Hardening Microsoft 365 on the licences you already have

Security defaults are free on every tenant and they are one switch in Entra ID. Turned on, they require every user to register for multi-factor authentication, require MFA for administrators, challenge sign-ins that look risky, and block legacy authentication outright. There is nothing to scope and nothing to exclude. For a tenant on Business Basic or Standard with no identity add-ons they are the correct setting, and they deliver more protection than most partially configured tenants ever reach.

Conditional access is the configurable version of the same idea and requires Entra ID P1, which Business Premium includes; Basic and Standard do not, though P1 can be added per user. The trap is the transition. Conditional access replaces security defaults, so from the moment defaults go off the tenant is protected only by whatever policies you have finished, and it is common for that policy set to stay unfinished well past the day defaults were switched off. If you switch, ship the core set the same day: MFA for all users, stronger factors for administrators, a legacy authentication block, and a break glass account excluded from every policy with a hardware credential locked away offline.

The risk-based conditions, sign-in risk and user risk, belong to Entra ID P2, which Business Premium does not include. A baseline does not need them: a small closed set of broad policies covers the attacks a small business actually receives.

Legacy authentication protocols, IMAP, POP and SMTP AUTH among them, complete a sign-in with a username and password and never invoke MFA, which is why password spray tooling goes looking for them first. Microsoft has retired basic authentication across most of Exchange Online, but SMTP AUTH survives, and it gets quietly re-enabled per mailbox for the scanner, the photocopier and the line-of-business app that emails invoices. Each of those mailboxes holds a real credential protected by exactly one password.

Closing this costs nothing on any tier. Security defaults block legacy authentication as part of the package. Under conditional access, write an explicit block policy for legacy authentication clients with no exclusions. In Exchange Online, disable SMTP AUTH at the organisation level and treat every per-mailbox re-enablement as an exception with a named owner and a review date. Before enforcing any of it, filter the sign-in logs by client app to see what still speaks the old protocols; most of what turns up can be moved to a modern connector before the block lands.

Exchange Online has had mailbox auditing on by default on every licence tier for years, and the unified audit log records mailbox actions, administrative changes and file activity across the tenant. Most tenants have the data and have never looked at it, so the first search happens mid-incident, in an unfamiliar corner of the Purview portal, under time pressure. Run one search this week: confirm auditing has not been switched off, pull one mailbox's activity for the last month, and note how long the query takes.

The licensing line here is retention. The standard audit tier keeps 180 days of activity, which is usually enough runway to investigate a compromise discovered within the last few months. Retention beyond that sits in premium audit licensing. If an insurer or a regulator obliges you to hold activity logs for longer, a scheduled export to storage you control answers the obligation without a tier change, though it is a decision to take deliberately rather than a script to copy.

The standard play after a mailbox compromise is quiet forwarding: an auto-forward to an external address, or inbox rules that mark the attacker's correspondence as read and file it where nobody looks. The attacker reads invoice traffic for weeks and picks the moment to redirect a payment. Every part of the defence is included in every tier.

In the outbound spam policy, set automatic external forwarding to off explicitly rather than leaving it on the system-controlled default, and handle the rare legitimate case per mailbox. Confirm the alert policy that fires on creation of forwarding rules is enabled and that its alerts land somewhere a person actually reads. Then put a periodic check on the inbox rules of the mailboxes that move money, because a rule created during a compromise looks exactly like a rule created by a tidy user, right up until you read what it does.

Consent phishing skips the password entirely. The user clicks a link, sees a genuine Microsoft consent screen for an application asking to read mail and files, and clicks accept. The grant persists through password resets and MFA, touches no endpoint, and trips no malware detection. The attacker holds a token, refreshed on schedule, for as long as the grant stands.

The controls are free on every tier and they live in the Entra ID consent settings. Restrict user consent to applications from verified publishers requesting low-impact permissions, or block user consent entirely, and turn on the admin consent request flow so a legitimate application becomes a reviewable request instead of an unmanaged grant. Then audit what has already been consented to: list the enterprise applications in the tenant, sort by the permissions they hold, and ask who recognises each application with access to mail or files. Tenants that have never restricted consent almost always find something in that list nobody can explain.

Business Premium is the tier where the bundled licences start doing security work. Entra ID P1 brings conditional access. Intune brings device compliance, which makes a require-compliant-device policy possible and is one of the more effective baseline defences against a stolen session token being replayed on an unmanaged device. Defender for Office 365 Plan 1 brings Safe Attachments, which detonates attachments in a sandbox before delivery, and Safe Links, which re-checks URLs at click time. Defender for Business covers the endpoints. On Basic and Standard, Exchange Online Protection still does baseline mail filtering, and Defender for Office 365 Plan 1 is available as an add-on.

The fastest way to apply the mail protections coherently is the preset security policies in the Defender portal. Assigning the standard preset configures anti-phishing, Safe Attachments and Safe Links to Microsoft's recommended settings in one move, which beats hand-assembling the individual policies and quietly missing one.

Some capabilities do sit behind higher tiers, and it is worth naming them so the boundary is clear:

None of these closes the entry paths described above, and none of them substitutes for the baseline. They add depth on top of it.

A tenant can be assessed against this baseline quickly, from read-only evidence:

A tenant that passes those checks is ahead of most small-business tenants we read. What the checks do not settle is remediation order and exceptions, because every exception has a constituency: the scanner that needs SMTP AUTH, the director's unmanaged iPad, the application adopted before anyone read its permission list. Sequencing the tightening so nothing breaks on a Monday morning is most of the actual work, and it is the part of a tenant review that does not fit in a note.