What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A secure Microsoft 365 tenant needs a deliberate review of three connected areas: identity and administrator access, email and collaboration, and devices. Start by verifying security defaults and multifactor authentication (MFA), then check admin privileges, mailbox protections, endpoint policies, and Baseline Security Mode impact reports. Your subscription determines which controls are available, so confirm entitlements in the tenant before changing policy.
What this Microsoft 365 security review covers
Microsoft’s small-business guidance groups tenant security into account security, email and collaboration security, and device security. Treat those as one control system: a strong sign-in policy is less useful if an administrator is over-privileged, a mailbox can be spoofed, or an unmanaged laptop can copy company data. The checks below are designed for Microsoft 365 business tenants and should be adapted to your subscription, users, devices, and regulatory obligations.
This is a configuration review, not a claim that every tenant has the same settings. Microsoft changes plan entitlements and admin-center workflows, so record what your tenant actually shows before you make a change. The Microsoft 365 for business security overview is the reference for included capabilities.
1. Establish scope, ownership, and a safe change process
Inventory the tenant before touching policy
Write down the tenant name, domains, business subscription, number of users, privileged roles, enrolled devices, mail-flow dependencies, and any third-party applications that sign in to Microsoft 365. A small company often has one person doing several jobs, but security ownership still needs to be explicit. Identify who can administer Microsoft Entra, Exchange Online, SharePoint and OneDrive, Teams, and endpoint management. Baseline Security Mode supports role-based access control, and workload-specific administrators can manage settings for their own area.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Confirm whether the organization uses Business Basic, Business Standard, Business Premium, or another combination of licenses.
- List every account with a privileged role, especially Global Administrator, and document why each role is needed.
- Identify the current MFA method, recovery contacts, emergency access accounts, and sign-in methods used by applications or older devices.
- Record whether devices are managed through Intune, the Defender portal, another management system, or not managed at all.
- Export or otherwise preserve current policy settings so a failed change can be reversed.
Assign a change owner and a rollback owner
Do not make tenant-wide security changes from an untested personal account. Assign one person to make the change and another to verify sign-ins, mail flow, device access, and business applications. Schedule changes outside critical operating periods, notify users about new prompts, and keep a tested recovery route available before enforcing a control.
2. Review Baseline Security Mode and its impact reports
Find the settings
In the Microsoft 365 admin center, open Show all → Settings → Org Settings → Security and Privacy → Baseline Security Mode. Microsoft describes Baseline Security Mode as applying across Microsoft 365 apps, SharePoint and OneDrive, Teams, Exchange Online, and Microsoft Entra. The official settings reference is Baseline security mode settings.
Use impact reports before enabling controls
Review the impact report for each setting rather than enabling every control in one batch. Microsoft’s guidance is straightforward: if a report shows zero impacts, enable the setting; if it identifies a critical dependency, resolve that dependency first. Settings can be managed independently, and an administrator can temporarily disable a setting while investigating what depends on it.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →- Open one Baseline Security Mode setting and run or view its impact report.
- Export the affected users, applications, devices, or workloads to a change record.
- For a zero-impact report, schedule activation and verify the result with a test account.
- For a non-zero report, identify the dependency, test a supported replacement or exception, and obtain owner approval before enabling the control.
- After activation, check sign-in logs, mail flow, Teams access, SharePoint/OneDrive access, and endpoint compliance for the affected scope.
Do not treat a zero-impact report as proof that a control can never cause disruption. It is evidence about the report’s current scope and data; new applications, users, or devices can create dependencies later. Keep a dated record of each report and activation decision.
3. Confirm MFA and choose one identity-control model
Verify security defaults first
Microsoft says every Microsoft 365 business subscription includes Microsoft Entra ID Free and security defaults. Tenants created after October 2019 have security defaults enabled by default according to Microsoft’s MFA guidance, but a default is not a guarantee that the setting is still enabled. In the Microsoft Entra admin center, verify the tenant status. When enabled, the interface displays “Your organization is protected by security defaults.” The setup instructions are in Microsoft’s multifactor authentication guidance.
Security defaults provide a baseline without requiring you to design a policy set. They are the right starting point for many small tenants that need broad protection and do not have a plan or staffing level for granular conditions.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Understand when Conditional Access is appropriate
Conditional Access requires Microsoft Entra ID P1 or later. Microsoft lists Microsoft 365 Business Premium as including Entra ID P1. Conditional Access lets you target users, applications, device states, locations, risk signals, and authentication requirements more precisely than security defaults.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →| Identity model | Best fit | What it provides | Important constraint |
|---|---|---|---|
| Security defaults | Small tenants seeking a broad baseline with minimal policy design | Microsoft-managed baseline protections, including MFA prompts and blocking older authentication patterns | Less granular control over exceptions and conditions |
| Conditional Access | Eligible plans and organizations needing targeted access rules | Granular policies for users, apps, devices, locations, and authentication requirements | Requires Entra ID P1 or later and deliberate policy design |
Security defaults and Conditional Access cannot be enabled at the same time. If you move to Conditional Access, recreate the protections that security defaults supplied before switching: require MFA for all users and administrators, block legacy authentication, and require MFA for Azure management. Microsoft explicitly cautions against turning off security defaults unless you are switching to Conditional Access.
Make the transition without locking out users
- Confirm that the tenant has Entra ID P1 or a qualifying subscription before designing Conditional Access.
- List administrators, service accounts, applications, and remote-access scenarios that need testing.
- Create the replacement policies in report-only or equivalent observation mode where available, and test with pilot users.
- Ensure policies cover all users and administrators, legacy-authentication blocking, and Azure-management MFA.
- Prepare emergency access accounts and test their credentials before changing the production model.
- Only then disable security defaults and enforce the Conditional Access policies.
Keep a documented exception list with an owner, business reason, compensating control, and expiry date. A permanent exception with no owner is an unreviewed bypass.
4. Harden administrator accounts
Apply least privilege
The account used to enroll in Microsoft 365 for business is automatically a Global Administrator. Microsoft recommends limiting the number of administrator accounts and assigning the least privilege needed instead of giving every administrator a permanent Global Administrator role. Use workload-specific roles where they meet the task.
Maintain two identities for people who administer the tenant: an ordinary account for email, browsing, and daily work, and a separate administrator account used only for administrative tasks. This separation reduces the chance that a phishing attack against a normal mailbox immediately becomes a tenant takeover. The detailed recommendations are in Admin account security in Microsoft 365 for business.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallPrepare emergency access accounts
Microsoft recommends at least two emergency access accounts that are not assigned to specific individuals and are used only when normal administrative accounts cannot sign in. The guidance calls for excluding these accounts from MFA and protecting them with long, complex passwords of 16 or more characters. That exception increases the importance of physical password protection, access logging, alerting, and periodic sign-in tests.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Store credentials in a controlled, offline or otherwise strongly protected process with named custodians.
- Use the accounts only for emergency recovery, not routine administration.
- Alert on every sign-in and investigate immediately.
- Test access on a schedule that does not weaken the accounts’ emergency purpose.
- Change credentials after any emergency use or suspected exposure.
Choose a passwordless method for routine administrators
Microsoft lists Microsoft Authenticator push with biometric or PIN verification, FIDO2 passkeys, and Windows Hello for Business as passwordless options for business administrator accounts. The cited guidance says these methods are supported through Entra ID Free for Business Basic and Business Standard. Device compatibility and enrollment readiness still matter.
| Method | What the administrator uses | Planning considerations |
|---|---|---|
| Microsoft Authenticator | Push approval plus a device biometric or PIN | Requires a managed, available phone and a recovery plan if it is lost |
| FIDO2 passkey | A hardware security key or another compatible passkey device | Verify browser, operating-system, and tenant compatibility before purchase; keep a spare enrollment path |
| Windows Hello for Business | Device-bound biometric or PIN credentials | Best suited to compatible Windows devices that are enrolled and maintained |
Enroll at least two usable methods for each routine administrator where policy permits, while preserving the separate emergency-access process. Never use an emergency account as a convenient workaround for a failed enrollment.
5. Review email and collaboration protections
Know what every business subscription includes
Microsoft says all Microsoft 365 business subscriptions include built-in cloud-mailbox protection against malware, spam, and email spoofing. The overview identifies anti-malware, anti-spam, and spoofing protection policies as enabled by default. Verify that defaults remain enabled and inspect quarantine, notification, and allowed-list behavior so legitimate mail is not silently lost.
Understand the Business Premium additions
Microsoft 365 Business Premium adds Defender for Office 365 Plan 1. Microsoft identifies impersonation protection, Safe Attachments, Safe Attachments for SharePoint, OneDrive and Teams, and Safe Links among the additional capabilities. The same guidance says default protections provide a good level of protection and recommends configuring stronger Standard or Strict preset security policies when the organization’s tolerance for false positives and user friction allows it.
| Protection area | Included in all Microsoft 365 business subscriptions | Business Premium addition identified by Microsoft |
|---|---|---|
| Malware, spam, and spoofing | Built-in protection policies enabled by default | Continues, with additional Defender for Office 365 controls |
| Impersonation defense | Not identified as an all-plan entitlement in the overview | Impersonation protection |
| Links and attachments | Not identified as an all-plan entitlement in the overview | Safe Links and Safe Attachments, including protection for SharePoint, OneDrive, and Teams |
| Preset policy strength | Review the defaults and tune supported settings | Standard or Strict preset security policies can be configured for stronger protection |
The table describes the entitlements identified in Microsoft’s overview, not a promise that every SKU combination has the same features. Check the subscription details shown in your tenant before planning a control around Business Premium.
Mail-security review checklist
- Confirm anti-malware, anti-spam, and spoofing policies are enabled.
- Review quarantine access, end-user notifications, and who can release messages.
- Inventory allowed senders, domains, transport rules, and connectors; remove exceptions that no longer have an owner.
- For Business Premium, review impersonation targets such as executives, finance staff, and high-value shared mailboxes.
- Configure Safe Links and Safe Attachments according to the organization’s tolerance for scanning delays, false positives, and user prompts.
- Test legitimate invoices, file-sharing notifications, and automated application mail after policy changes.
- Train users to report suspicious messages rather than forwarding them around a filter.
6. Secure enrolled devices and endpoints
Separate the limited baseline from full management
All Microsoft 365 business subscriptions include Basic Mobility and Security. Microsoft describes it as a limited subset of Intune for securing access to company data on enrolled devices in supported applications. It is useful for a baseline but is not equivalent to full device-management coverage.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Business Premium adds Intune Plan 1, with broader mobile-device management and mobile-application management capabilities, support for more device types including macOS, and Microsoft Defender for Business endpoint security. If your workforce uses personal phones, Macs, Windows PCs, or mixed ownership, map each device class to the control that actually supports it rather than assuming one policy covers everything.
Recommended Free Tools
| Capability | All business subscriptions | Business Premium |
|---|---|---|
| Mobile access baseline | Basic Mobility and Security, a limited subset of Intune | Included, plus broader management options |
| Mobile device and app management | Limited scope | Intune Plan 1 with broader MDM and MAM capabilities |
| macOS and additional device types | Not identified as included in the limited subset | More device types, including macOS, are supported by the added Intune capability |
| Endpoint protection | Not identified as Defender for Business in the overview | Microsoft Defender for Business |
Review Defender for Business policies
For tenants with Defender for Business, review the default next-generation protection and firewall policies, attack-surface-reduction features, and advanced-feature settings. Microsoft’s configuration guide is Set up, review, and edit security policies and settings in Microsoft Defender for Business.
The Defender portal is designed as a simplified place to onboard devices, manage policies, and view incidents. Organizations already using Intune can continue managing devices there. Microsoft warns that switching to Defender-portal configuration requires deleting existing Intune security policies to avoid policy conflicts. Do not configure the same endpoint control in both systems without a documented precedence plan.
- Identify which devices are already onboarded and which are only registered for access.
- Export or document current Intune security policies and assignments.
- Choose Intune or the Defender portal as the policy-management path for the affected controls.
- Remove superseded policies before creating replacements, following Microsoft’s transition guidance.
- Onboard a pilot device and verify antivirus status, firewall state, attack-surface-reduction behavior, alerts, and user experience.
- Expand deployment in groups and watch incidents and policy-conflict indicators.
