Microsoft 365 is the most widely deployed productivity suite worldwide and a primary target for phishing, business email compromise (BEC), and ransomware delivery. In 2025, BEC attacks cost organizations over $3 billion per the FBI IC3 report. Microsoft provides powerful M365 security controls — but most organizations leave them misconfigured or disabled. This guide covers the most impactful M365 security controls for 2026.
Microsoft Secure Score: Your Starting Point
Navigate to security.microsoft.com and check your Secure Score immediately. Most tenants start at 35-45%. Follow improvement actions sorted by points per implementation effort. Target 80%+ within 30 days. Each percentage point represents real risk reduction per Microsoft telemetry.
MFA Enforcement
Single-factor authentication is categorically insufficient. Enable MFA via Conditional Access for all users. Use Microsoft Authenticator with number matching to prevent MFA fatigue. Require phishing-resistant MFA (FIDO2 or Windows Hello) for all administrative accounts.
Anti-Phishing Policies
Configure Microsoft Defender for Office 365: enable mailbox intelligence, protect C-suite and finance as priority accounts, protect your top 10 domains, enable anti-spoofing intelligence, set phishing action to quarantine (not junk folder).
Safe Links and Safe Attachments
Safe Links rewrites and checks URLs at click-time against threat intelligence. Safe Attachments detonates email attachments in a sandbox before delivery. Enable both. Set Safe Attachments to Dynamic Delivery so recipients can read email text while attachments are analyzed.
Email Authentication: DMARC, DKIM, SPF
| Protocol | What It Does | Required Setting |
|---|---|---|
| SPF | Lists authorized sending IPs | -all (hard fail) in DNS TXT |
| DKIM | Cryptographically signs outbound email | Enable in M365 admin for all domains |
| DMARC | Policy for SPF/DKIM failures | p=reject after monitoring phase |
Block Legacy Authentication
Legacy protocols (IMAP, POP3, Basic Auth) bypass MFA entirely. Microsoft reports 99%+ of password spray attacks use legacy authentication. Create a Conditional Access policy: conditions = legacy authentication clients, grant = block. Verify no service accounts require legacy auth before enabling.
Audit Logging
Enable Unified Audit Logging in M365 Compliance Center. Set retention to 90 days minimum (180+ for E3/E5). Send logs to Microsoft Sentinel or third-party SIEM. Enable Mailbox Audit Logging for all users. Alert on: impossible travel logins, mass email deletion, forwarding rule creation, admin privilege escalation.
🔗 Further Reading
FAQs
Why block legacy authentication protocols?
Legacy protocols (IMAP, POP3, Basic Auth) do not support MFA. Attackers use them to bypass MFA-enforced Conditional Access and authenticate with stolen passwords only. Over 99% of password spray attacks use legacy authentication protocols per Microsoft telemetry.
What is Microsoft Secure Score?
Secure Score measures your M365 and Azure security posture numerically. Higher scores correlate with lower compromise probability. Available at security.microsoft.com with prioritized improvement actions.
Key Takeaways
- Check Secure Score immediately and target 80%+ within 30 days
- Block legacy authentication protocols to prevent MFA bypass
- Enable Safe Links and Safe Attachments with Dynamic Delivery
- Configure DMARC p=reject after monitoring phase
- Enable Unified Audit Logging with 180+ day retention and SIEM integration
Conclusion
M365 security centers on MFA, Conditional Access, email authentication, and audit logging. Microsoft provides all required tools — the challenge is enabling them correctly. Use Secure Score as your continuous measurement. Related: Identity and Access Management Guide.
Sources
- Microsoft 365 Security Best Practices – learn.microsoft.com
- FBI IC3 Internet Crime Report 2025 – ic3.gov
- CISA Microsoft 365 Security Guidance – cisa.gov
Blocking Legacy Authentication
Legacy protocols (IMAP, POP3, Basic Auth) bypass MFA because they do not support modern authentication challenges. Block via Conditional Access: create a policy targeting All Users, All Cloud Apps, condition Client Apps = Legacy Authentication Clients, Grant = Block. Monitor Sign-in logs for 14 days before enforcing to identify exceptions. Apps using Basic Auth must be updated or decommissioned.
Key Takeaways
- Block legacy authentication via Conditional Access before enabling MFA enforcement
- Target Secure Score above 75 within 30 days of initial hardening
- Enable Safe Links and Safe Attachments on all mailboxes without exception
- Run Attack Simulator quarterly to measure user susceptibility to phishing
