How Secure Is Your
Microsoft 365 Tenant?

Microsoft 365 Security Assessment: How to Check If Your Tenant Is Actually Protected

Most small and mid-sized businesses run their entire operation on Microsoft 365 — email, file sharing, identity management, collaboration. But very few have actually audited their M365 security configuration. The default settings Microsoft ships with are designed for convenience, not protection. That gap between "turned on" and "locked down" is exactly where attackers operate.

A Microsoft 365 security assessment evaluates how your tenant is configured across identity and access management, email threat protection, data loss prevention, and endpoint security. The goal is simple: find the misconfigurations and policy gaps that leave your organization exposed, then fix them in priority order before an attacker finds them first.

The self-assessment tool above gives you a quick read on where you stand. Below, we break down what a thorough M365 security review actually covers — and why each area matters.

What Is Microsoft Secure Score and Why Does It Matter?

Microsoft Secure Score is a built-in metric available in the Microsoft Defender portal that grades your tenant's security posture on a percentage scale. It evaluates your configurations across identity, devices, apps, and data, then compares your score against Microsoft's recommended best practices. A higher score means you've implemented more of the security controls Microsoft considers essential.

The problem is that most businesses never look at it. According to research from CoreView, 60% of organizations consider themselves to have "advanced security" — yet experience the same rate of account compromise as organizations with the most basic implementations. The disconnect between perceived security and actual protection is enormous.

Your Secure Score isn't a guarantee you won't be breached, but it's the fastest way to identify the low-hanging fruit an attacker would exploit first. Think of it as a prioritized to-do list for hardening your environment.

The 4 Pillars of an M365 Security Assessment

A complete Microsoft 365 security review isn't just about checking one box. It covers four interconnected areas, and weakness in any one of them can undermine the others.

1. Identity and Access Management

Identity is the new perimeter. With cloud-first environments, there's no firewall sitting between an attacker and your data — there's only authentication. If your identity controls are weak, everything else downstream is compromised.

The most critical controls in this category include enforcing multi-factor authentication for every user (not just admins), blocking legacy authentication protocols that bypass MFA entirely, implementing Conditional Access policies that evaluate risk signals before granting access, limiting Global Administrator accounts to no more than four, and using Privileged Identity Management for just-in-time admin access instead of permanent role assignments.

MFA alone blocks over 99% of automated account compromise attacks. But "enabled" isn't the same as "enforced." If users can opt out or if legacy protocols like POP3 and IMAP remain open, attackers simply route around MFA. A proper assessment verifies that MFA is enforced through Conditional Access policies with no escape hatches.

2. Email and Threat Protection

Email is still the number one attack vector. Phishing, business email compromise, and malware delivery all start in the inbox. Microsoft 365 includes strong email security tools, but they require deliberate configuration to be effective.

A thorough email security review checks whether SPF, DKIM, and DMARC records are all configured and enforced (not just SPF alone), whether Microsoft Defender for Office 365 Safe Links and Safe Attachments are active, whether anti-phishing policies include impersonation protection for executives and key partners, and whether external email tagging is enabled so users can visually distinguish outside senders.

Many organizations have basic Exchange Online Protection active but haven't enabled the advanced Defender for Office 365 features their license includes. Safe Links alone can prevent a significant number of credential-harvesting attacks by scanning URLs at click time — after the email has already been delivered and the initial scan has passed.

3. Data Security and Compliance

Protecting data once it's inside your M365 environment is just as important as keeping threats out. This pillar covers audit logging, data loss prevention, sensitivity labels, and external sharing controls.

Unified audit logging is non-negotiable. Without it, you have zero forensic visibility when something goes wrong. If a mailbox is compromised, audit logs are how you determine what was accessed, what was forwarded, and how the attacker got in. Default retention is 90 days — many compliance frameworks require longer.

External sharing in SharePoint and OneDrive is another common gap. Default settings allow users to share files with anyone, including generating anonymous links that require no authentication. A security assessment should verify that sharing is restricted to authenticated guests or specific partner domains, with anonymous link creation disabled.

4. Device and Endpoint Security

If unmanaged devices can access your M365 data without restriction, then your identity controls only go so far. An attacker who compromises a personal laptop with a saved browser session has access to everything — email, SharePoint, Teams, OneDrive.

The strongest configuration combines Conditional Access policies that require device compliance through Microsoft Intune, endpoint detection and response through Microsoft Defender for Endpoint or an equivalent EDR solution, and app protection policies that prevent corporate data from being copied to personal apps or backed up to unmanaged cloud storage.

For organizations that aren't ready for full device enrollment, App Protection Policies (also known as Mobile Application Management) offer a lighter-weight approach that protects corporate data at the app level without requiring full device control.

Common Microsoft 365 Security Gaps We Find in Small Businesses

After assessing Microsoft 365 environments across dozens of small and mid-sized businesses, the same gaps show up repeatedly. These aren't obscure edge cases — they're the most common misconfigurations that attackers actively exploit.

MFA enabled but not enforced. Security Defaults are turned on, but users have registered only one authentication method or legacy auth protocols remain open, creating bypass paths.

Too many Global Admins. We regularly see tenants with 8, 10, or even 15 Global Administrator accounts. Every one of those accounts is a high-value target. Microsoft recommends two to four, with break-glass emergency accounts that are cloud-only.

No Conditional Access beyond defaults. Security Defaults provide a baseline, but they're a blunt instrument. Custom Conditional Access policies allow you to enforce device compliance, block risky sign-in locations, require step-up authentication for sensitive apps, and much more.

SPF configured, but no DKIM or DMARC. SPF alone doesn't prevent domain spoofing. All three email authentication protocols need to work together, with DMARC set to a reject or quarantine policy — not just monitoring.

Audit logging at default retention. 90 days sounds like a lot until you realize the average time to detect a breach is over 200 days. By the time you discover the compromise, the evidence may already be gone.

SharePoint sharing wide open. Anonymous sharing links are still enabled, and no restrictions exist on external sharing. Sensitive documents can be shared with anyone, anywhere, with no audit trail.

How to Improve Your Microsoft 365 Secure Score

Improving your score isn't about enabling every feature at once. It's about prioritizing the highest-impact actions first and implementing them carefully so you don't disrupt your users.

1. Enforce MFA through Conditional Access. Move beyond Security Defaults. Create a Conditional Access policy that requires MFA for all users, all cloud apps, with no exclusions except your break-glass accounts. Block legacy authentication in a separate policy.
2. Reduce admin privilege sprawl. Audit your Global Admin list. Remove unnecessary permanent assignments and implement PIM for just-in-time elevation. Use the least-privilege role that fits each admin's actual duties.
3. Configure full email authentication. Set up SPF, DKIM, and DMARC for every domain in your tenant. Start DMARC in monitoring mode (p=none), verify your legitimate senders are passing, then move to quarantine and eventually reject.
4. Enable Defender for Office 365 features. Turn on Safe Links, Safe Attachments, and anti-phishing policies with impersonation protection. Configure these for all users, not just executives.
5. Restrict external sharing. Set SharePoint and OneDrive external sharing to "existing guests only" or "specific domains." Disable anonymous links. Review and clean up existing external shares.
6. Extend audit log retention. If your license supports it, extend unified audit log retention beyond 90 days. For compliance-sensitive industries, consider 365 days or longer.
7. Require device compliance. Deploy Intune compliance policies and tie them to Conditional Access. Start with a pilot group, verify the policies work correctly, then expand to all users.

Frequently Asked Questions