Skip to main content
Microsoft 365 stores some of your most sensitive data — emails, documents, contacts, calendars, and business files. That makes it a high-value target for cybercriminals who use phishing, credential stuffing, and brute-force attacks to gain unauthorized access. Fortunately, Microsoft 365 includes a robust set of security tools that, when properly configured, create multiple layers of protection for your account and your organization’s data. This guide walks you through the most important security steps every Microsoft 365 user and administrator should take — from enabling multi-factor authentication to reviewing app permissions and leveraging Microsoft Defender.
Without MFA enabled, your Microsoft 365 account is vulnerable to credential stuffing attacks, where attackers use leaked username and password combinations from other data breaches to access your account. Enable MFA immediately after completing your initial Microsoft 365 setup — do not wait.

​
Enable Multi-Factor Authentication (MFA)

Multi-factor authentication (MFA) is the single most effective security measure you can enable for your Microsoft 365 account. MFA requires you to verify your identity using a second factor — typically a code from an authenticator app or a text message — in addition to your password. Even if an attacker obtains your password, they cannot access your account without that second factor. Microsoft reports that MFA blocks over 99.9% of automated account compromise attacks. Enabling it takes less than five minutes and should be your first security action.
1

Go to your Microsoft account security settings

Navigate to account.microsoft.com/security and sign in with your Microsoft 365 credentials.
2

Open Advanced security options

On the Security page, click Advanced security options to access the full range of verification settings.
3

Turn on Two-step verification

Under the Two-step verification section, click Turn on and confirm your choice when prompted.
4

Set up your verification method

Follow the on-screen prompts to configure your second factor. You can choose the Microsoft Authenticator app (recommended), an alternative authenticator app, or SMS text message verification. Complete the setup and save your backup codes in a secure location.
Use the Microsoft Authenticator app rather than SMS for your second factor. Authenticator app codes are generated locally on your device and are not susceptible to SIM-swapping attacks, which can intercept SMS-based codes. Download the Microsoft Authenticator app from the App Store or Google Play.

​
Strong Password Practices

Even with MFA enabled, your password remains an important line of defense. A weak or reused password significantly increases your risk of compromise. Follow these practices to keep your credentials strong:
  • Use a unique, complex password of at least 14 characters. Combine uppercase and lowercase letters, numbers, and symbols. Avoid dictionary words, your name, or predictable patterns like “Password123!”.
  • Never reuse passwords across services. If another service you use suffers a data breach and you’ve reused your Microsoft password, attackers can use those leaked credentials to attempt access to your Microsoft 365 account.
  • Use a password manager such as Bitwarden, 1Password, or the built-in password manager in Microsoft Edge. A password manager generates and stores complex unique passwords for every account, so you only need to remember one master password.
  • Microsoft 365 admins can enforce organization-wide password policies — including minimum length, complexity requirements, and expiration intervals — via the Microsoft 365 Admin Center under Settings → Org settings → Security & privacy → Password policy.

​
Manage App Permissions and Connected Apps

Over time, you may grant third-party apps and services access to your Microsoft 365 account — for integrations, productivity tools, or single sign-on logins. Each connected app is a potential access point if that app is ever compromised. Regularly reviewing and revoking unnecessary permissions is an important security habit. To audit your connected apps:
  1. Go to myapps.microsoft.com and sign in with your Microsoft 365 account.
  2. Review the list of applications that have been granted access to your account.
  3. Click on any app you don’t recognize or no longer use and select Remove or Revoke access to disconnect it.
  4. For administrator-level control, IT admins can manage enterprise app permissions via Azure Active Directory → Enterprise Applications in the Microsoft Entra admin center.
Be especially cautious of apps requesting broad permissions such as access to read and send emails on your behalf, or full access to your files — grant only the minimum permissions an app truly needs.

