How to check microsoft 365 tenant security

Summary

This guide helps you troubleshoot and resolve: How to check microsoft 365 tenant security. Follow the steps below to fix the issue.

Common Causes

Microsoft 365 provides powerful productivity tools, but a subscription alone does not guarantee your data is secure. Many Australian small businesses leave default security settings in place, which can expose their organisation to unauthorised access, phishing attacks, and data loss. This guide walks you through reviewing your Microsoft 365 tenant security, enforcing Multi-Factor Authentication (MFA), and applying Conditional Access policies to help align your environment with the Australian Cyber Security Centre (ACSC) Essential Eight.

Quick Fix Steps

1. Sign in to the Microsoft 365 admin centre with a Global Administrator account.
2. Verify that MFA is enabled and enforced for all users.
3. Review and enable Conditional Access policies.
4. Check security defaults and legacy authentication settings.
5. Confirm device compliance and antivirus status through Microsoft Intune.

Detailed Instructions

1. Sign in to the Microsoft 365 admin centre

1. Open your web browser and go to https://admin.microsoft.com.
2. Sign in using an account with Global Administrator or Security Administrator privileges.
3. From the left-hand navigation menu, select Show all, then choose Security.

2. Review Multi-Factor Authentication (MFA)

1. In the Microsoft 365 admin centre, go to Users > Active users.
2. Select Multi-factor authentication from the top ribbon.
3. Review the MFA status for each user. Accounts showing Disabled should be changed to Enabled or Enforced.
4. For Microsoft 365 Business Premium, prefer using Microsoft Entra ID (formerly Azure AD) Conditional Access to require MFA rather than legacy per-user MFA.

MFA is one of the most effective controls in the ACSC Essential Eight. It significantly reduces the risk of unauthorised access if a password is compromised.

3. Configure Conditional Access policies

1. Go to the Microsoft Entra admin centre at https://entra.microsoft.com.
2. Select Security from the left menu, then choose Conditional Access.
3. Select New policy.
4. Give the policy a descriptive name, such as Require MFA for all cloud apps.
5. Under Assignments, select Users and groups and choose All users (or exclude emergency access accounts).
6. Under Cloud apps or actions, select All cloud apps.
7. Under Access controls > Grant, select Require multi-factor authentication.
8. Set Enable policy to On and select Create.

Test Conditional Access policies on a small group of users before rolling them out to your entire organisation to avoid accidental lockouts.

4. Enable security defaults (if not using Conditional Access)

1. In the Microsoft Entra admin centre, go to Identity > Properties.
2. Select Manage security defaults.
3. Set Enable security defaults to Yes and select Save.

Security defaults require MFA for all users and block legacy authentication. You cannot use security defaults and Conditional Access policies at the same time.

5. Block legacy authentication

1. In the Microsoft Entra admin centre, go to Security > Conditional Access.
2. Create a new policy named Block legacy authentication.
3. Under Assignments > Users and groups, select All users.
4. Under Cloud apps or actions, select All cloud apps.
5. Under Conditions > Client apps, check Other clients and select Done.
6. Under Access controls > Grant, select Block access.
7. Set Enable policy to On and select Create.

6. Review sign-in logs and risky users

1. In the Microsoft Entra admin centre, go to Monitoring & health > Sign-in logs.
2. Review failed sign-in attempts, unusual locations, and unfamiliar applications.
3. Go to Identity Protection > Risky users to identify accounts that may be compromised.
4. Reset passwords and force MFA re-registration for any flagged accounts.

7. Manage device compliance and antivirus

1. If you have Microsoft 365 Business Premium, go to the Microsoft Intune admin centre.
2. Navigate to Devices > Compliance policies.
3. Create or review policies that require managed antivirus, encryption, and minimum OS versions.
4. Mark non-compliant devices and restrict their access to corporate data until remediated.

8. Align with the ACSC Essential Eight

• Application control: Use Microsoft Defender Application Control or AppLocker to restrict unauthorised applications.
• Patch applications: Ensure Microsoft 365 Apps and third-party software are set to update automatically.
• Configure Microsoft Office macro settings: Disable macros from the internet in Microsoft 365 Apps via Group Policy or Intune.
• User application hardening: Disable Flash, ads, and Java in web browsers where possible.
• Restrict administrative privileges: Limit Global Administrator roles and use separate admin accounts.
• Patch operating systems: Keep Windows devices updated through Windows Update for Business.
• Multi-factor authentication: Enforce MFA for all users, especially remote and privileged access.
• Regular backups: Configure OneDrive and SharePoint retention policies and test restore procedures regularly.

Troubleshooting

Users are being prompted for MFA too frequently

• Review your Conditional Access policies for overly strict sign-in frequency settings.
• Ensure trusted devices and locations are configured correctly.
• Check if users are clearing browser cookies or using private browsing mode.

Legacy authentication is still active

• Verify that security defaults are not enabled alongside Conditional Access policies.
• Check the sign-in logs for protocols such as IMAP, SMTP, or POP3 and block them via Conditional Access.
• Inform users to update older email clients that do not support modern authentication.

Cannot access Conditional Access settings

• Confirm your account has Global Administrator, Security Administrator, or Conditional Access Administrator rights.
• Ensure your subscription includes Microsoft Entra ID P1 or P2 (included with Microsoft 365 Business Premium).
• Sign out and sign back in to refresh your admin role token.

If you are unsure about your current security posture, run the Microsoft Secure Score assessment in the Microsoft 365 Defender portal for prioritised recommendations.

Regularly review your Microsoft 365 tenant security settings to ensure they remain aligned with your organisation's risk profile and the ACSC Essential Eight.

If you host with us, you don't need to do this yourself — just Open a Ticket and our Brisbane team will get it sorted.

Still Having Issues?