Device checks that catch common gaps
- Require a screen lock and supported operating-system version for company-data access where the plan supports those controls.
- Confirm encryption, firewall, malware protection, and update posture on managed endpoints.
- Separate personal-device access from corporate-device requirements so users understand what data-management permission they are granting.
- Remove stale devices and departed users from enrollment and compliance assignments.
- Verify that Teams, SharePoint, OneDrive, and Exchange access behaves as intended after a compliance-policy change.
7. Roll out the baseline in a dependency-aware sequence
A practical sequence is to inventory plans and roles, inspect MFA and security defaults, harden administrators, review mailbox protections, review endpoint management, and then schedule Baseline Security Mode changes from their impact reports. This order follows the dependency relationships between identity, workloads, and devices; it is an implementation approach rather than a claim that Microsoft mandates one fixed sequence.
Suggested rollout waves
- Preparation: document subscriptions, privileged accounts, emergency access, applications, devices, current policies, and rollback contacts.
- Identity pilot: test MFA enrollment and passwordless methods with administrators and a small user group.
- Administrative protection: reduce unnecessary Global Administrator assignments, separate daily and admin identities, and verify emergency access.
- Mail pilot: review quarantine and impersonation behavior, then test representative business messages.
- Endpoint pilot: choose Intune or Defender portal ownership for each policy, onboard test devices, and resolve conflicts.
- Baseline activation: enable Baseline Security Mode settings with zero reported impacts first; defer settings with critical dependencies.
- Verification: inspect sign-in logs, alerts, quarantine, endpoint incidents, and user reports after every wave.
Keep an evidence trail
For each change, record the date, administrator, affected scope, policy version, impact-report result, dependencies, test results, user communication, and rollback action. This turns a one-time hardening project into an auditable operating process and makes later troubleshooting much faster.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors8. Troubleshoot the most likely failures
The Baseline Security Mode page or setting is missing
Check that you are in the correct Microsoft 365 tenant, have a role with permission for the workload, and are using the documented admin-center path. If a workload administrator can see only part of the configuration, involve the tenant administrator rather than granting permanent Global Administrator access.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Conditional Access is unavailable
Confirm that the tenant has Microsoft Entra ID P1 or later and that the user is working in the correct directory. Business Premium is identified by Microsoft as including Entra ID P1; other plans may require a different entitlement. Do not disable security defaults merely to expose a feature you are not licensed to use.
Users are repeatedly prompted or locked out after an identity change
Pause expansion, use the documented emergency-access process if administrators are affected, and inspect sign-in logs for the policy, application, device, or authentication method causing the failure. Check that legacy applications have a supported authentication path before enforcing a policy that blocks older protocols.
Endpoint policies conflict
Determine whether Intune and the Defender portal are both assigning the same security control. Microsoft specifically warns about conflicts when switching portal configuration. Remove superseded assignments, document the chosen owner, and retest on a pilot device before broad deployment.
Legitimate mail is quarantined
Review the triggering policy, sender or domain exception, and release permissions. Avoid broad allow-list entries; narrow an exception to the required sender, recipient, or workflow, assign an owner, and set a review date. Test the corrected rule with representative messages.
9. A repeatable quarterly review checklist
- Compare the current subscription inventory with the controls you rely on; confirm any plan changes.
- Verify that security defaults or the intended Conditional Access policy set is active, but not both.
- Review privileged-role assignments and remove stale administrators.
- Test routine administrator authentication and the emergency-access monitoring process.
- Inspect anti-malware, anti-spam, spoofing, quarantine, impersonation, link, and attachment settings available to your plans.
- Review enrolled devices, inactive devices, compliance assignments, endpoint alerts, firewall, malware, and attack-surface-reduction policies.
- Check for Intune and Defender policy overlap after product or licensing changes.
- Run Baseline Security Mode impact reports for settings not yet enabled and recheck dependencies for settings already deployed.
- Review exceptions for an owner, reason, compensating control, and expiry date.
- Update the change record, user guidance, and rollback instructions.
Microsoft’s official documentation remains the authority for current labels, plan entitlements, and workflow details. Recheck it whenever Microsoft changes the admin centers or your organization changes subscriptions.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
