What you Probably Didn't Know About your Microsoft 365 Account

Microsoft 365 is a powerful suite of cloud-based applications and services that can boost your productivity, collaboration, and security. However, many businesses are not aware of the various security settings and configurations that are available in the M365 ecosystem. Settings that are paramount to the security and protection of your company data. These settings can help you protect that data, your devices, and identity from cyber threats and malicious actors. In this article, I will explore some of the best practices that you must configured in order to protect your business, enhance your security posture, and make the most of your M365 account.

The use of cloud-based software has grown rapidly among organizations in the past few years. The Covid-19 pandemic accelerated this trend as it enabled remote work. The businesses that embraced cloud-based platforms had an edge in maintaining their operations as their employees shifted to working from home.

Many people were reluctant to adopt M365 and other similar Software as a Service (SaaS) solutions because of cloud app security concerns. However, Microsoft M365 is becoming more popular because of its distinctive features. It is important to take measures to secure the environment. Many practices do not require additional investment in security systems but make use of what M365 offers.

How does security in Microsoft 365 work?

Microsoft 365 security focuses on defending businesses from external attacks by providing them with high-quality resources and protection. The threat protection features block the business from malware, spam, viruses, malicious links, or phishing attempts. Sophisticated techniques are used for protection from complex threats such as ransomware attacks.

Why is your data more secure in Microsoft 365?

M365 offers built-in security features to safeguard businesses and enable the staff to work from anywhere in the world, using devices of their own preference. Here are some reasons why M365 keeps your data more secure:

Security. M365 has stated how much they have invested in making their products secure. The Multi-factor authentication applied to all services makes it more secure than many other cloud services.

Control. A set of controls lets users adjust who can access their information and files. The huge amount of personal data that is exchanged over the web needs to be stored in a secure place.

Automation. M365 has automated many tasks. Most security problems are caused when a user mistakenly opens a malicious email, discloses personal data, or other mistakes that are mostly reduced by automation.

Best Security Practices in Microsoft 365

M365 is one of the leading cloud-based services from Microsoft. It enables remote work with its security features and has regained its popularity. Here are some ways to protect your information in M365 from cyberattacks.

Educating Users. Microsoft 365 is often targeted by phishing attackers. They can access your emails and data and spread malware and malicious links inside and outside your organization for their financial gain. Teaching your employees about security through phishing simulators or other methods is a key strategy to secure your organization’s emails and database.

Microsoft Secure Score. Microsoft 365 has two methods of security reporting. One of them is part of M365 security, called Microsoft Secure Score. It is a numerical representation of your security posture based on system configuration, security metrics, and user behavior. However, this does not indicate the exact probability of your system or data being breached. It will scan your system and alert you of ways to improve your tenant configuration for optimal security.

Identity Secure Score. Identity secure score is a relatively new feature that helps you check if your security policies align with Microsoft’s best practices. It is a subset of the Security score and a section of the Azure Active Directory Admin Center. Experts suggest reviewing the scores regularly to enhance your overall security efforts. Identity secure score will examine your environment and inform you of the steps to take for better security.

Enable Unified Audit Log. The first step is to prioritize the security of your M365 tenants. The next step is to have a plan of action in case of a breach. Logging can help you find the exact location and time of the attack. For the administrator, the mailbox audit logs will be enabled automatically. The log information can be collected and searched easily on the Microsoft compliance portal. The software will generate alerts for a specific event automatically. The entries in the Unified Audit log will be stored for about 90 days. To extend the use of this feature, e5.5 is needed.

Configure Multi-Factor Authentication. Enabling multi-factor authentication (MFA) is highly recommended for M365 security. It protects your accounts from password sprays and phishing attacks. All accounts, including admins and users, should have multi-factor authentication enabled. Multi-Factor Authentication Settings To enable MFA, log in to the portal at https://aad.portal.azure.com/. In the user’s column, enable Multi-factor Authentication.

Strong Passwords. You should not let the users create passwords, as these features are needed by apps that do not support modern authentication. You should also disable the option of calls and text messages, as they can expose your system to attacks and data theft. Choose the option of setting the devices for 90 days. Add the notification for extra context and number matching MFA request to identify who made the requests. Don’t Allow Reuse of Corporate Passwords Strong and new passwords are essential for cybersecurity in any organization. Using the same passwords for personal and work accounts increases the risk of compromising your security while the hacker tries to break into your system or guesses your passwords easily.

Install Anti-Malware solution. The hackers are finding new ways to bypass the security solutions and challenge the organization’s efforts to protect their documents. Malware and ransomware attacks are becoming more powerful, making it hard for cybersecurity to detect and react before it harms the organization. M365 security features include malware vectors for initially accessing the organization and spreading across its network environment. A dedicated malware solution can stop the propagation of malware in the organization through M365.

