Securing Remote Work with Microsoft 365: Eight Controls, in Order
What does it take to secure a workforce that signs in from kitchens, client sites and airport lounges? Eight controls in Microsoft 365, applied in a fixed order: identity first, devices second, threat protection third, data and network last. This guide gives each control's decision rule, the license it needs (Microsoft 365 Business Premium at $22.00 per user per month on an annual term covers seven of the eight), and a 30-day order of work for a 10-to-500-person organization.
The short answer: eight controls, and Business Premium already licenses seven
Remote work removed the office network as a control. What replaces it is a chain of eight controls, in order, each depending on the one before it.
| # | Control | License it needs | In Business Premium? |
|---|---|---|---|
| 1 | MFA for every account, phishing-resistant methods for admins | Microsoft Entra ID, any plan | Yes |
| 2 | Conditional Access baseline | Entra ID P1 | Yes |
| 3 | Company devices enrolled in Intune with compliance policies | Intune Plan 1 | Yes |
| 4 | Personal phones protected by app protection policies, no enrollment | Intune Plan 1 | Yes |
| 5 | Defender for Business on every endpoint, Defender for Office 365 Plan 1 on mail | Defender for Business, Defender for Office 365 Plan 1 | Yes |
| 6 | Internal apps reached through Entra Private Access, not a VPN | Entra ID P1 plus Private Access ($5.00) or Entra Suite ($12.00) | No; add-on |
| 7 | Files in SharePoint and OneDrive with sharing limits, labels and DLP | Purview Information Protection and DLP | Yes |
| 8 | Supported, patched operating systems on every PC | Intune Plan 1 update policies | Yes |
Prices are Microsoft list prices per user per month on an annual term, October 2026 price list. Microsoft 365 E3 ($39.00) and E5 ($60.00) carry the same seven; E5 adds Entra ID P2 and Defender for Endpoint Plan 2. Business Premium is capped at 300 users per tenant.
Control 1: MFA for everyone, and the admin accounts first
Two paths exist. Security defaults are the no-license path: Microsoft Entra ID requires MFA registration for every user, requires MFA for administrators and blocks legacy authentication protocols. Since January 2025 the option to postpone registration for 14 days is gone for existing tenants, so a new user registers at first sign-in. Conditional Access is the configurable path and needs Entra ID P1, which Business Premium, E3 and E5 include; the two cannot run together, so a tenant on P1 turns security defaults off and replaces each behavior with a policy.
Decision rule: no Entra ID P1 license, security defaults. Any plan that includes P1, Conditional Access.
Microsoft now enforces MFA on its own admin portals regardless of your settings: the Azure portal, the Entra admin center and the Intune admin center since the rollout that began in October 2024, the Microsoft 365 admin center from February 2025, and Azure CLI, Azure PowerShell and REST API calls that change resources from October 1, 2025, with a postponement option that ran to July 2026.
For the admin accounts, go beyond the Authenticator app: register a passkey or a FIDO2 security key and require it through a Conditional Access authentication strength. Create two emergency-access accounts, exclude them from every policy, and keep their credentials offline.
Control 2: the five Conditional Access policies that make remote sign-ins safe
Build these in report-only mode, read the sign-in log for seven days, then enforce:
- Block legacy authentication for all users, with no exceptions other than a scanner account under its own narrow policy.
- Require MFA for all users on all cloud apps.
- Require phishing-resistant MFA for administrator roles.
- Require a compliant device for Windows and macOS access to Microsoft 365 (depends on control 3).
- Require an app protection policy for iOS and Android access to Microsoft 365 (depends on control 4).
Microsoft ships these as templates under Protection, then Conditional Access, in the Entra admin center; name each policy by what it blocks. The full set, with the exclusions that keep you from locking yourself out, is in Conditional Access policies every business should have.
Controls 3 and 4: enroll the company's devices, protect personal ones without enrolling them
The treatment a device gets depends on who owns it:
| Device | Treatment | What the policy checks | Conditional Access grant |
|---|---|---|---|
| Company Windows PC or Mac | Enrolled in Intune with a compliance policy | Disk encryption on, Defender active, OS at a supported version, screen lock set | Require compliant device |
| Personal iPhone or Android | App protection policy only, no enrollment | Work data stays inside Outlook, Teams and the Office apps; PIN on the app; copy and paste blocked to personal apps; selective wipe on leaving | Require app protection policy |
| Personal home PC or a contractor's own laptop | No direct access; a Windows 365 Cloud PC or Azure Virtual Desktop session instead | The Cloud PC is the enrolled, compliant device; the personal PC sees a video stream | Require compliant device |
App protection needs an Intune license on the user, not on the device. Users install Microsoft Authenticator on iOS or the Company Portal app on Android as the broker, and IT cannot read, access or erase the personal data on the phone. The settings and the day-one user experience are in BYOD phones and Microsoft 365.
