Microsoft 365 Hardening: 10 Settings We Change on Day One

Microsoft 365 tenants ship with defaults designed for onboarding friction, not security posture. That's a deliberate Microsoft choice, and it's fine for a five-person agency. It is not fine for a company with regulated data, enterprise buyers, or a growing employee base.

The exact list varies by engagement and usually runs to at least ten settings. These are the ten we start with, ordered roughly by risk reduction per hour of effort.

1. Disable legacy authentication

Legacy authentication skips MFA, so any sign-in that uses it goes around your MFA enforcement. Microsoft has already removed Basic authentication for POP, IMAP, and Exchange ActiveSync in Exchange Online, and SMTP AUTH is next (Microsoft on the deprecation). Block legacy authentication in Conditional Access anyway, as the first block policy, so older clients and other services are covered too. Anything that still uses legacy auth in 2026 should either be replaced or given a conscious, documented exception.

2. Enforce MFA for every user, admins included

Security Defaults gets you most of the way. Enforcing MFA on every user in Conditional Access gets you the rest, with control over methods (app-based, FIDO2 keys) and fallback behavior. Admins-only MFA is a compromised-account waiting to happen, because compromise usually starts at a standard user.

3. Build a Conditional Access baseline

Three policies are the floor: block legacy auth, require MFA for all users, require compliant device or MFA for admin portals. Above that, you add geography restrictions, session controls, and device compliance as the tenant matures. Baseline policies are exit criteria from Security Defaults, not a replacement for thinking.

4. Tighten external sharing defaults

OneDrive's default external sharing setting is "Anyone", which allows links that work for whoever holds them (Microsoft's default sharing settings). Tighten the default link type to "specific people" or "only people in your organization" at the tenant level, and grant exceptions per-site when business need justifies it. This alone eliminates most accidental external exposure.

5. Configure anonymous link expiration

If you permit anonymous links at all, set a short default expiration (30 or 60 days) and enforce password protection. Shared links that never expire are a known exfiltration path.

6. Maximize audit log retention

Audit log retention defaults vary by license. Set it to the maximum available for your SKU. An investigation can only look back as far as the logs go. Paying for log storage is cheap insurance compared to flying blind during an incident.

7. Enable unified audit log

The unified audit log is still opt-in on some tenants. Without it, you cannot correlate events across Exchange, SharePoint, Entra ID, and Teams. It is a one-click change in the Microsoft Purview portal and it is consistently overlooked.

8. Enable Safe Links and Safe Attachments

Included in Defender for Office 365. Safe Links rewrites URLs in email and Teams to a time-of-click scan. Safe Attachments detonates attachments in a sandbox. Tenants with Defender for Office 365 get a baseline of both from the Built-in protection preset policy, which is on by default; the Standard and Strict preset policies, which apply Microsoft's recommended settings, stay off until someone turns them on and assigns users (Microsoft on preset security policies).

9. Review and restrict Teams external access

By default, Teams allows federation with any other Teams tenant and often allows guest access broadly. Tighten external access to an allow-list of trusted partner tenants, and govern guest access through Conditional Access and access reviews.

10. Enable Privileged Identity Management for admin roles

Global Admin should never be a standing assignment. PIM gives you just-in-time elevation with approval workflows and session logging. It needs Microsoft Entra ID P2 or Entra ID Governance, which come with Microsoft 365 E5 or as add-ons to Business Premium (Microsoft on PIM licensing). This is table stakes for any company pursuing SOC 2 or HIPAA, and it prevents the most expensive incidents: compromised standing admin accounts.

Doing all ten on day one breaks things. The sequence we use on real engagements:

1. Enable unified audit log and max retention (zero user impact, enables everything else)
2. Roll out MFA to admins and IT staff first; verify no gaps
3. Roll out MFA to the whole workforce with a 7-day notice window
4. Add the Conditional Access baseline policies in report-only mode; monitor for a week; promote to enforce
5. Tighten external sharing defaults and Teams federation (expect some workflow questions, communicate)
6. Enable Safe Links and Safe Attachments (expect a few false positives early)
7. Enable PIM for admin roles last, once you've validated the rest of the stack

The whole rollout, done well, takes 2 to 4 weeks for a company under 100 people. The risk reduction is measurable from the first week.