​
Safe Sharing in OneDrive and SharePoint

OneDrive and SharePoint make it easy to share files and folders, but sharing settings deserve careful attention — especially when dealing with sensitive or confidential information.
  • Avoid “Anyone with the link” sharing for sensitive files. This setting allows anyone who obtains the link — even if forwarded outside your organization — to access the content without signing in. Reserve it only for low-sensitivity public content.
  • Set expiration dates on shared links so access automatically revokes after a set period. This is particularly important for external collaborators or temporary project access. You can set expiration dates in OneDrive by clicking Share → Link settings → Set expiration date.
  • Add passwords to shared links for an extra layer of access control. Recipients must enter the password you set before they can view the file.
  • Use “Specific people” sharing for confidential documents. This limits access to named individuals with Microsoft accounts, ensuring only the intended recipients can open the file.
Admins can configure organization-wide external sharing policies in the SharePoint Admin Center under Policies → Sharing to enforce these best practices across the entire organization.

​
Microsoft Defender for Microsoft 365

Microsoft Defender for Microsoft 365 is a cloud-based security suite that protects your organization from advanced threats delivered through email, links, and collaboration tools. It operates silently in the background, continuously scanning for malicious activity. Key protections include:
  • Anti-phishing policies that detect and block sophisticated phishing attempts, including impersonation attacks targeting executives and spoofed sender domains.
  • Anti-malware scanning that inspects incoming and outgoing emails for known malware signatures and suspicious payloads.
  • Safe Links that scan URLs in emails and Office documents in real time, blocking known malicious links even if they were benign at the time of delivery.
  • Safe Attachments that opens email attachments in a sandboxed virtual environment to detonate and analyze potentially malicious files before they reach your inbox.
Microsoft Defender for Office 365 (Plan 1) is included in Microsoft 365 Business Premium at no additional cost. For organizations on Business Basic or Business Standard, Microsoft Defender can be added as a standalone add-on license. Admins can configure Defender policies in the Microsoft 365 Defender portal at security.microsoft.com.

​
Security Checklist

Use this checklist to verify that your Microsoft 365 environment meets baseline security standards. Expand each item for details on what to check and how to act.
Every user in your organization — not just administrators — should have multi-factor authentication enabled. Admins can enforce MFA organization-wide via Azure Active Directory → Security → Conditional Access or by enabling Security Defaults in the Entra admin center. Personal accounts should enable MFA at account.microsoft.com/security.
Check your recent sign-in history for unfamiliar locations, devices, or times. Go to account.microsoft.com/security → Review activity. If you see sign-ins you don’t recognize, change your password and revoke active sessions immediately. Admins can review org-wide sign-in logs in the Microsoft Entra admin center under Monitoring → Sign-in logs.
Your recovery contact information is critical for regaining access if you’re ever locked out. Visit account.microsoft.com/security → Update info to verify that your recovery email address and phone number are current and accessible. Outdated recovery details can leave you permanently locked out of your account.
Human error is the leading cause of security breaches. Run regular phishing awareness training for all employees who use Microsoft 365. Microsoft offers Attack Simulation Training in the Microsoft 365 Defender portal, which sends simulated phishing emails and provides instant feedback and training modules to employees who click through. Aim for at least quarterly simulation campaigns.
Microsoft 365 audit logs record user and admin activity across Exchange Online, SharePoint, OneDrive, Teams, and more. Audit logging must be explicitly turned on — it is not always enabled by default on older tenants. Go to the Microsoft Purview compliance portal → Audit → Start recording user and admin activity. Logs are essential for investigating security incidents and meeting compliance requirements.
Over time, shared files and folders accumulate stale access permissions. Schedule a quarterly review of OneDrive and SharePoint sharing settings. In OneDrive, right-click any shared file → Manage access to see who has access and remove anyone who no longer needs it. Admins can run sharing reports from the SharePoint Admin Center to get a full picture of external sharing across the organization.
Now that your Microsoft 365 account is properly secured, you’re ready to tackle any technical issues that come your way. If you run into activation errors, sign-in problems, or sync issues, our Microsoft 365 Troubleshooting guide walks you through fixes for the most common problems step by step.