1. Require strong MFA
Protect interactive sign-ins with MFA and avoid leaving exceptions that quietly become permanent.
2. Use Conditional Access deliberately
Apply policies around risk, location, device state and sensitive applications rather than relying on one blanket rule.
3. Separate administrative identities
Daily email accounts should not casually carry powerful administrative roles. Reduce privilege and use dedicated admin workflows where appropriate.
4. Review legacy authentication and risky protocols
Old authentication paths can weaken otherwise strong sign-in controls. Inventory and retire them where the business can support the change.
5. Protect email
Review anti-phishing, spoofing, attachment/link controls, mail flow and user reporting. Email remains a common entry point for account compromise.
6. Review external sharing
Teams, SharePoint and OneDrive make collaboration easy. Define who can share, with whom, and how guest access is reviewed.
7. Centralize meaningful logging
Ensure the security events you may need during an incident are available, retained and monitored appropriately.
8. Protect endpoints too
Identity controls do not replace endpoint protection. Devices accessing business data still need patching, encryption and detection/response.
9. Plan independent recovery
Understand what Microsoft provides, what retention settings cover and where independent backup is appropriate for your recovery requirements.
10. Test onboarding and offboarding
A secure environment needs repeatable account creation, access assignment and rapid removal when someone leaves.