How to Protect Your Microsoft 365 Environment: The 2026 Baseline

Microsoft enforces MFA on its own portals: since October 2024 for the Azure portal, Entra admin center and Intune admin center, from February 2025 for the Microsoft 365 admin center, and from 1 October 2025 for create, update and delete operations through Azure CLI, Azure PowerShell and the REST APIs. That protects the consoles; your users still need a policy.

A tenant without Entra ID P1 uses security defaults: every user must register for MFA within 14 days of their first sign-in after it is enabled, administrators perform MFA at every sign-in, legacy authentication and device code flow are blocked. New tenants have it on. It allows no exceptions, which is why tenants with Entra ID P1 (Business Premium, E3 and E5 include it) switch to Conditional Access and turn security defaults off.

The five policies we deploy first, in report-only mode for a week and then enforced, are in our Conditional Access guide: MFA for all users; phishing-resistant MFA for administrator roles; block legacy authentication; require a compliant or app-protected device for Microsoft 365 apps; block sign-ins from countries you do not operate in. Risk-based policies that react to leaked credentials need Entra ID P2 at $10.00 per user per month (Microsoft list price, October 2026 price list); under 300 people, add P2 to administrators and finance rather than everyone. Phishing-resistant methods are covered in our passkey rollout order.

Nobody reads email with a Global Administrator account. Give each admin a second, cloud-only account with no license and no mailbox, hold it to phishing-resistant MFA, and limit Global Administrator to two people. Create two emergency access accounts with long random passwords stored offline, exclude them from Conditional Access, and alert on any sign-in by them. Review role assignments quarterly; Privileged Identity Management, which makes roles time-bound, is an Entra ID P2 feature.

If a partner manages the tenant, their access must be through Granular Delegated Admin Privileges with specific roles and an expiry date. Ask your partner which roles they hold and when the relationship expires; if they cannot answer, that is the finding.

The Microsoft Defender portal has three preset security policies. Built-in protection is on by default and gives Safe Links and Safe Attachments to anyone not covered by another policy. Standard is for most of the company. Strict applies more aggressive detections and requires an admin to release blocked mail, so Microsoft assigns it to executives, their assistants and people who are repeatedly targeted. Both need user and domain impersonation entries (up to 350 users), and Microsoft updates the locked settings as its recommendations change, which is the point of using them. Safe Links, Safe Attachments and the Teams protections need Defender for Office 365 Plan 1, included in Business Premium and $2.00 per user per month on its own (Plan 2 is $5.00; Microsoft list price, October 2026 price list).

Publish SPF, sign with DKIM, move DMARC to p=reject once the reports show every legitimate sender, and block automatic external forwarding in the outbound spam policy.

Then deal with basic authentication for SMTP client submission, which copiers, scanners and line-of-business apps still use. Under Microsoft's revised timeline of 27 January 2026, behavior is unchanged until December 2026; at the end of December 2026 it is disabled by default for existing tenants (admins can re-enable it); tenants created after December 2026 have it off; the final removal date is to be announced in the second half of 2027. Senders that keep using it will fail with "550 5.7.30 Basic authentication is not supported for Client Submission". Inventory them now and move them to OAuth, a relay or Azure Communication Services.

Windows 10 reached end of support on 14 October 2025; what that means for the machines still on it is in our Windows 10 ESU guide. Everything else here assumes Windows 11.

Enroll company devices in Intune with a compliance policy that requires BitLocker, Secure Boot, a current build and Defender running, and let Conditional Access policy 4 above act on it. Onboard every device to Defender for Business, which Business Premium includes and which sells standalone at $3.00 per user per month (Microsoft list price, October 2026 price list) for up to 300 users and five devices per user: next-generation antivirus, endpoint detection and response with automatic attack disruption, automated investigation and remediation, and vulnerability management. Larger organizations choose between it and Defender for Endpoint in our plan comparison.

Two settings close most ransomware paths. Tamper protection is on by default for new deployments through built-in protection; confirm it. Then enable the three attack surface reduction rules Microsoft calls standard protection, in block mode, without a long pilot: block credential stealing from LSASS, block abuse of exploited vulnerable signed drivers, and block persistence through WMI event subscription. ASR policies are managed in Intune, not the Defender portal.

Personal phones get an app protection policy instead of enrollment: PIN on Outlook and Teams, no copy to unmanaged apps, selective wipe on departure, as in our BYOD app protection guide.

Set the SharePoint and OneDrive external sharing default to "new and existing guests" rather than "anyone", set anonymous links to expire, and block downloads from unmanaged devices for the sites that hold finance, HR and client data. For browser sessions from unmanaged devices, Defender for Cloud Apps session policies, through Conditional Access app control, allow viewing while blocking download, print and copy; Defender for Cloud Apps is included in E5 and $3.50 per user per month on its own (Microsoft list price, October 2026 price list).

