Knowing how to secure your Microsoft 365 account against cyberattacks is not optional for anyone who uses the platform for work. Microsoft 365 holds email, files, calendars, and in many organisations, identity itself. Attackers know this. Business email compromise attacks targeting Microsoft 365 tenants cost organisations billions of dollars globally each year, and most of those breaches trace back to a small set of misconfigured or missing controls. The good news is that those controls exist, they're built into the platform, and most of them don't require a security team to switch on.
Start with multi-factor authentication
Multi-factor authentication (MFA) is the single most effective control available in Microsoft 365. Microsoft's own telemetry, published through the Microsoft Digital Defense Report, attributes MFA to blocking over 99% of automated account takeover attempts. That figure is worth pausing on. It's not a marginal improvement.
Microsoft 365 offers MFA through the Microsoft Authenticator app, SMS codes, and hardware tokens. The Authenticator app is the strongest of these options. SMS is better than nothing, but SIM-swapping attacks mean it shouldn't be your only factor for admin accounts.
To enable MFA across your tenant, go to Microsoft Entra admin centre (formerly Azure Active Directory), navigate to Security > Authentication methods, and confirm that per-user MFA or Security Defaults are active. For organisations on Microsoft 365 Business Premium or above, Conditional Access policies give you more granular control over when and how MFA is required.
Don't skip MFA on shared mailboxes or service accounts. Attackers target exactly those because administrators assume they're lower risk.
Use Conditional Access to restrict where and how people sign in
MFA answers the question of who is signing in. Conditional Access answers the question of where, on what device, and under what circumstances. The two work together.
Conditional Access policies in Microsoft Entra let you block sign-ins from countries you don't operate in, require compliant devices (via Microsoft Intune), and enforce MFA specifically when a login comes from an unfamiliar location. Even a single policy that blocks sign-ins from known high-risk countries cuts a large category of credential stuffing attacks before they begin.
A practical starting set of Conditional Access policies includes: requiring MFA for all users, blocking legacy authentication protocols, and requiring compliant or hybrid Azure AD joined devices for access to sensitive applications. Legacy authentication protocols such as IMAP, SMTP AUTH, and POP3 don't support modern MFA and are frequently exploited. Block them unless a specific application genuinely requires them.
Harden your admin accounts separately
Admin accounts deserve a different security model from regular user accounts. They should not be used for day-to-day email or browsing. Each administrator should have a separate admin account used only for administrative tasks, and that account should be protected by MFA and Conditional Access regardless of anything else in the tenant's configuration.
Microsoft 365 supports Privileged Identity Management (PIM), which enforces just-in-time elevation. Instead of an account holding Global Administrator rights permanently, PIM grants those rights for a defined window and requires justification before activation. This limits the blast radius if an admin account is compromised.
Reduce the number of Global Administrators to the minimum required. Two is a reasonable floor for redundancy. More than five is usually unnecessary and increases the attack surface.
Enable Microsoft Defender for Office 365
Microsoft Defender for Office 365 adds a layer of protection that goes well beyond the spam filter built into Exchange Online Protection. Defender for Office 365 Plan 1 (included in Microsoft 365 Business Premium) adds Safe Links, Safe Attachments, and anti-phishing policies that check URLs at click time and detonate suspicious attachments in a sandbox before they reach the inbox.
Safe Links rewrites URLs in emails and re-checks them at the moment a user clicks. This matters because phishing links sometimes point to benign pages at delivery time and redirect to malicious content only after anti-spam scanning is complete. Safe Attachments catches malware in Word, Excel, and PDF attachments before they're opened. These two controls together address the two most common delivery methods for credential theft and ransomware. The connection between phishing emails and Microsoft 365 credential theft is direct enough that skipping Defender is a meaningful gap.
Configure an anti-phishing policy that enables impersonation protection for your domain and your key executives. Attackers routinely spoof the CEO's display name when targeting finance teams.
Audit and tighten app permissions
OAuth app abuse is a growing attack vector against Microsoft 365. An attacker convinces a user to grant a malicious third-party app access to their mailbox or OneDrive, and that access persists even after a password reset because it's token-based, not password-based.
In the Microsoft Entra admin centre, go to Enterprise Applications > User settings and restrict whether users can consent to third-party apps on their own. Setting this to "Admin consent required" means every new app integration gets reviewed before it touches tenant data. Regularly audit existing app permissions under Enterprise Applications > App registrations and revoke access for anything no longer in use.
This control is frequently overlooked. Many tenants that have MFA and Defender correctly configured still leave app consent wide open.
Review your secure score and act on its findings
Microsoft 365 includes a Microsoft Secure Score dashboard in the Microsoft Defender portal. Secure Score quantifies your tenant's security posture as a number and lists specific recommended actions ranked by impact. It doesn't replace judgment, but it's a useful checklist of controls you may have missed.
Common high-impact recommendations include enabling audit logging, disabling mailbox forwarding rules to external addresses, requiring MFA for admins, and ensuring Unified Audit Log is turned on. Audit logging is worth highlighting separately: it's off by default in some configurations, and without it you have no forensic record of what happened in the event of a breach.
Check the Secure Score monthly. The recommendations change as Microsoft adds new controls, and the score reflects changes attackers are actively exploiting at any given time.
Train users, because technology alone doesn't close the gap
Controls at the tenant level stop a lot. They don't stop a user who is socially engineered into handing over an MFA approval or typing credentials into a convincing fake login page. AI-generated phishing and deepfake attacks make this problem harder because the messages are more convincing than anything that came before them.
Microsoft 365 Defender includes Attack Simulation Training, which sends realistic phishing simulations to your users and measures who clicks. Organisations that run simulations quarterly see measurable reductions in click rates over time. The training modules attached to each simulation are short, specific, and triggered by real behaviour, which makes them more effective than annual compliance videos.
Pairing technical controls with user awareness is what actually closes the gap. Neither works as well without the other.
Keep an eye on sign-in and audit logs
Microsoft Entra's sign-in logs and the Unified Audit Log record authentication events, admin actions, and data access across your tenant. Reviewing these regularly catches anomalies that automated policies miss: a user signing in from two countries in an hour, an admin account making bulk changes at 2 AM, or a forwarding rule added to an executive mailbox.
If your organisation uses a SIEM (security information and event management) tool, Microsoft 365 logs integrate natively with Microsoft Sentinel and with third-party platforms. Sentinel can alert on suspicious patterns automatically. For smaller organisations without a SIEM, the Entra sign-in logs and the Defender Incidents queue cover the most important visibility gaps without additional tooling. Protecting your Microsoft 365 environment also sits within the broader goal of protecting personal and organisational information online, and consistent log review is one of the most direct ways to detect a compromise early.