Configure your Microsoft 365 tenant for increased security


Did you know you can try the features in Microsoft Defender XDR for Office 365 Plan 2 for free? Use the 90-day Defender for Office 365 trial at the Microsoft Defender portal trials hub. Learn about who can sign up and trial terms here.

Your organizational needs require security.

Specifics are up to your business.

This article walks you through the manual configuration of tenant-wide settings that affect the security of your Microsoft 365 environment. Use these recommendations as a starting point.

Tune EOP and Defender for Office 365 protection policies in the Microsoft Defender portal

The Microsoft Defender portal has capabilities for both protection and reporting. It has dashboards you can use to monitor and take action when threats arise.

As an initial step, you need to configure email authentication records in DNS for all custom email domains in Microsoft 365 (SPF, DKIM, and DMARC). Microsoft 365 automatically configures email authentication for the * domain. For more information, see Step 1: Configure email authentication for your Microsoft 365 domains.


For non-standard deployments of SPF, hybrid deployments, and troubleshooting: Set up SPF to help prevent spoofing.

Most protection features in Exchange Online Protection (EOP) and Defender for Office 365 come with default policy configurations. For more information, see the table here.

We recommend turning on and using the Standard and/or Strict preset security policies for all recipients. For more information, see the following articles:

Custom policies are required if the business needs of your organization require policy settings that are different than or aren't defined in preset security policies. Or, if your organization requires a different user experience for quarantined messages (including notifications). For more information, see Determine your protection policy strategy.

View dashboards and reports in the Microsoft Defender portal

In the Defender portal at select Reports. Or, to go directly to the Reports page, use

On the Reports page, you can view information about security trends and track the protection status of your identities, data, devices, apps, and infrastructure.

The data in these reports becomes richer as your organization uses Office 365 services (keep this point in mind if you're piloting or testing). For now, be familiar with what you can monitor and take action on.

On the Reports page at, select Email & collaboration > Email & collaboration reports.

On the Email & collaboration reports page that opens, note the cards that are available. In any card, select View details to dig into the data. For more information, see the following articles:

Mail flow reports and insights are available in the Exchange admin center (EAC). For more information, see Mail flow reports and Mail flow insights.

|If you're investigating or experiencing an attack against your tenant, use Threat Explorer (or real-time detections) to analyze threats. Explorer (and the real-time detections report) shows you the volume of attacks over time, and you can analyze this data by threat families, attacker infrastructure, and more. You can also mark any suspicious email for the Incidents list.

Additional considerations

For information about ransomware protection, see the following articles:

Configure tenant-wide sharing policies in SharePoint admin center

Microsoft recommendations for configuring SharePoint team sites at increasing levels of protection, starting with baseline protection. For more information, see Policy recommendations for securing SharePoint sites and files.

SharePoint team sites configured at the baseline level allow sharing files with external users by using anonymous access links. This approach is recommended instead of sending files in email.

To support the goals for baseline protection, configure tenant-wide sharing policies as recommended here. Sharing settings for individual sites can be more restrictive than this tenant-wide policy, but not more permissive.

Area Includes a default policy Recommendation
Sharing (SharePoint Online and OneDrive for Business) Yes External sharing is enabled by default. These settings are recommended:
  • Allow sharing to authenticated external users and using anonymous access links (default setting).
  • Anonymous access links expire in this many days. Enter a number, if desired, such as 30 days.
  • Default link type > select Internal (people in the organization only). Users who wish to share using anonymous links must choose this option from the sharing menu.

More information: External sharing overview

SharePoint admin center and OneDrive for Business admin center include the same settings. The settings in either admin center apply to both.

Configure settings in Microsoft Entra ID

Be sure to visit these two areas in Microsoft Entra ID to complete tenant-wide setup for more secure environments.

Configure named locations (under conditional access)

If your organization includes offices with secure network access, add the trusted IP address ranges to Microsoft Entra ID as named locations. This feature helps reduce the number of reported false positives for sign-in risk events.

See: Named locations in Microsoft Entra ID

Block apps that don't support modern authentication

Multi-factor authentication requires apps that support modern authentication. Apps that don't support modern authentication can't be blocked by using conditional access rules.

For secure environments, be sure to disable authentication for apps that don't support modern authentication. You can do this in Microsoft Entra ID with a control that is coming soon.

In the meantime, use one of the following methods to block access for apps in SharePoint Online and OneDrive for Business that don't support modern authentication:

Get started with Defender for Cloud Apps or Office 365 Cloud App Security

Use Microsoft 365 Cloud App Security to evaluate risk, to alert on suspicious activity, and to automatically take action. Requires Office 365 E5 plan.

Or, use Microsoft Defender for Cloud Apps to obtain deeper visibility even after access is granted, comprehensive controls, and improved protection for all your cloud applications, including Office 365.

Because this solution recommends the EMS E5 plan, we recommend you start with Defender for Cloud Apps so you can use it with other SaaS applications in your environment. Start with default policies and settings.

More information:

The Defender for Cloud Apps dashboard

Additional resources

These articles and guides provide additional prescriptive information for securing your Microsoft 365 environment: