Not sure what is switched on in your tenant? Brydan reviews your Microsoft 365 configuration and tells you plainly where the gaps are — see our Microsoft 365 services.
Key Takeaways
- ›Microsoft secures the platform, not your tenant. The defaults are chosen for compatibility with old software, not for your safety.
- ›Turn on MFA, switch off legacy authentication, and separate admin accounts first. Those three close most of the gap and cost nothing but an afternoon.
- ›MFA alone is no longer enough. Attackers now proxy the real login page and steal the session after you approve the prompt correctly.
- ›Most businesses running Business Premium have paid for security features they never configured. The licence is rarely the gap; the configuration is.
Microsoft secures the platform. You secure the tenant.
The single most useful thing to understand about Microsoft 365 security is where Microsoft’s responsibility stops. Microsoft keeps the service running, patches the infrastructure, defends the datacentres, and guarantees availability. What happens inside your tenant — who can sign in, from where, with what, and what they can reach once they are in — is yours.
This matters because a new tenant does not arrive locked down. It arrives configured for the widest possible compatibility, so that a business with a fifteen-year-old scanner and a line-of-business application that only speaks legacy protocols can still get email working on day one. Those choices are reasonable defaults for Microsoft. They are poor defaults for you.
Microsoft has genuinely improved this over the past few years — security defaults on new tenants are far better than they were — but “better than it used to be” is not the same as configured. Almost every tenant we take over has at least one of the gaps below.
The baseline: three things to do first
If you do nothing else from this article, do these three. Between them they close the majority of the realistic risk, and none of them requires a licence upgrade or a project plan.
1. Multi-factor authentication on every account, without exception
MFA is the highest-value security control available to a small business, and the exceptions are what undo it. The pattern we see repeatedly is MFA enabled for staff but skipped for the owner, the bookkeeper, or the shared mailbox that three people use — which are precisely the accounts an attacker most wants. An exception list is an attack plan.
Prefer an authenticator app over SMS. Text-message codes can be intercepted through SIM-swap attacks, and while that is a targeted technique rather than a mass one, the app is free and no harder to use.
2. Turn off legacy authentication
Legacy authentication covers the older protocols that predate modern sign-in — and critically, they cannot enforce MFA. Leaving them enabled means an attacker can simply choose the door that has no lock on it, no matter how carefully you configured the front entrance.
The reason it is still switched on in so many tenants is that something old depends on it: a multifunction printer that scans to email, an accounting package, an alarm panel that sends reports. Find those first, because switching legacy auth off without checking will break them. Usually the fix is a firmware update or an app password, and occasionally it is replacing a device that should have been replaced anyway.
3. Separate your admin accounts
The account you read email on should not be the account that can reconfigure the tenant. When a day-to-day account is also a global administrator, a single successful phish gives the attacker everything at once — mailboxes, files, security settings, and the ability to lock you out of your own tenant.
The fix is a separate administrative account used only for administration, with its own MFA, no mailbox, and no email client signed in to it. Keep the number of global administrators small; two is usually right, one is a single point of failure, and five is an unnecessary surface.
MFA is necessary. It is no longer sufficient.
This is the part of the picture that has changed most recently, and it catches out businesses who reasonably believed they had done the work.
Adversary-in-the-middle phishing places a proxy between your user and the genuine Microsoft login page. The user sees the real page, because it is the real page relayed through the attacker. They enter their password, they approve the MFA prompt on their phone, and everything looks correct — because everything is correct. What the attacker captures is the session token issued afterwards, which lets them resume an already-authenticated session without ever needing the password or a second factor again.
Nothing about the user’s behaviour was wrong in that sequence, which is why “train people to spot phishing” stops being a complete answer. We have written up how these attacks work in detail in MFA isn’t enough anymore. The defences that actually help are conditional access, phishing-resistant authentication where it is practical, and monitoring that notices an impossible sign-in after the fact.
Email security beyond the defaults
Email remains the way most businesses get compromised, and the out-of-the-box filtering catches the obvious material while letting through the things aimed specifically at you.
Three configurations are worth the effort. Anti-phishing policies with impersonation protection flag messages that appear to come from your own executives or domains that look almost like yours — the mechanism behind most invoice fraud. SPF, DKIM and DMARC published correctly on your domain make it substantially harder for anyone to send mail that appears to be from you, which protects your clients as much as it protects you. And external sender warnings, a small visual banner on mail from outside the organisation, do more practical good than their simplicity suggests.
If any of this is unfamiliar, the underlying attack is worth understanding first: business email compromise, explained.
Conditional access, without locking your team out
Conditional access is the difference between a tenant that merely checks who you are and one that also considers the circumstances. It is included in Business Premium and above, and it is the most commonly paid-for and least commonly configured feature in Microsoft 365.
The apprehension is understandable — nobody wants to be the person who locked the whole company out on a Monday morning. In practice the policies worth starting with are conservative: block sign-ins from countries you never operate in, require a managed or compliant device for administrative accounts, and require reauthentication for risky sign-ins rather than blocking them outright.
Two rules make this safe. Always keep one break-glass administrator account excluded from conditional access policies, stored securely and never used day to day. And always run new policies in report-only mode first, so you can see who would have been blocked before anyone actually is.
Data protection and what happens when someone leaves
Retention policies decide how long deleted items and old mail stick around, and they are worth setting deliberately rather than accepting whatever is there. Two things are commonly confused, though, and the distinction is expensive.
Retention is not backup. Microsoft protects the service against its own failures and gives you limited windows to recover deleted items. It does not maintain a restorable copy of your data against accidental deletion, a departing employee clearing a mailbox, or ransomware. That gap surprises people at the worst possible moment — the full explanation is in Microsoft 365 backup: why your data isn’t as safe as you think.
Offboarding deserves a defined process for the same reason. Converting a mailbox rather than deleting it, revoking active sessions rather than only resetting the password, and reassigning file ownership before the account disappears are all easy in the moment and painful to reconstruct six months later. We covered the full sequence in what happens to your data when an employee leaves.
What Secure Score does and does not tell you
Microsoft Secure Score gives your tenant a percentage and a list of recommended improvements. It is genuinely useful as a prompt — it will surface things you had not thought about — and it is a poor target to optimise for.
The score weights every recommendation by Microsoft’s model of general risk, not by your business. Some high-scoring items are irrelevant to a twelve-person office; some things that matter enormously to you barely move the number. A tenant at 65% with MFA everywhere, legacy authentication off, and separated admin accounts is in far better shape than one at 80% that has accumulated points elsewhere while leaving those three undone.
Use it as a checklist to review, not a number to chase.
A practical order to work through
Doing all of this at once is how projects stall. This is the sequence we use, and it is deliberately front-loaded — the first week closes most of the risk.
| When | What | Why this order |
|---|---|---|
| Week 1 | MFA everywhere, no exceptions. Audit who holds global admin. | Highest risk reduction per hour spent. |
| Week 1–2 | Inventory what still uses legacy authentication, then switch it off. | Inventory first, or you will break the scanner and lose the room. |
| Week 2 | Separate admin accounts; create and store a break-glass account. | Needed before conditional access, so you cannot lock yourself out. |
| Week 3 | Anti-phishing and impersonation policies; SPF, DKIM, DMARC; external sender banner. | Closes the channel most compromises actually arrive through. |
| Week 4 | Conditional access in report-only mode, then enforce. | Report-only shows you the blast radius before anyone is blocked. |
| Ongoing | Third-party backup, retention review, offboarding process, sign-in monitoring. | These are habits, not tasks. They fail quietly when nobody owns them. |
The licence is rarely the problem
Businesses often ask whether they need to upgrade to secure Microsoft 365 properly. Usually the answer is no. Business Premium already includes conditional access, Intune, Defender for Office 365 and data loss prevention, and most small businesses on that licence are using a fraction of it.
The genuinely common failure is paying for Business Premium and running it with Business Standard configuration — the capability is bought and never switched on. If you are on that plan, the useful question is not what to buy next, but what you are already entitled to that is currently switched off.
Where to start
If you take one thing from this: check whether MFA has exceptions, and check who holds global administrator. Those two answers tell you most of what you need to know about the state of your tenant, and both take about ten minutes to find.
If the answers are uncomfortable, that is worth acting on rather than filing away. Brydan Solutions reviews Microsoft 365 configurations for Las Vegas businesses and reports plainly on what is switched on, what is not, and what actually matters given how your business runs — see our Microsoft 365 services and cybersecurity services. Still weighing the platform itself? See Microsoft 365 vs Google Workspace, or read the Cloud & Microsoft 365 glossary if any of the terminology above was unfamiliar.
Talk to Brydan
Do You Know What Is Switched On in Your Tenant?
We review your Microsoft 365 configuration against the baseline above and give you an honest list of what is missing — whether or not you end up working with us.
About the Author
Brydan Solutions is a veteran-owned, minority-owned managed IT and cybersecurity provider based in Las Vegas, serving Nevada businesses since 2002. We are a Microsoft Cloud Solution Provider and manage Microsoft 365 environments for small and mid-sized organizations across the Las Vegas Valley and remotely nationwide. Learn about our team or talk to a real person.
Continue Reading
