In one sentence: Microsoft 365 security basics are a short list of settings, mostly free, that stop the most common attacks on your email, files and staff accounts.

What it is

Microsoft 365 holds email, documents, calendars and often the keys to everything else a business uses. That makes each staff account worth stealing.

Microsoft runs the platform. You decide who can sign in, how, and from where, as the cloud shared responsibility model explains.

The basics below are the settings that matter most. Microsoft says it makes preconfigured security settings (security defaults) available to everyone so that all organisations have at least a basic level of security at no extra cost.

How it works

1. Security defaults. This is a bundle of settings in Microsoft Entra ID, the sign-in service behind Microsoft 365. Microsoft lists them: all users register for multifactor authentication (MFA), administrators use MFA, users are asked for MFA when needed, legacy authentication is blocked, device code flow is blocked, and privileged activities such as Azure portal access are protected. Microsoft states that more than 99.9% of common identity-related attacks are stopped by MFA and blocking legacy authentication.
2. Conditional Access. Organisations with Entra ID P1 or P2 licences can use Conditional Access policies for finer control. Microsoft says security defaults are probably not right for them.
3. Basic authentication is gone. It sends a username and password with every request, which makes credentials easier to capture. Microsoft has removed it for Exchange Online protocols including POP, IMAP and Exchange ActiveSync.
4. Secure Score. Microsoft Secure Score measures your security posture in the Microsoft Defender portal. Each recommended action is worth 10 points or fewer.
5. Audit log. Audit log search is on by default for Microsoft 365 enterprise organisations, so activity can be investigated.

Who it affects and how badly

Every organisation on Microsoft 365, which in the UK, EU, US and Armenia means most small and mid-sized firms.

• Sole trader to 10 staff: one phished password can mean a hijacked mailbox and fake invoices sent to clients.
• 10 to 50 staff: accountancy, legal and estate agency firms hold payment details. Worst case: fraud and lost clients.
• 50 to 250 staff: schools, charities and care providers hold sensitive records.
• Regulated businesses: fintech and insurance firms must be able to show that access to data is controlled.

Real examples

• Microsoft retiring Basic authentication. Microsoft began disabling it for tenants with no reported usage in early 2021, and for all tenants from early 2023. It explained that enforcing MFA is not simple or sometimes possible while it stays enabled.

How to detect it

• Open the Microsoft Entra admin center, go to Entra ID, then Overview, then Properties, and select Manage security defaults to see whether they are on.
• Open Secure Score in the Microsoft Defender portal and read the improvement actions.
• In Exchange Online PowerShell, run `Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled` and expect `True`.
• Search the audit log in the Microsoft Purview portal for unexpected sign-ins and new admin roles. You need the Audit Logs or View-Only Audit Logs role.
• Review who holds the Global Administrator role, which Microsoft says should be limited to emergency scenarios.

How to fix or prevent it

1. Turn on security defaults if you have no Conditional Access policies: Entra ID, Overview, Properties, Manage security defaults, set to Enabled, Save. Use Conditional Access instead if you hold P1 or P2.
2. Make sure every user has registered for MFA, administrators first.
3. Block legacy authentication, and move any old apps that need it to modern authentication.
4. Keep few administrators, with the fewest permissions needed.
5. Work through the Secure Score recommendations and accept risk in writing where you decide not to act.
6. Confirm audit logging is on, and consider phishing-resistant MFA as a next step.

Related terms

• multi factor authentication
• phishing resistant mfa
• cloud shared responsibility model
• business email compromise
• password spraying
• cyber essentials

Frequently asked questions

Are security defaults free?
Yes. Microsoft says they are available in all Microsoft 365 organisations via Microsoft Entra ID Free.

Can I still use POP or IMAP with Microsoft 365?
Basic authentication has been removed for them in Exchange Online. Apps must use modern authentication such as OAuth 2.0.

Does a high Secure Score mean I am safe?
No. It is a measure of recommended actions taken, and Microsoft notes that not every recommendation suits every environment.

Sources

• Microsoft Learn, security defaults in Microsoft Entra ID: https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults
• Microsoft Learn, Microsoft Secure Score: https://learn.microsoft.com/en-us/defender-xdr/microsoft-secure-score
• Microsoft Learn, deprecation of Basic authentication in Exchange Online: https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-basic-authentication-exchange-online
• Microsoft Learn, search the audit log: https://learn.microsoft.com/en-us/purview/audit-search
• Microsoft Learn, set up multifactor authentication: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/set-up-multi-factor-authentication

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan.