A Microsoft 365 security baseline you can apply in 30 days

Why a baseline beats a wish list

Microsoft 365 holds your email, documents, identities and often your collaboration history. Attackers target it because one successful sign-in exposes all of it. A baseline is a short list of settings you apply to every tenant, document once and verify regularly, so security does not depend on who configured what and when.

The plan below assumes licensing that includes Entra ID Conditional Access and Defender for Office 365 or equivalent. If a control requires a license you lack, record the gap rather than skipping the intent.

Plan communication alongside configuration. Every control in this list changes something a user can feel, whether a new prompt, a blocked attachment or a device registration. Send a brief note before each change, name a contact for problems, and pilot with the IT team and a friendly department first. Rollbacks caused by surprised executives cost more credibility than any delay would have.

Week one: identity first

Identity is the new perimeter, so the first week is about who can sign in, from where, and how they prove it.

• Create two emergency access accounts with long random passwords, excluded from Conditional Access, stored offline, and monitored for any sign-in.
• Require multi-factor authentication for all users, starting with administrators. Prefer the Microsoft Authenticator app with number matching, or FIDO2 keys for privileged roles.
• Block legacy authentication protocols, which cannot perform multi-factor checks.
• Make administrators use separate, cloud-only accounts with no mailbox, and use Privileged Identity Management for just-in-time elevation where licensed.
• Review enterprise applications and user consent settings, and require admin approval for new third-party app permissions.

Week two: email and phishing defense

Email remains the most common entry point. Publish SPF, DKIM and DMARC records for every sending domain, and move DMARC from monitoring to enforcement once legitimate senders are aligned. Turn on safe links and safe attachments, impersonation protection for executives and finance staff, and automatic removal of messages found malicious after delivery.

Disable automatic external forwarding, and alert on new inbox rules that forward or delete mail, a staple of business email compromise. Give users a one-click way to report suspicious messages so that reports feed your detection process.

Test the result as an attacker would. Send a harmless simulated phish to a pilot group, attempt a sign-in from a blocked country, and try to create an inbox forwarding rule from a standard account. Each test either confirms a control works or reveals an exclusion nobody remembered, and the outcomes make a persuasive status update for leadership.

Week three: devices and access context

Decide what a trusted device is, then enforce it. Enroll corporate devices in Intune or your management platform, require encryption and a supported operating system, and use Conditional Access to demand a compliant device for sensitive applications.

• Apply app protection policies to personal phones so that company data can be wiped without touching personal content.
• Restrict sign-ins from countries where you have no staff or customers.
• Set sign-in risk and user risk policies to require password reset or block when risk is high.
• Limit session lifetime and require reauthentication for admin portals.

Week four: data, sharing and logging

Review SharePoint and OneDrive external sharing defaults and move from anyone-with-the-link to named people for sensitive sites. Publish sensitivity labels that users can understand, such as Public, Internal and Confidential, and begin with auto-labeling in audit-only mode to learn where sensitive data lives.

Confirm that unified audit logging is on and retained long enough for investigation. Forward sign-in, audit and Defender alerts to the people or service that will actually read them. A control nobody monitors is a comment in a configuration file.

Keep it a baseline, not a project

After day thirty, schedule a monthly review of Secure Score recommendations, Conditional Access policy exclusions, stale accounts and guest users. Document each exception with an owner and an expiry date. Exceptions without expiry dates are how baselines erode.

Finally, compare your configuration to the CIS Microsoft 365 Foundations Benchmark to find anything this list missed. Treat the benchmark as a review tool, apply changes in report-only mode first, and communicate user-facing changes before they land.

Record the baseline itself as a living document: each setting, its intended value, the reason for it, and the date it was last verified. When an auditor, insurer or customer asks how your tenant is protected, you can answer from evidence in minutes. When a new administrator joins, they inherit intent, not just a configuration they are afraid to touch.