Every tenant we inherit tells the same story. Somebody bought licences, migrated the mailboxes over a weekend, and moved on. The settings are whatever Microsoft shipped. Two years later there are guest accounts nobody recognises, files shared with "anyone with the link", and a global administrator account that four people know the password to.
None of that is negligence. The defaults simply are not a security posture, and nobody told the person who did the migration that configuring them was part of the job. Here is the baseline we apply.
1. Multi-factor authentication on everyone, no exceptions
Including the CEO, including service accounts that can use it, including the contractor who is only here for six weeks. Password-only access to a mailbox is the single most exploited weakness in the region, and business email compromise is far more common than ransomware in the incidents we attend.
Where a legacy application genuinely cannot support modern authentication, isolate it, restrict it by IP, and put a date in the calendar to replace it. "Temporarily excluded" tends to mean "permanently forgotten".
2. Block legacy authentication outright
POP, IMAP, SMTP AUTH and older Exchange protocols bypass conditional access entirely, which makes every other control optional. Turn them off tenant-wide, then handle the two or three genuine exceptions individually. Check the sign-in logs first so you know what will break before it breaks.
3. Break-glass accounts, properly built
Two cloud-only global administrator accounts, excluded from conditional access, with long random passwords split and stored in a physical safe. They exist so that a misconfigured policy or an identity provider outage cannot lock you out of your own tenant. Alert on any sign-in to them. Nobody uses them for daily work.
4. Named admin accounts, separate from daily accounts
Administrators get a second account for privileged work. Their everyday account, the one that reads email and opens attachments, holds no administrative rights at all. This single change removes the most common path from a phishing click to a tenant-wide compromise.
5. Conditional access that reflects how you actually work
At minimum: require multi-factor for all users, require compliant or hybrid-joined devices for administrators, and block or challenge sign-ins from countries you never operate in. Build the policies in report-only mode first and read the results for a week. Turning them on blind is how you spend a Sunday on the phone.
6. External sharing set deliberately
The default lets users share files with anyone who has the link, including people who were forwarded it. Decide what you actually want, usually "existing external users" or "new and existing guests", and set link expiry. Then check what has already been shared, because the answer is normally surprising.
7. Retention and litigation hold
Decide how long mail and files should live, then configure retention policies to match. This is also the moment to be clear with the business about a point most people get wrong: retention protects you from deletion, not from encryption or from a malicious administrator.
8. Third-party backup, because retention is not backup
Microsoft protects the platform. It does not protect you from your own mistakes beyond a limited window, and its recovery options are not designed for restoring a department's SharePoint site to how it looked six weeks ago. Every serious tenant needs an independent backup with its own credentials and its own retention.
9. Defender configured, not just licensed
Safe Links and Safe Attachments switched on, anti-phishing policies with impersonation protection for your executives and finance team, and DMARC published and moved to a reject policy once you have monitored it. Publishing SPF alone is not email security, and half the tenants we inherit have DKIM unsigned.
10. Licensing reviewed
Not a security control, but it pays for the rest of the work. Almost every tenant we take over is over-licensed: leavers still assigned, users on E5 who need E3, add-ons duplicating features already included. A right-sizing exercise typically returns twenty per cent, and on one 3,200-user migration it funded the entire hardening project.
Do them in this order. MFA and legacy authentication first, because they close the doors that are actually being tried. Break-glass accounts before conditional access, so a bad policy cannot lock you out. Sharing and retention next. Licensing last, when you understand who actually needs what.
The half-day version
If you only have an afternoon, do these four: enable MFA for all users, block legacy authentication, create two break-glass accounts, and separate administrator identities from daily ones. That combination removes the majority of the risk we see exploited in practice, and none of it requires a project or a change freeze.
Everything else is worth doing properly, with a plan and a communication to users. But those four are worth doing today.