DLP for Exchange, SharePoint and OneDrive is included with Business Premium and E3; start with the five policies in our DLP guide for a 50-user firm. DLP for Teams messages needs an E5-level entitlement, the cheapest being the E5 Information Protection and Governance add-on at $7.00 per user per month. Sensitivity labels come with Business Premium and E3; apply three (Public, Internal, Confidential) and no more until people use them.

Microsoft Purview Audit (Standard) is on by default. Entra ID, Exchange, SharePoint and OneDrive records are kept one year and everything else 180 days unless Audit (Premium) extends it. Review Microsoft Secure Score monthly with our Secure Score guide, and treat it as a backlog, not a grade.

Versioning, recycle bins and retention policies protect against single deletions. They do not help when an attacker with admin rights purges a mailbox, when a sync client overwrites a library with encrypted files, or when a retention policy was never set. Microsoft 365 Backup covers Exchange, OneDrive and SharePoint, is enabled from the Microsoft 365 admin center, and is billed as a metered charge per gigabyte per month through an Azure subscription, with no license prerequisite beyond the source workloads; the Azure charge is yours. Whether that or a third-party tool fits is the subject of our native backup comparison. Whichever you pick, test-restore one mailbox and one site twice a year and keep the result.

Microsoft list price, October 2026 price list, billed to you at that price. For most companies under 300 people the answer is Business Premium plus Entra ID P2 for a handful of accounts; the comparison with E3 is in our Business Premium vs E3 guide.

• Monthly: Secure Score, risky sign-ins, Defender incidents, new admin role assignments, devices out of compliance.
• Quarterly: Conditional Access policy review, guest accounts and external sharing links, mail flow rules and forwarding, SMTP AUTH senders, partner GDAP relationships.
• Twice a year: test restore, break-glass account sign-in test, phishing simulation.
• Annually: license fit, retention and audit settings, incident response contacts.

Is Microsoft 365 secure out of the box?

The service is; the tenant is not finished. Security defaults, built-in protection and audit are on for a new tenant, but external sharing, guest access, device compliance, DLP and admin role hygiene are decisions you still make.

Do I need Microsoft 365 E5 to be secure?

No. Business Premium at $22.00 per user per month (Microsoft list price, October 2026 price list) covers eleven of the twelve controls for a company under 300 people. E5 adds Teams DLP, risk-based Conditional Access, PIM and one-year audit retention, which most small organizations add selectively.

Should I use security defaults or Conditional Access?

Security defaults if you have no Entra ID P1 licenses. Conditional Access if you do, because it allows exclusions, device conditions, named locations and report-only testing; turn security defaults off once your policies are enforced.

When does basic authentication for SMTP stop working?

Under Microsoft's 27 January 2026 timeline, it works through December 2026, is disabled by default for existing tenants at the end of December 2026 (admins can re-enable it), and the final removal date will be announced in the second half of 2027.

Does Microsoft back up my Microsoft 365 data?

Retention, versioning and recycle bins are included; a backup with independent restore points is not. Microsoft 365 Backup is a separate, metered service billed per gigabyte through Azure, and third-party backup is the alternative.

How long does this baseline take?

For a tenant under 300 users, one to two weeks: a day of assessment, identity and admin controls in report-only mode first, then enforcement, email, device and data settings in the second week.

• Mandatory multifactor authentication for Azure and other admin portals — Microsoft Learn, checked 2026-10-11
• Security defaults in Microsoft Entra ID — Microsoft Learn, checked 2026-10-11
• Preset security policies in EOP and Microsoft Defender for Office 365 — Microsoft Learn, checked 2026-10-11
• MC786329 Exchange Online to retire Basic Auth for Client Submission (SMTP AUTH), Message Center mirror — Microsoft 365 Message Center via mc.merill.net, checked 2026-10-11
• Windows 10 end of support — Microsoft, checked 2026-10-11
• What is Microsoft Defender for Business? — Microsoft Learn, checked 2026-10-11
• Microsoft Defender for Business — Microsoft, checked 2026-10-11
• Attack surface reduction rules overview — Microsoft Learn, checked 2026-10-11
• Attack surface reduction rules reference — Microsoft Learn, checked 2026-10-11
• Manage tamper protection for your organization using Microsoft Defender portal — Microsoft Learn, checked 2026-10-11
• Data loss prevention and Microsoft Teams — Microsoft Learn, checked 2026-10-11
• Microsoft Purview Audit solutions overview — Microsoft Learn, checked 2026-10-11
• Microsoft 365 Backup — Microsoft, checked 2026-10-11