Anti-Phishing Protection. M365 is the most frequent target of phishing scams, which include business email compromise (BEC) attacks. The hackers can launch spear phishing attacks to gain a strong foothold and achieve their goals if they successfully break into the M365 account. An email security system integrated with anti-phishing features can reduce this risk in several ways. Suspicious attachments and links are identified by testing emails in a sandbox environment. Artificial intelligence is used for natural language processing (NLP) to spot dubious language. It alerts attacks and other phishing email warning signs.

Deploy a Combination of App Security. Phishing and spreading malware are mostly done through emails, but other collaboration apps can also be used for this purpose. M365 provides applications for online collaboration, such as OneDrive and Microsoft Teams. The risks of phishing attacks on these applications are similar to those of phishing emails. Malicious links and malware can be sent on chat windows or hidden in shared files and folders stored in OneDrive. Securing emails in M365 is as important as securing collaboration apps.

Applying Mobile Security Settings. Covid-19 has created new trends of work, increasing work from home. The use of mobile phones for work has increased, and employees are asked to bring their own devices to their workplaces. The devices are often not updated, and employees fail to install anti-malware for their protection. Mobile devices have unique security requirements and need security solutions that are specially designed for them. Applying security measures on mobile phones is essential to ensure that a phone with compromised security does not access M365 mobile applications. This lowers the chances of hackers trying to access the company’s sensitive systems and data.

M365 Compliance Center. The customers can scan their files to check the type of data in the system. Mostly this will involve scanning for exchange, OneDrive workloads, personally identifiable information on SharePoint, and many other compliance and scan scores that will be available on the Microsoft Compliance Score.

Compliance and Security Dashboard. A quick overview of threats and different events in the network environment is shown on the compliance and security dashboard. The Exchange workload is the most vulnerable to attacks, but the features also cover DLP policies and sensitivity labels. Alert Policies The feature of alerts coming to users is enabled by M365 Tenant. The activities of users and admins can be tracked and send alerts of threats or data loss.

Continuous Access Evaluation. Authentication in M365 relies on the OAuth 2.0 access token. These limit access to the services, like logging in to SharePoint or opening Outlook. The token is only valid for an hour and automatically refreshes once it expires. The problem with this is that any changes made to the user’s credentials that authorize it are detected after an hour. Enabling Continuous Access Evaluation can shorten the time almost to real-time.

External Users. M365 allows you to host external users in OneDrive, SharePoint, or other tools for team collaboration. You can choose the sharing policies that best suit you and your company. Many end users do not have enough IT knowledge to limit sharing internally. The best approach would be to exclude people who have not been approved by IT for collaboration, also known as existing guests.

Azure Portal Inactivity Timeout. You can use the Azure portal to set up inactivity timeouts for the portal and admin users. You need to have Global Administrative rights to change settings. Inactive users for more than 60 minutes are automatically removed.

Conditional Access Through Azure. You can secure access to M365 with Azure AD conditional access features. Tenants are protected from threats that may arise from their location, applications used, or iPhone IP addresses. When combined with user properties of AD, you can block access from a malicious site.

Sharing Links. Sharing links configuration is important for automatic generation by the users. The best solution is to provide the option “Specified people” for those selected by users. You can still send a link to other users in the organization, but the access to the files will be limited to those who are authorized.

Block Access to Azure Portal. Only authorized people can use Azure Active Directory and Microsoft Azure Portals. You can change it from read-only. The random users will not need to access the settings of Azure AD, where you can easily block them by changing passwords.

Microsoft Advanced Threat Protection. Microsoft M365 helps companies protect themselves from emails and viruses. The attacks are shown using reporting, administrator features, and URL tracking. Microsoft is constantly working to enhance its security, and these features are upgraded with advanced features. You should read the product’s documentation before subscribing to it. ATP is an application software based on Microsoft windows.

Classification of Data. You have a data classification option for M365 on the admin console to protect your data from unauthorized third parties. The labels specify the sensitivity and processing of the data, including mandatory encryption and watermarking. Any attempt to access the data is carefully watched, and the source is traced. The use of Endpoint Protection ensures the files do not leave the organization.

Microsoft 365 is a powerful and secure cloud-based service that offers many benefits for businesses and individuals. However, it also requires some best practices to ensure optimal security and performance. In this blog, we have discussed some of the ways to protect your information, access, and devices in M365, such as educating users, enabling multi-factor authentication, deploying app security, configuring sharing links, and using advanced threat protection. By following these tips, you can make the most of your M365 account and enjoy its features with peace of mind.

If you use the M365 platform and want to protect it and your business from a breach or worse, reach out for a chat. We can help.

Cloud Matrix IT™ is a managed IT and technology consulting firm who specializes in providing proactive IT solutions to small and medium-sized businesses. We designed IT PROTECT specifically for the SMB. IT PROTECT is a comprehensive suite of solutions & processes that help your business save time, reduce costs, provide your staff IT support, and help you stay protected with our fully managed 24/7/365 SOC PLUS cybersecurity platform. Yes, even weekends and holidays.