Enhancing email security in Microsoft 365
The default tenant is not hardened. The settings, authentication records and monitoring that stop most business email compromise.
By the Telappliant team
Microsoft 365 out of the box stops commodity spam and little else. Almost every business email compromise we investigate would have been prevented, or caught much earlier, by a handful of configuration changes that cost nothing but attention.
Fix identity first
- Enforce MFA for every account, including shared mailboxes' owners and service accounts
- Block legacy authentication, which bypasses MFA entirely
- Use conditional access to restrict sign-in by location, device compliance and risk
- Remove standing global administrator rights and use just-in-time elevation
Get your authentication records right
SPF, DKIM and DMARC together tell the world which servers may send as your domain. Publish SPF with a hard fail, sign with DKIM on every sending service, then move DMARC from none to quarantine to reject as the reports come clean. Without DMARC at enforcement, anyone can spoof your domain to your own staff.
Harden the mail flow
- Safe Links and Safe Attachments on all users, not just executives
- External sender warnings on inbound mail
- Block auto-forwarding to external addresses, the classic sign of a compromised mailbox
- Impersonation protection for your directors and finance team
- Quarantine policies staff can actually use, so they stop asking IT
Watch for the compromise you did not prevent
Enable unified audit logging and alert on the signals that matter: new inbox rules that move mail to Deleted Items, mailbox forwarding changes, impossible-travel sign-ins, and mass download from OneDrive or SharePoint. These fire hours before the fraudulent invoice goes out.
The human layer
Payment changes must be verified out of band on a known number, every time, regardless of who appears to be asking. Train it, rehearse it, and make it a process the finance team is thanked for following rather than pressured to skip.
A one-day hardening plan
- Turn off legacy auth and confirm nothing breaks
- Enforce MFA and conditional access baselines
- Publish or tighten SPF, DKIM and DMARC
- Enable Safe Links, Safe Attachments and anti-impersonation
- Set alerts for forwarding rules and risky sign-ins
Next steps
Frequently asked questions
Was this article helpful?
