Microsoft 365 & Office 365 Security
Every control, configured and proven.
Microsoft 365 ships with powerful security features, but most are off, in report-only, or licensed and never deployed. We close the gap between what you pay for and what you enforce.
Control library
What we harden
A sample of the controls we review in every engagement, grouped by workload. Each finding is mapped to CIS Microsoft 365 benchmark guidance and the license tier it requires.
| Ref | Control | Why it matters | Tooling |
|---|---|---|---|
| CA-001 | MFA for all usersConditional Access, no per-user MFA exceptions | Stops the large majority of password-spray and credential-stuffing attacks. | Entra ID P1 |
| CA-004 | Block legacy authenticationPOP, IMAP, SMTP AUTH, older Office clients | Legacy protocols cannot do MFA and are the most common way it gets bypassed. | Entra ID P1 |
| CA-010 | Phishing-resistant MFA for adminsFIDO2 keys, Windows Hello, passkeys | Defeats adversary-in-the-middle phishing kits that steal session tokens. | Entra ID P1 |
| PIM-01 | Just-in-time admin rolesNo standing Global Administrators | Shrinks the blast radius of a compromised admin account to minutes. | Entra ID P2 |
| IDP-02 | Risk-based sign-in policiesBlock or step-up on risky users and sign-ins | Responds automatically to leaked credentials and impossible travel. | Entra ID P2 |
| BG-01 | Break-glass accountsTwo excluded, monitored emergency accounts | Prevents a Conditional Access mistake from locking everyone out. | Entra ID |
| Ref | Control | Why it matters | Tooling |
|---|---|---|---|
| EXO-01 | SPF, DKIM and DMARC at enforcementMoving DMARC from p=none to quarantine or reject | Stops attackers sending mail that appears to come from your domain. | Exchange Online |
| EXO-02 | Safe Links & Safe AttachmentsIncluding Teams and Office apps | Detonates attachments and rewrites links at time of click. | Defender for Office 365 P1 |
| EXO-05 | Block auto-forwarding to external domains | A classic sign of business email compromise and silent data theft. | Exchange Online |
| EXO-08 | Anti-phishing impersonation protectionExecutives, finance and key vendors | Catches look-alike domains and display-name spoofing in wire-fraud attempts. | Defender for Office 365 P1 |
| SPO-07 | Restrict "Anyone" links & external sharingExpiring links, domain allow-lists | Anonymous links are the most common way files leave the tenant. | SharePoint / OneDrive |
| TMS-03 | Teams guest & external access policy | Controls who can chat with your staff and join meetings uninvited. | Teams |
| Ref | Control | Why it matters | Tooling |
|---|---|---|---|
| PUR-01 | Sensitivity label taxonomyPublic, Internal, Confidential, Restricted | Gives people and AI tools a clear signal about how data can be used. | Purview Information Protection |
| PUR-03 | Auto-labeling for regulated dataPII, PHI, card data, account numbers | Protects sensitive files even when users forget to label them. | Microsoft 365 E5 / E5 Compliance |
| DLP-01 | DLP across Exchange, Teams, SharePoint, OneDrive | Blocks or warns before regulated data is sent outside the organization. | Purview DLP |
| DLP-04 | Endpoint DLP for browsers and AI sitesBlock paste of labeled content into unapproved AI apps | Closes the gap where staff copy confidential text into public chatbots. | Purview Endpoint DLP |
| AUD-01 | Unified audit log & retention | Without it, incident response and legal holds start blind. | Purview Audit |
| RET-02 | Retention and deletion policies | Keeps what regulators require and removes what only adds risk. | Purview Data Lifecycle |
| Ref | Control | Why it matters | Tooling |
|---|---|---|---|
| INT-01 | Device compliance in Conditional AccessOnly managed, encrypted, patched devices reach data | Stops data syncing to unmanaged home PCs and personal phones. | Intune + Entra ID |
| INT-04 | App protection policies for mobileBYOD without enrolling the device | Keeps corporate data inside managed apps on personal phones. | Intune |
| MDE-01 | Attack surface reduction rules | Blocks the techniques ransomware uses after the first click. | Defender for Endpoint |
| XDR-02 | Defender XDR incident correlationIdentity, email, endpoint and cloud apps in one queue | Turns hundreds of alerts into a short list of real incidents. | Microsoft Defender XDR |
| MCA-01 | Shadow AI and SaaS discovery | Shows which AI and cloud apps staff use, and lets you sanction or block them. | Defender for Cloud Apps |
| SS-01 | Secure Score governanceMonthly review, owners and target score | Makes security progress measurable for leadership. | Microsoft Secure Score |
Capabilities
Building a cyber-resilient enterprise
Beyond Microsoft 365, our security practice covers your whole estate: on-premises networks, multi-cloud, endpoints and the remote workforce.
Security Advisory & Risk
Assess your posture, find the gaps and build a prioritized roadmap.
Identity & Access Management
Control, audit and revoke access to data and services across every system.
Data Security
Classify, encrypt and monitor data through its full lifecycle.
Infrastructure Protection
Harden applications, infrastructure and endpoints against attack.
Cloud Security
Secure Azure, AWS and Google Cloud environments and their identities.
Threat Detection & Response
24/7 monitoring, threat hunting and incident response.
Threat landscape
What's targeting businesses today
The attacks we see most often, and the Microsoft 365 controls above that blunt them.
Data encrypted and stolen for extortion. Countered by MFA, attack surface reduction rules, EDR and tested backups.
Social engineering aimed at wire transfers and credentials. Countered by DMARC, impersonation protection and phishing-resistant MFA.
A vendor breach that spreads into your network. Countered by guest access reviews, least privilege and vendor risk assessment.
Exposed storage and weak identity policies. Countered by CSPM, Secure Score governance and configuration drift monitoring.
Malicious or careless data exfiltration. Countered by DLP, sensitivity labels, audit logging and insider risk policies.
Engagement process
Assess. Design. Implement. Monitor.
A phased approach that fits your risk tolerance, industry requirements and budget, with minimal disruption to the business.
Assess
Evaluate current posture, threat exposure and compliance gaps.
Design
Build an architecture matched to your risk tolerance, regulations and budget.
Implement
Deploy controls, tools and processes in phases, report-only first.
Monitor
Ongoing detection, incident response and continuous improvement.
Compliance mapping
Controls your auditor will recognize.
Every configuration we deliver is documented against the frameworks you answer to, with evidence exports ready for your next audit or cyber-insurance questionnaire.
Financial services, healthcare and mortgage clients get control narratives written for examiners as well as engineers.
Engagements
Ways to work with us
Fixed-scope projects to get secure, and a managed option to stay that way.
M365 Security Assessment
Read-only review of your tenant against CIS and Microsoft baselines.
- Findings scored by risk and effort
- License gap analysis
- Executive summary and roadmap
Hardening Sprint
We implement the roadmap: identity, email, devices and data, staged safely.
- Conditional Access rollout
- Defender & Purview deployment
- Documentation and user comms
Managed M365 Security
Continuous monitoring and a named security lead.
- Defender XDR alert triage
- Configuration drift detection
- Quarterly vCISO reviews