Tenant security and Defender. What to check, and what to fix first.
A drifted Microsoft 365 tenant is the most common starting point for engagements. These notes cover Defender baselines, DLP for Copilot and third-party AI, sensitivity labels, external sharing clean-up, Secure Score backlog work and the day-to-day operating model.
Notes on this topic
Short guides on what to check and why it matters.
AI Phishing and UK SMEs: Controls That Work
AI has made phishing more convincing, not fundamentally different. The controls that stop it are phishing-resistant sign-in, layered email filtering and a payment process that does not trust email.
Purview Retention Auto-Archive for SharePoint
Microsoft Purview is adding an archive action to retention policies. It can cut storage spend and Copilot noise, but only if you pilot it on the right content first.
Defender for Business Web Content Filtering
Microsoft 365 Business Premium includes native web content filtering. Protect remote laptops and block malicious web categories without third-party agents.
Exchange Online EWS Retirement: October 2026
Exchange Web Services starts its phased retirement in October 2026. The useful work now is finding every dependency, assigning an owner, and testing a replacement.
SMTP AUTH Basic Auth: December 2026 Plan
Microsoft changed the SMTP AUTH Basic authentication timeline. The extra runway should be used to identify devices and applications, not to preserve shared mailbox passwords.
Cyber Essentials Plus Readiness Guide
This is the readiness guide I would want before booking a Cyber Essentials Plus assessment for a Microsoft 365-heavy environment: scope first, MFA proof, device evidence, patch records, mail controls and a dry run before assessment week.
Intune and Defender Endpoint Control
Endpoint control is not proved by a busy Intune portal. It is proved by managed device coverage, Defender onboarding, compliance enforcement, patch evidence, local admin control and a remediation path for exceptions.
Cyber Essentials Plus Endpoint Samples
The assessor does not care about your best three laptops. They care whether an ordinary sample of business devices reflects the controls you say are in place.
Cyber Breaches Survey Lessons for M365
The latest UK breaches survey is not a reason to panic. It is a reason to tighten the day-to-day Microsoft 365 controls that often get treated as background admin.
Endpoint DLP Only Works When the Endpoint Is Actually Managed
What Endpoint DLP really needs before it becomes useful, and why unmanaged or poorly managed devices make the whole story weaker.
Purview DSPM for AI: Copilot Readiness
Copilot readiness is usually not an AI settings question first. It is a data posture question with a lot of old permissions and neglected workspaces hiding inside it.
Container Labels for Teams, Sites and Groups: Control the Place, Not Just the File
Sometimes the real problem is not one badly handled document. It is the workspace around it being too open, too easy to share, or too loose on unmanaged access.
Sensitivity Labels in SharePoint and OneDrive: A Practical Start
Most label rollouts fail because they are too abstract. People get a list of terms, not a small set of decisions that actually helps them handle data better.
DLP for Copilot and Third-Party AI
AI does not invent a permissions mess. It tends to find it faster, summarise it faster, and make sloppy data controls harder to ignore.
Audit Logs and Evidence: What to Capture Before Assessment Week
Good evidence packs are not glamorous. They are dated, easy to navigate, and strong enough that nobody reconstructs the tenant from memory under pressure.
OAuth App Consent Audit: The Microsoft 365 Backdoor People Miss
How to review OAuth app consent in Microsoft 365 properly, including user consent settings, admin workflow, and the apps that quietly end up with far too much access.
Defender for Office 365 Operations
Email security does not usually fail because the licence was wrong. It fails because the queue had no owner, exceptions multiplied and the monthly review stopped happening.
Microsoft 365 Incident Response Plan
A good Microsoft 365 incident plan does not need to be huge. It needs to help a small team make clean decisions in the first hour, while evidence is fresh.
Guest Access Reviews in Teams
Guest access is usually not risky because it exists. It becomes risky when nobody can explain who still needs it, what they can see, and when it should end.
Mail Forwarding and Inbox Rules: The Audit Nobody Should Skip
Password resets are not cleanup. If you have not checked forwarding, inbox rules and transport rules, you may be leaving the quiet part of an email compromise behind.
Device Compliance and Conditional Access
How to make device compliance matter at the access layer, instead of leaving it as a nice-looking dashboard.
Microsoft Secure Score Backlog
Secure Score is useful because it points at work. It becomes less useful when people turn it into a trophy number and stop asking which recommendations reduce real risk.
SharePoint External Sharing Clean-up
External sharing in Microsoft 365 is usually not one giant mistake. It is dozens of small permissions that nobody came back to tidy up.
Phishing Still Pays: A Microsoft 365 Action Plan for UK SMEs
Phishing is still cheap, common and effective when basic follow-up controls are weak. A Microsoft 365 action plan that makes sense for UK teams without turning into theatre.
Email Security Baselines: Standard vs Strict
Standard and Strict are not personality types. They are operating choices. A practical way to decide what goes where and stop phishing tuning becoming a weekly argument.
Microsoft 365 Security Review for UK SMEs: The First 10 Checks
A decent first Microsoft 365 security review does not need to be dramatic. It needs to show which controls are weak, who owns them, what evidence exists and which fixes reduce tenant risk first.
Where coverage drops
The basics are widespread. Two-factor authentication, remote access and user monitoring are where tenants fall short.
- Updated malware protection81%
- Cloud backups74%
- Password policies74%
- Network firewalls74%
- Restricted admin rights73%
- Two-factor authentication47%
- VPN for remote staff36%
- User monitoring30%
How businesses look for risk
Monitoring tools and risk assessments are the most common checks, and almost half of businesses did neither.
- Security monitoring tools32%
- Cyber risk assessment30%
- Staff tested, such as mock phishing22%
- Vulnerability audit18%
- Penetration test13%
Microsoft 365 security clean-up
Bring the current Secure Score, any recent Defender alerts or exclusions, external sharing settings and the last time DLP or audit settings were reviewed. Note any upcoming audit, board review or AI tool rollout that changes the risk picture.
Ask yourself first
If any of these is hard to answer, a review will help. Move from reading to action when the tenant has licensed controls but no operating rhythm. Governance needs owners, review cycles and proof.
- 01
Are Defender alerts, exclusions, mail security and endpoint coverage owned day to day?
- 02
Which SharePoint, OneDrive, Teams and guest-access choices expose sensitive work?
- 03
Can the tenant produce useful evidence for audit, board reporting or incident response?
Common questions
What does a review look like?
A typical review checks Defender ownership, mail protection, DLP, labels, sharing settings, audit evidence and response habits so licensed features become controls rather than unused portals.
Keep exploring
