Microsoft 365 Security Settings Worth Reviewing in an Established Tenant
Microsoft 365 changes continuously. A tenant that was configured several years ago may still work perfectly while carrying policies, exceptions and application access that nobody would choose if the environment were being designed today.
The useful question is not whether your Microsoft 365 tenant is “old”. It is whether somebody periodically reviews the settings that control identity, devices, sharing, applications and audit visibility.
1. Review how MFA and Conditional Access are actually enforced
Do not stop at “we have MFA”. Confirm which users are covered, which authentication methods are allowed, what happens to administrator accounts and whether Conditional Access policies have exclusions that are still justified.
Where the risk warrants it, move toward phishing-resistant authentication such as suitable passkeys or security keys. We cover the practical relationship between MFA, passkeys and Conditional Access in our account-takeover guide.
2. Review external sharing in SharePoint and OneDrive
Check the organisation-level sharing settings and the defaults users see when they create links. The right balance depends on how your business works with clients and suppliers, but “anyone with the link” should be a deliberate business decision rather than an inherited default nobody remembers approving.
Also review older guest access and shared links. Changing the default for future sharing does not automatically tidy every historic permission.
3. Check automatic forwarding and mailbox rules
External forwarding can be legitimate, but it is also a common way for information to leave the business unnoticed. Review the outbound forwarding policy as well as suspicious or obsolete mailbox rules.
If a mailbox has ever been compromised, attackers may create rules that hide or redirect messages. Forwarding and rule review therefore belongs in both routine configuration management and incident response.
4. Review third-party applications and user consent
Microsoft 365 environments accumulate connected applications over time. Some are important; others were authorised for a short project, belong to software the business no longer uses, or were approved by a staff member who has since left.
Review enterprise applications and consented permissions, identify owners, and remove access that no longer has a business purpose. This is the Microsoft 365 version of the broader Shadow AI and unsanctioned-app problem.
5. Check device-access expectations
Decide whether sensitive business data should be accessible from unmanaged devices and whether those expectations are enforced. Microsoft 365 identity and Intune controls can work together so access decisions consider the user, authentication strength and device state rather than only the password.
6. Confirm audit and investigation coverage
Make sure the business has the audit data it expects to have when investigating suspicious activity. Microsoft 365 audit capabilities and retention vary by licence and workload, so this should be checked against your actual licensing and any contractual or regulatory needs rather than assumed from a generic checklist.
7. Remove historical exceptions
Old exclusions are often more important than headline settings. Temporary Conditional Access exclusions, legacy service accounts, guest users, test administrators and one-off sharing arrangements can quietly become permanent.
A useful tenant review asks, “if we were configuring this today, would we still make this exception?” If not, remove it through normal change control.
Turn the review into a recurring process
The value is not in doing a one-off seven-point audit and declaring Microsoft 365 finished. The platform, the business and the threats all change. Important configuration should be revisited as part of an ongoing technology and security review.
If you want a quick view of the wider security baseline, start with our IT Security Self-Check. For a deeper Microsoft 365 review, see our managed IT support and cyber-security services. If you'd like to talk through how this applies to your business, get in touch.