Microsoft 365 Security Baseline: 5 Steps to Get Started
Microsoft 365 isn’t insecure out of the box, but it isn’t as locked down as many people assume either. When I take over a tenant, I work through five steps in a fixed order. The order is deliberate: start with step three and you are likely to lock yourself out.
1. Set up emergency access
Two cloud-only accounts with the Global Administrator role, a long password and ideally a FIDO2 key. No Conditional Access policy applies to them, and they are only used in an emergency. Where the credentials are stored, who may retrieve them and when they were last tested goes into the customer documentation.
That sounds like paperwork. Without these accounts, though, a single wrong policy is enough and nobody can get into the tenant anymore. You don’t want to solve that through Microsoft support.
2. Conditional Access, report-only first
MFA for everyone, block legacy authentication, stricter rules for admins. Each policy runs in Report-only mode for a few days first; then I check the sign-in logs and the What If tool and only then enforce it. The exact settings are in Setting Up Conditional Access Baseline Policies in Microsoft Entra ID.
Without Entra ID P1 (for example with Business Standard) there is no Conditional Access. In that case I at least turn on Security Defaults.
3. Prevent weak passwords
Microsoft’s global banned list is always on. With P1 you can add your own list: company name, town, product names. That blocks passwords like “Companyname2024!” that formally meet every policy. How to set it up: Microsoft Entra Password Protection.
4. Local admin passwords with LAPS
If the local administrator has the same password on every PC, one compromised device is enough for all of them. Windows LAPS gives each device its own rotating password and stores it in Entra ID. LAPS has to be enabled in the tenant first, and old GPO settings should be gone. Guide: Intune LAPS setup.
5. Keep checking
A policy nobody looks at slowly loses its point. Exclusions stay forever, guest accounts pile up, an admin turns out not to have MFA after all. Once a month I look at:
- Sign-ins of the emergency accounts (there should be none)
- Exclusions in the Conditional Access policies
- Users without an MFA method and guests who haven’t signed in for a long time (these PowerShell snippets help)
- LAPS errors in Intune
Once a quarter I do a test sign-in with an emergency account.
How long does it take?
For a small company I plan about four weeks, because the report-only phases take time, not because there is that much work:
- Week 1: emergency accounts, inventory of admins and service accounts
- Week 2: Conditional Access in report-only mode
- Week 3: enforce the policies, set up password protection
- Week 4: LAPS on a few test devices first, then everyone
