Microsoft 365 Security Best Practices

Plenty of organizations run on Microsoft 365, some on Exchange Online alone and others across OneDrive, Teams, and SharePoint too. Whatever your mix, a few practices will strengthen the environment and help you take care of the data inside your environment.

The M365 best practices our team recommends most fall into three areas: hardening, monitoring, and backup. All three also need regular review as the platform changes.

What are the most important Microsoft 365 security best practices?

The core Microsoft 365 security best practices are:

1. Harden your M365 configuration by aligning it with a security benchmark such as CIS.
2. Put a monitoring platform in place to catch malicious activity, internal and external.
3. Back up your M365 data on a regular schedule, and consider a backup provider outside the Microsoft ecosystem.
4. Review your hardening, monitoring, and backup approach regularly as the platform evolves.

How do you harden Microsoft 365?

Start by aligning your M365 configuration with a recognized benchmark. Our team strongly encourages the CIS benchmark recommendations. They're pretty strong, and they give you an objective look at the different configurations available across the platform.

You may not adopt every recommendation as written. Our team sees a few things in the CIS benchmark you could scale back, depending on functionality and how your organization uses the platform. Aligning with some form of benchmark to strengthen the environment, though, is paramount.

How do you monitor Microsoft 365 for malicious activity?

Once the environment is hardened, move into a monitoring platform of some kind. There are a couple of ways to go here.

One leans toward configuration standardization, with SaaS alerts. Within that, you can monitor for activity that may be malicious, whether it comes from inside or outside the organization. Large file downloads are one example. Unusual sign-ins and mail forwarding rules are others worth watching.

For a deeper layer, you can fold in Huntress ITDR, which adds a deep cloud SOC approach to monitoring the platform and confirming no malicious activity is taking place.

Does Microsoft 365 back up your data by default?

No. We run into a lot of organizations that assume a cloud platform is automatically backed up. Really and truly, by default, it's not.

Being certain your data is safe and backed up is a key piece of the M365 puzzle. Whether you use a Microsoft backup product or a third party, standardize on one. Treat it much like your on-premise environment and get a regular backup.

Some organizations take it a step further and back up their M365 data outside the Microsoft ecosystem entirely, with another backup provider. That keeps your data available in the event of a really bad day.

How often should you review Microsoft 365 security settings?

Continually. Microsoft 365 evolves on a daily basis, so your hardening approach, your monitoring, and your backup strategy all need regular review to make sure you're truly covered over time.

Don't rest on a config you put in place a year ago and assume it's still viable and good.

Questions to ask your IT team or MSP

Talk with your internal IT team, or with your technology partner or MSP, about each of these areas. Bring these questions:

• Is our Microsoft 365 configuration documented against a known benchmark, such as CIS or NIST?
• Who's watching for unusual sign-ins and mail forwarding rules?
• Are we backing up the data? And are we backing up the data outside of Microsoft?
• What are we doing from a hardening and a monitoring approach?
  
  

Microsoft 365 security FAQ

Is Microsoft 365 data backed up automatically?

No. By default, Microsoft 365 data is not backed up. StrataDefense recommends standardizing on one backup product, either Microsoft's or a third party's, and running regular backups the same way you would for an on-premise environment.

Should I back up Microsoft 365 outside of Microsoft?

For some organizations, yes. Backing up M365 data to a provider outside the Microsoft ecosystem helps keep that data available if something goes badly wrong inside it.

Which security benchmark should I use for Microsoft 365?

StrataDefense strongly encourages aligning your M365 configuration with the CIS benchmark recommendations, which give an objective look at the configurations available. NIST is another known benchmark. Some CIS recommendations may be scaled back depending on how your organization uses the platform.

What should I monitor for in Microsoft 365?

Watch for activity that may be malicious, from inside or outside the organization. Examples include large file downloads, unusual sign-ins, and mail forwarding rules. SaaS alerts support configuration standardization, and a tool like Huntress ITDR adds a deep cloud SOC layer.

How often should Microsoft 365 security be reviewed?

Regularly and continually. The platform evolves daily, so a configuration from a year ago may no longer hold up. Review your hardening, monitoring, and backup strategy together.

Get a second set of eyes on your M365 environment

If you'd like a third-party, objective opinion, reach out to the team at StrataDefense for a no-fee consult. Book at stratadefense.com/contact-us or call (715) 842-7665.