Microsoft 365 Email Security: A Practical Checklist

Enforce multi-factor authentication

MFA is the highest-value security control you can apply, full stop. The overwhelming majority of account compromises involve a stolen or guessed password, and MFA stops almost all of them by requiring a second factor the attacker does not have.

Cover every account, especially admins

Enforce MFA for all users, not just some. Administrator accounts are the most valuable targets, so they need the strongest protection — ideally with phishing-resistant methods. A single admin account without MFA can undo every other control in this list.

MFA only protects logins that go through modern authentication. That is exactly why closing legacy protocols, covered next, is the necessary partner to enforcing MFA.

Close legacy authentication

Legacy authentication refers to older protocols and clients that do not support modern authentication — and crucially, do not support MFA. As long as legacy auth is allowed, an attacker can use it to log in with just a password, bypassing your MFA entirely.

Blocking legacy authentication is therefore essential to making MFA meaningful. Before you block it, check for any genuine dependency — an old device or application still using it — and modernise or replace it. Then turn legacy auth off so the bypass route is closed.

Get your DNS and authentication right

Microsoft 365 supplies the records you need, but it is your responsibility to publish and maintain them correctly. Getting SPF, DKIM and DMARC right both protects your deliverability and stops people spoofing your domain.

• Publish a correct SPF record that authorises Microsoft 365 and any third-party tools that send as your domain.
• Enable DKIM signing for your domain in the Microsoft 365 admin centre and publish the keys.
• Add a DMARC record, start at monitoring, then move to enforcement once aligned.
• Keep MX records pointing where they should and remove stale entries.

A common trap is leaving DKIM disabled because Microsoft 365 will still send mail without it. Mail flows, but you are missing a key authentication signal and weakening both deliverability and spoofing protection. Our SPF, DKIM and DMARC guide walks through the detail.

Defend against phishing and BEC

Business email compromise (BEC) is the most financially damaging email attack. It typically involves an attacker impersonating a senior person or a supplier to redirect a payment or extract sensitive information. Microsoft 365 includes protections that help, but they need configuring.

Anti-phishing and impersonation protection

Configure anti-phishing policies, including impersonation protection for your key people and domains, so messages pretending to be your finance director or a trusted supplier are caught. Combine this with DMARC at enforcement, which stops exact-domain spoofing, and external-sender warnings that flag mail from outside the organisation.

Technology is only half the answer. Clear internal processes — verifying payment changes out of band, never acting on an emailed bank-detail change without a phone call — close the gap that no filter fully covers.

Harden admin access and monitor

Administrative accounts are the keys to the kingdom, so they deserve disproportionate care. The aim is to limit how many exist, what they can do, and how quickly misuse is noticed.

• Use the principle of least privilege — grant the minimum admin role each person actually needs.
• Keep the number of global administrators small and use separate accounts for admin work.
• Ensure auditing and mailbox logging are on, so you can investigate after an incident.
• Set up alerts for risky sign-ins and suspicious mailbox rules, a classic sign of compromise.

A frequent indicator of a compromised mailbox is a hidden rule that forwards or deletes incoming mail. Reviewing for unexpected forwarding and inbox rules is a quick, high-value check.