A Microsoft 365 security baseline for Indian SMBs

Most Microsoft 365 tenants we audit are running close to default settings, which is not a criticism of anyone: the defaults are designed to work everywhere rather than to be secure anywhere in particular. This is the baseline worth applying, ordered by what actually reduces risk.

1. Multi-factor authentication, with no exceptions list

Compromised credentials remain the most common way businesses get breached, and MFA closes most of that. The failure mode is not forgetting to turn it on, it is the exceptions list: a service account here, an executive who found it annoying there. Attackers find those.

If an account genuinely cannot use MFA, restrict it by other means: block it from interactive sign-in, limit it to known addresses, and review it quarterly. An exception without a compensating control is just a gap with paperwork.

2. Block legacy authentication

Older protocols cannot do MFA, which makes them the obvious route around it. Blocking them is usually straightforward, and the risk is an old device or application that still uses them. Check sign-in logs for legacy authentication before blocking, fix what appears, then block.

3. Conditional access that reflects how you work

Once identity is protected, conditional access is where the leverage is. Sensible starting policies: require MFA for all users, require compliant or managed devices for access to company data, block sign-ins from countries you never operate in, and require reauthentication for administrative actions.

Build these in report-only mode first and watch for a week. Turning on a policy you have not modelled is how you lock out your own finance team on a Friday afternoon.

4. Separate and protect administrator accounts

Administrators should not browse the web and read email from an account that can reconfigure your tenant. Separate admin accounts, no mailbox on them, MFA enforced, and used only for administration. Break-glass accounts excluded from conditional access, stored securely and monitored for use.

Also: count your global administrators. Most tenants have several more than they need, frequently including a former consultant.

5. Device compliance and encryption

Enrol devices in Intune, require encryption, require a screen lock, and make compliance a condition of access. Half the value of device management is not the control itself, it is being able to answer whether a lost laptop was encrypted, without hoping.

6. Mail protection beyond the default

Configure anti-phishing policies with impersonation protection for your own domain and your executives. Turn on safe links and safe attachments if your licence includes them. Publish SPF, DKIM and DMARC properly, and move DMARC to enforcement once you have watched the reports long enough to be confident. Half-configured DMARC does nothing.

7. Logging and alerting

Turn on unified audit logging if it is not already on. Set alerts for the things that actually matter: new global administrator, mailbox forwarding rule created, unusual sign-in location, large download from SharePoint. A compromise nobody notices is indistinguishable from no compromise until it is very obvious.

8. Sharing and guest access

Default sharing settings are generous. Decide whether anonymous links should exist, set an expiry if they do, and review guest accounts periodically. Guest access is useful and it accumulates.

What this does not cover

This is a baseline, not a security programme. It does not give you monitoring with somebody watching, incident response capability, or backup, which Microsoft 365 does not provide for your data. It does close the majority of the routes we actually see used against small and mid-sized businesses, and most of it is included in licences you already hold.