants, but retention is 180 days for standard licensing. If you’re a professional services firm, extend that to 365 days (available with Microsoft 365 E5 or the Advanced eData Audit add-on), or export logs to Microsoft Sentinel for longer retention.

Alert policies that actually get read

The default alert policies in Microsoft 365 Defender fire on things you should care about, but you have to tell them where to send the alert. Route them to a monitored mailbox or a Teams channel, not a shared inbox that nobody checks. The alerts that matter most:

• New admin role assignments
• Sign-ins from anonymous IP addresses or high-risk geographies
• Impossible travel events (sign-in from Brisbane at 9 am, sign-in from Lagos at 9:15 am)
• Mass downloads or mass deletions of SharePoint or OneDrive content
• Creation of new inbox forwarding rules to external addresses
• Unusual activity on shared mailboxes or service accounts

Have an incident response plan. Practise it

When the alert fires at 11 pm on a Sunday, the people who need to act should already know their role; write the incident response plan down before you need it. It should cover, at minimum: who declares an incident, who takes the lead, how you contain a compromised account (usually a global sign-out plus password reset plus revoke sessions), how you preserve evidence, who talks to the affected users and clients, and when the Office of the Australian Information Commissioner needs to be told under the Notifiable Data Breach scheme.

Run a tabletop exercise twice a year. Take the plan out, invent a plausible scenario (“the finance manager’s mailbox is being used to send invoice fraud emails right now”), and walk through it. Every time we run one of these with a client, we find at least one gap that would have caused a real delay in a real incident.

The Australian compliance layer

Microsoft’s controls are the same globally. What sits on top of them is uniquely Australian, and depending on your industry, it changes how you configure the tenant.

The ACSC Essential Eight

The Essential Eight is the ACSC’s baseline set of mitigation strategies. Maturity Level 1 (ML1) is the target for most SMEs; ML2 and ML3 apply to businesses handling sensitive government or critical infrastructure data. Six of the eight controls map directly to Microsoft 365 settings: application control, patch applications, configure Microsoft Office macro settings, user application hardening, restrict administrative privileges, patch operating systems, MFA, and regular backups. In practical terms, if you’ve followed sections 2 through 6 of this guide, you’re close to ML1 already.

The Privacy Act and the Notifiable Data Breach scheme

If your business turns over more than $3 million a year, or you handle health information, tax file numbers, or credit reporting data, you’re covered by the Privacy Act 1988 and the Notifiable Data Breach scheme. Any data breach “likely to result in serious harm” must be assessed within 30 days and, if confirmed, reported to both affected individuals and the Office of the Australian Information Commissioner. The DLP templates in Microsoft Purview include an NDB template that helps you spot the kinds of data that trigger the scheme.

Industry-specific rules

• Healthcare (medical, dental, radiology): The RACGP Information Security Standards, the My Health Records Act 2012, and the AHPRA rules on patient confidentiality all shape how you configure identity, sharing, and audit. Best Practice, Medical Director, and radiology PACS systems all sit on top of the M365 tenant in most modern practices. We cover the nuances in our medical IT support and dental IT support service pages.
• Legal firms: The Legal Profession Uniform Law and the Legal Profession Complaints Committee guidance on client data hold you to strict confidentiality and file retention rules. Retention labels and DLP policies are effectively mandatory. See our IT support for law firms page for the practical setup.
• Financial services: APRA CPS 234 (Information Security) requires regulated entities to maintain information security capability commensurate with the vulnerabilities and threats. That includes documented incident response, tested backups, and third-party risk management.
• Critical infrastructure: The Security of Critical Infrastructure Act 2018 (SOCI) covers 11 sectors and has specific obligations for risk management, incident reporting, and system information register submissions.

Old habits to abandon in 2026

Some practices that were fine five years ago are now actively risky. If any of these describe your setup, they’re the first things to change.

• Basic authentication: Deprecated across Microsoft 365. Block all basic auth via conditional access. Any legacy protocol still using it (old IMAP or POP3 clients, unattended scripts with saved credentials) is a bypass around your MFA.
• SMS as your second factor: SIM swap fraud in Australia has grown fast enough that SMS-based MFA is now considered weak by the ACSC. Move to Microsoft Authenticator with number-matching or hardware keys.
• Running as global admin all day: Even if the admin account has MFA, one bad click or one browser exploit and the attacker inherits the role. Use PIM.
• Assuming Security Defaults is enough: Security Defaults were designed for the smallest tenants. Anyone with a Business Premium licence or above should be running custom conditional access, not the default policy set.
• Assuming Microsoft backs up your data: They don’t. Neither do they back up your tenant configuration. Both need to be handled separately.
• Ignoring the audit log until you need it: By the time you need it, you’ll have forgotten how to enable it and 180 days will have already ticked past.

Should you do this yourself, or bring in help?

A lot of what’s in this guide can be done by a capable internal IT person over a few weeks. Turning on MFA. Configuring Safe Attachments. Setting SPF, DKIM and DMARC. Publishing a retention policy. If you have the time and the appetite, do it. It’s not black magic.

The parts that trip people up, in our experience, are the ones where “good” is subjective. What conditional access policies actually make sense for your business? Which DLP rules will fire ten times a day and get switched off out of frustration, and which ones will save you from a Notifiable Data Breach report? What does your incident response plan need to include for a legal firm versus a radiology practice versus an accounting firm? Those calls take field experience, and they’re where an MSP earns its fee.

The other honest reason to bring in help is that ongoing security work is different from setting it up once. Alerts get raised at 11 pm. New attack techniques (device code phishing, OAuth consent phishing, token theft) get discovered every few months and need policy changes. Microsoft ships new features constantly, and the ones you should turn on aren’t always obvious. Doing this well takes someone whose job it is to be paying attention.

If you’d rather have someone else own that, we do this for a living. We work with Australian professional services businesses across Brisbane, the Sunshine Coast, and remote-first teams nationwide. Our M365 tenant security review covers identity, threat protection, data protection, backup, devices, and monitoring, and returns a written gap analysis against the Essential Eight. Most reviews take a week. The remediation plan afterwards depends on what we find, but it’s usually done inside a month.

Book a free M365 security review

Want a written gap analysis of your Microsoft 365 tenant against the Essential Eight and the checklist in this guide? Book a free M365 security review with CRT, and we’ll deliver it inside a week. Call 1300 760 339 or request a quote online.