For the home-PC case, a Windows 365 Business Cloud PC with 2 vCPU, 8 GB and 128 GB is $32.40 per user per month on an annual term (Microsoft list price, October 2026 price list). When a Cloud PC beats shipping a laptop is covered in Windows 365 for contractors and BYOD.
Control 5: endpoint and email threat protection that is already paid for
Business Premium includes Microsoft Defender for Business for endpoints and Microsoft Defender for Office 365 Plan 1 for mail. Standalone, Defender for Business is $3.00 per user per month on an annual term (Microsoft list price, October 2026 price list).
Order of work:
- Onboard every enrolled device to Defender for Business through Intune; the compliance policy from control 3 then reads its risk level.
- Turn on tamper protection, and run the attack surface reduction rules in audit mode for 14 days before block mode.
- In Defender for Office 365, assign the Standard preset security policy to all users for Safe Links, Safe Attachments and anti-phishing.
Decision rule for a third-party antivirus or mail filter: if it duplicates what the plan includes, retire it at its renewal date and put the money toward control 6.
Control 6: internal apps without a VPN
A remote-access VPN gives a laptop the whole network. Microsoft Entra Private Access, part of Global Secure Access, gives a signed-in user one published application at a time, and Conditional Access decides each connection: MFA, compliant device, risk. Connectors inside the network dial out, so nothing on the firewall listens on a public address.
What it needs: Entra ID P1 or P2 on every user (in Business Premium, E3 and E5), plus either the standalone Private Access license at $5.00 per user per month on an annual term or the Microsoft Entra Suite at $12.00 (Microsoft list prices, October 2026 price list). Clients exist for Windows 10 and 11, macOS 14 or later, iOS 16 or newer and Android 11 or later.
What a VPN still does: office-to-office traffic, devices without a client such as printers and appliances, and Linux. Decision rule: if fewer than a fifth of staff need an internal file share, RDP or an intranet app, publish those destinations through Private Access for those users and retire the user VPN; keep a site-to-site tunnel for the office. The rollout order is in Entra Private Access vs a VPN.
Control 7: where files live and who can share them
The data controls are habits enforced by settings:
- Personal drafts live in OneDrive; anything two people touch lives in a Team or a SharePoint site, shared as a link, not an attachment.
- Set the default sharing link to Specific people at the tenant level, and allow Anyone links only on the sites that need them.
- Review guests quarterly; require an owner for every Team and an expiration policy for inactive ones.
- Publish four sensitivity labels with a General default, as described in Sensitivity labels in Word and Excel, and apply container labels to the Teams that hold client or employee data so external sharing and unmanaged-device access are decided per site.
- Turn on the data loss prevention policies for Exchange, SharePoint and OneDrive that Business Premium includes, in simulation mode first.
Control 8: supported, patched operating systems
Windows 10 reached end of support on October 14, 2025. A remote laptop still on it receives no security fixes unless it is enrolled in Extended Security Updates, and it fails any compliance policy that checks the OS version, so control 2 blocks it. The rule: every remote PC runs Windows 11 or a currently supported macOS, and Intune update rings install quality updates within a fixed deadline, with a forced restart after a grace period you set. Our Windows 11 migration service handles a fleet at $25 per device plus a $1,950 tenant fee, quoted in writing before work begins.
A 30-day order of work and the license bill for 50 users
| Week | Work | Controls |
|---|---|---|
| 1 | Emergency-access accounts; MFA registration campaign; Conditional Access policies in report-only; admin passkeys | 1, 2 |
| 2 | Enroll company PCs and Macs; compliance policies; app protection policy for phones; switch the compliant-device and app-protection policies to enforce | 2, 3, 4 |
| 3 | Onboard devices to Defender for Business; attack surface reduction in audit; Standard preset policy in Defender for Office 365 | 5 |
| 4 | Sharing defaults, guest review, labels and DLP in simulation; Windows 10 inventory and upgrade plan | 7, 8 |
| Month 2 | Private Access pilot for the people who need internal apps; retire the user VPN | 6 |
The license bill at Microsoft list price, October 2026 price list, annual term: 50 users on Business Premium is 50 × $264.00 = $13,200 per year; Private Access for ten of them adds 10 × $60.00 = $600; a Cloud PC for two contractors adds 2 × $388.80 = $777.60. Microsoft bills the subscriptions to you.
Frequently asked questions
Is Microsoft 365 Business Premium enough to secure remote work?
For a tenant of 300 users or fewer, it licenses seven of the eight controls here: Entra ID P1 for Conditional Access, Intune Plan 1, Defender for Business, Defender for Office 365 Plan 1, and Purview Information Protection and DLP. The one add-on is Entra Private Access at $5.00 per user per month on an annual term (Microsoft list price, October 2026 price list), and only for the people who need internal apps.
Do we still need a VPN for remote workers?
Not for users on managed Windows, macOS, iOS or Android devices reaching published internal applications; Entra Private Access covers that per application. A site-to-site tunnel still carries office-to-office traffic and devices that cannot run the client.
Do employees have to enroll their personal phones in Intune?
No. An app protection policy protects Outlook, Teams and the Office apps on a personal phone without enrollment, and a Conditional Access policy makes it mandatory. IT cannot read or erase personal data on the phone.
Are security defaults enough instead of Conditional Access?
They are the right choice when the tenant has no Entra ID P1 license. With Business Premium, E3 or E5, Conditional Access replaces them because it can require a compliant device, an app protection policy and phishing-resistant MFA for admins, which security defaults cannot.
What happens to a remote laptop still on Windows 10?
It has received no security updates since October 14, 2025 unless it is enrolled in Extended Security Updates, and it fails a compliance policy that checks the OS version, so Conditional Access blocks it. Upgrade it to Windows 11 or replace it.
Sources
- Security defaults in Microsoft Entra ID — Microsoft Learn, checked 2026-10-11
- Update to security defaults — Microsoft Tech Community, checked 2026-10-11
- Planning for mandatory multifactor authentication for Azure and other admin portals — Microsoft Learn, checked 2026-10-11
- Azure mandatory multifactor authentication: phase 2 starting in October 2025 — Microsoft Azure Blog, checked 2026-10-11
- Microsoft 365 Business Premium security overview — Microsoft Learn, checked 2026-10-11
- Implement mobile application management policies in Intune — Microsoft Learn training, checked 2026-10-11
- Enable Microsoft Conditional Access Policy Templates — CISA, checked 2026-10-11
- Windows 10 Home and Pro lifecycle — Microsoft Lifecycle, checked 2026-10-11
- IT Partner articles linked above on Entra Private Access, BYOD app protection, Windows 365 and Conditional Access, which cite Microsoft Learn's Global Secure Access, Intune and Conditional Access documentation
- Microsoft commercial price list, October 2026 (US), for the prices quoted
Key takeaways
- Remote work security in Microsoft 365 is a chain of eight controls: identity, Conditional Access, enrolled devices, protected personal phones, Defender, Private Access, data controls and supported operating systems.
- Business Premium ($22.00 per user per month, annual term) licenses seven of the eight; Entra Private Access ($5.00) or the Entra Suite ($12.00) is the add-on.
- Use security defaults only without Entra ID P1; with P1, five Conditional Access policies replace them, built in report-only mode first.
- Company devices are enrolled and must be compliant; personal phones get app protection without enrollment; personal PCs get a Cloud PC.
- Microsoft itself enforces MFA on the Azure, Entra, Intune and Microsoft 365 admin portals, so admins register phishing-resistant methods first.
- Windows 10 has been out of support since October 14, 2025; a remote PC on it fails compliance and should be upgraded or replaced.
Want the chain built in that order? Our Microsoft Entra ID Conditional Access Policy Implementation service designs and enforces the identity and device policies that controls 1 to 4 depend on, with emergency-access accounts and a report-only phase, as a fixed-price project quoted in writing before work begins; the Microsoft 365 subscriptions stay on your own invoice at Microsoft's list price.
Questions this article didn’t answer?
Thirty minutes with Mike — our CEO, not a sales rep. Bring the hard version of the question.