Security defaults & key settings in Microsoft 365

The baseline security settings every Microsoft 365 business account should have — including security defaults, admin account protection, and app permissions.

Microsoft 365 includes a range of security features. Some are on by default and some are not, and a few have moved since you last looked. This guide covers the most important settings to review — even if you have no IT background.

Quick summary

The most important security steps for Microsoft 365 are: check security defaults are on (they turn on MFA for everyone), keep the number of global admins low, review which apps have access to your account, and make sure your admin accounts have strong passwords. Most of these take five minutes each.

1. Turn on security defaults

Security defaults is a free set of Microsoft settings that protects your whole organization from common identity attacks like password spray and phishing. It requires everyone to register for multi-factor authentication (MFA), requires administrators to use MFA, and blocks older sign-in methods that skip MFA entirely. Microsoft aims it at organizations that want better security but don't know where to start, and at anyone on the free tier of Microsoft Entra ID licensing.

Your account may already have them on. Microsoft words it two ways: its Microsoft 365 admin documentation says tenants created after October 2019 have security defaults turned on by default, while its Microsoft Entra documentation says a tenant created on or after 22 October 2019 might have them enabled. Check the current status rather than assume either way. Whatever you find, they now live in the Microsoft Entra admin center, not the Microsoft 365 admin center and not the Azure portal. See the full guide: Turning on multi-factor authentication.

2. Limit global admin accounts

A Global Administrator has almost unlimited access to your organization's settings and most of its data. Microsoft's own advice is blunt: have as few of them as possible.

Best practice:

Keep the number of Global Administrators as low as you can get away with.
Make sure someone else can rescue a locked-out admin. Microsoft suggests assigning at least one person the Privileged Authentication Administrator role, because either that role or another Global Administrator is needed to reset a Global Administrator's password.
Everyone else should have the least permissive role that lets them do their job — or no admin role at all.

To review your admins:

Sign in to the admin center at admin.microsoft.com.

Go to Role assignments.

Select a role to open its detail pane, then open the Assigned tab to see who holds it. Start with Global Administrator.

Take the role away from anyone who doesn't need full access, and assign something narrower instead — Password Administrator or Helpdesk Administrator for password resets, Billing Administrator for billing, and so on.

An admin can't demote themselves

A Global Administrator can't remove their own Global Administrator assignment — Microsoft blocks it so an organization can never end up with zero. Another admin has to do it.

3. Use a dedicated admin account

Many admins use their regular work email account for admin tasks. This is a risk — if that email is compromised through a phishing attack, the attacker immediately has admin access.

Best practice: Create a separate account just for admin tasks (for example, admin@yourcompany.com) that is not used for day-to-day email. Protect it with MFA and a strong, unique password. Microsoft recommends the same split, and points out a side benefit: separate accounts for administration and everyday work mean far fewer MFA prompts during the working day.

Use the dedicated admin account only for admin tasks

Don't use your admin account to read email, browse the web, or do everyday work. It should only be used when you need to make changes in the admin center.

4. Review app permissions

Third-party apps can request access to your Microsoft 365 data — this happens when you or your team install apps or authorize services. It's worth reviewing what has been granted access.

Go to the Microsoft 365 admin center, select Settings, and then choose Integrated apps. This portal lists the apps, agents, and add-ins that people in your organization can use, and lets you remove a deployment.

For the full picture of what an app can reach, go to the Microsoft Entra admin center and open Entra ID → Enterprise apps → All applications. Select an app, then Permissions, then the Admin consent tab to see what was granted on behalf of the whole organization.

Review any unfamiliar apps and revoke what you don't recognize or no longer use. In the Admin consent tab, select the permission, choose the "..." control, and select Revoke permission.

5. Check your audit log

Audit logs record who did what in your Microsoft 365 environment — sign-ins, file access, permission changes, and more. This is important for spotting suspicious activity and responding to security incidents.

You almost certainly don't need to turn this on. Microsoft's words: audit (Standard) "is enabled by default for all organizations with the appropriate subscription", and it captures and makes searchable the records for audited activities. What's left for you is making sure the right people can actually search it:

Open the Microsoft Purview portal. If you're used to the Microsoft Purview compliance portal, that one has been retired and its features moved or were retired with it.

Find the Audit search tool and try a search, to confirm records are there.

Assign the necessary permissions to anyone who needs to run those searches. That is the step that is genuinely missing on most accounts.

How far back it goes

On the standard audit that comes with most business subscriptions, records are retained for 180 days — so you can search roughly the past six months. Longer retention needs a higher tier or an add-on licence.

6. Check password policies

There is less to configure here than you might expect. Microsoft says cloud-only accounts have a predefined password policy that can't be changed; the only things you control are whether passwords expire and after how many days. Find it at Settings → Org settings → Security & privacy → Password expiration policy. By default, passwords never expire.

Microsoft's current guidance is to leave it that way: expiration policies are discouraged for cloud-only accounts, because imposing rules on people tends to produce predictable passwords rather than strong ones. Focus on strong initial passwords and MFA instead. See Resetting a user's password and strong passwords for more.

7. Check the Secure Score

Microsoft provides a Secure Score — a measure of your organization's security posture, where a higher number means more of the recommended actions have been taken.

You'll find it as Microsoft Secure Score in the Microsoft Defender portal — you may have seen this called Microsoft 365 Defender in older guides, including ours — which you reach from the specialist security workspace in the Microsoft 365 admin center's navigation pane — it isn't a page inside the admin center itself. Each recommended action is worth 10 points or less, most are scored all-or-nothing, and your score updates in real time as you act on them.

Common questions

What is the difference between security defaults and Conditional Access?

Security defaults are a simple, free, one-switch way to apply a standard set of security policies. Conditional Access gives you granular control — for example, requiring MFA only from certain locations, or only for certain apps. Conditional Access needs Microsoft Entra ID P1 or P2, which is what Business Premium includes and Business Basic and Standard don't. Microsoft's own steer is that if you do have those licences, security defaults are probably not right for you; if you don't, security defaults are the right starting point. You can't run both: while security defaults are on, you can create Conditional Access policies but you can't switch them on.

We've had Microsoft 365 for years. Do we still need to check these settings?

Yes — especially if you set it up a while ago. Microsoft's default settings have changed over time, and some protections that are now standard weren't available when older accounts were set up. It's worth doing a quick review.

Is there a way to see if any accounts have been compromised?

Yes. Sign-in activity now lives in the Microsoft Entra admin center: go to Entra ID → Monitoring & health → Sign-in logs (you need at least the Reports Reader role). Look for sign-ins from unusual locations or at unusual times, and filter the list rather than scrolling it. The Secure Score recommendations in the Microsoft Defender portal are the other place worth looking.

Need a hand?

If you're stuck, email support@chykalophia.com and we'll help. Include your website address and a screenshot if you can.