Microsoft 365 security: best practices

Microsoft 365 brings email, files, meetings, identities and applications together, which makes secure configuration essential.

Protect identities with MFA

Enable multifactor authentication for every user, prioritizing administrators and sensitive roles. Use Conditional Access to require additional controls for unusual sign-ins.

Strengthen email security

Use anti-phishing, anti-spam and anti-malware policies. Review automatic forwarding rules and help employees recognize suspicious messages.

Manage devices and applications

Set baseline requirements for any device accessing business information: up-to-date operating system, encryption, malware protection and screen locking. Regularly review third-party applications and permissions.

Protect and monitor information

Classify sensitive data, use appropriate sharing rules and review alerts, sign-in logs, privilege changes and unusual activity. Practice a documented response process for compromised accounts.