10 settings every new Microsoft 365 tenant needs on day one

A new tenant is the cheapest moment to get security right. Nobody depends on the bad defaults yet, so nothing breaks when you change them.

This is the order I work in. Identity first, because that's where most real incidents start. Then email. Then sharing.

Licensing note: Conditional Access needs Entra ID P1, which comes with Microsoft 365 Business Premium, E3 and E5. On Business Standard or Basic, use security defaults instead.

1. Create two break-glass accounts

Two cloud-only admin accounts on your *.onmicrosoft.com domain, not tied to any person. Protect them with a FIDO2 key or passkey, exclude them from Conditional Access policies that could lock you out, and alert on every sign-in.

If your identity provider or your only admin's phone fails, these are how you get back in.

2. Require MFA for everyone, and phishing-resistant MFA for admins

Turn on security defaults, or a Conditional Access policy that requires MFA for all users. For admin roles, go further: require an authentication strength of phishing-resistant MFA (FIDO2, passkeys, Windows Hello for Business).

SMS and push approvals are better than nothing. They don't stop an AiTM proxy.

3. Block legacy authentication

Legacy protocols can't do MFA, so they're a way around everything in step 2. Create a Conditional Access policy that blocks the "Exchange ActiveSync clients" and "Other clients" conditions for all users.

Run it in report-only mode for a week first and check the sign-in logs for anything still using them. Old scanners and printers sending mail over SMTP AUTH are the usual suspects.

4. Keep Global Administrators between two and four

Every Global Admin is a full-tenant compromise waiting to happen. Give people the narrowest role that does the job: Exchange Administrator, User Administrator, Security Reader. If you have Entra ID P2, use PIM so admin roles are activated only when needed.

5. Stop users from consenting to random apps

Illicit consent grants are phishing without a password. In the Entra admin center, under Enterprise applications → Consent and permissions, allow user consent only for verified publishers and low-risk permissions, and turn on the admin consent workflow so people can request the rest.

6. Confirm the unified audit log is on

You can't investigate what you didn't record. It's on by default in new tenants, but confirm it:

Connect-ExchangeOnline
Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled
 
# If it returns False:
Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true

7. Publish SPF, enable DKIM, start DMARC

For every custom domain that sends mail:

• SPF: v=spf1 include:spf.protection.outlook.com -all
• DKIM: enable it in the Defender portal under Email authentication settings after publishing the two CNAME records it gives you.
• DMARC: start with monitoring, then tighten.

_dmarc.contoso.com  TXT  "v=DMARC1; p=none; rua=mailto:[email protected]"

Read the reports for two to four weeks, fix the senders that fail, then move to p=quarantine and finally p=reject.

8. Apply the Standard preset security policy

In the Defender portal, Email & collaboration → Policies & rules → Threat policies → Preset security policies, apply Standard protection to all users. It configures anti-phishing, anti-spam and anti-malware with Microsoft's recommended values, and keeps them updated as recommendations change.

9. Block automatic forwarding to external addresses

A compromised mailbox with a forwarding rule leaks quietly for months. New tenants block this by default, but make it explicit:

Set-HostedOutboundSpamFilterPolicy -Identity Default -AutoForwardingMode Off

If a team really needs external forwarding, create a separate policy scoped to just them.

10. Restrict external sharing in SharePoint and OneDrive

Out of the box, sharing is wide open, including "Anyone" links that need no sign-in. Tighten it to existing guests and make "specific people" the default link type:

Connect-SPOService -Url https://contoso-admin.sharepoint.com
Set-SPOTenant -SharingCapability ExistingExternalUserSharingOnly -DefaultSharingLinkType Direct

You can open individual sites back up when there's a business reason. That's easier than finding out what was already shared.

Then track it

Secure Score won't tell you everything, but it's a free to-do list that shows progress. Check it after these ten, write down the number, and look again in a month.

None of this needs an extra license or a new tool. That's the point.