iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Short answer: Microsoft 365 security is not one all-inclusive feature set. Security defaults are available to every tenant, Conditional Access requires Microsoft Entra ID P1 (included in some bundles such as Microsoft 365 Business Premium), and risk-based identity policies require Entra ID Protection, a P2-level capability. Alert coverage also depends on the specific activity, subscription, and add-ons. Start by mapping each control to the exact licenses assigned to the affected users, then review Secure Score, identity risk, Defender alerts, and alert-tuning rules in that order.
The guidance below reflects Microsoft documentation available on October 13, 2026. Subscription packaging, feature entitlements, and portal labels can change, so confirm the current assignment in your tenant before buying a license or enabling a policy.
Which Microsoft 365 license do you need for security?
There is no single “security license” that unlocks every Microsoft 365 protection. Microsoft ties each capability to a particular Entra or Microsoft 365 entitlement, and the requirement can apply to the users affected by a policy rather than only to the administrator who configures it.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Capability | Minimum entitlement described by Microsoft | What it provides | Important qualification |
|---|---|---|---|
| Security defaults | Available to all customers | Preconfigured protection against common identity attacks, including baseline multifactor authentication and legacy-authentication defenses | Use it as a baseline when you do not have, or do not need, custom Conditional Access design. Understand its interaction before adding overlapping risk policies. |
| Microsoft Entra Conditional Access | Microsoft Entra ID P1 | Rules that evaluate signals such as user, device, application, location, and sign-in context before granting access | Microsoft Entra Suite includes Conditional Access features, and Microsoft 365 Business Premium also includes access to Conditional Access features. Verify the exact bundle and user assignment in your tenant. |
| Risk-based Conditional Access policies | Microsoft Entra ID Protection (P2-level capability) | Policies that respond to user-risk or sign-in-risk signals, such as requiring stronger authentication or blocking access | Risk policies are not implied by having a basic Entra or Microsoft 365 subscription. |
| Entra ID Protection dashboard | Dashboard access is available with Free, P1, or P2 licenses | Visibility into identity risk signals and recent risk activity | P2 is required for the comprehensive recommendations list and recommended action links. Some detections require Microsoft 365 E5 or Enterprise Mobility + Security E5. |
That distinction between visibility and entitlement is easy to miss. An administrator may be able to open the ID Protection dashboard while lacking the license needed for every recommendation, risk policy, or detection shown in Microsoft documentation. Treat the dashboard as an indication of what is visible, not proof that all remediation features are licensed.
#1 Best Overall
How to check before changing a plan
- In the Microsoft 365 admin center, list the licenses assigned to the users and administrators whose access you want to protect.
- Write down the exact control you need—such as a device-based Conditional Access rule, a sign-in-risk policy, or a particular malware alert.
- Check the current Microsoft licensing reference for that control and compare it with the assigned user license or bundle.
- Confirm the entitlement in the tenant’s admin center. Product names and bundles evolve, so do not rely on an old SKU comparison saved in a spreadsheet.
License decisions should follow the control you need. Buying a higher plan simply because it is associated with “security” can leave gaps if the relevant users are unlicensed, while assuming that a visible portal blade includes every feature can produce a policy that never evaluates as expected.
Are Microsoft 365 security alerts included in every plan?
No. Microsoft alert policies can monitor many common activities, but the available alert categories and advanced functions vary by Microsoft 365 or Office 365 plan and by add-on. Answer “it depends on the alert,” not “all alerts require E5” or “every alert is included.”
| Alert example | What the policy can watch | Entitlement note |
|---|---|---|
| Administrator privilege assignment | Activities such as assigning administrative privileges in Exchange Online | Availability depends on the tenant’s plan and the alert catalog entry. |
| Malware activity | Malware attacks detected by Microsoft security services | Coverage and advanced controls vary by plan and add-on. |
| Phishing activity | Phishing campaigns or related detections | Check the specific policy’s requirements. |
| Unusual file deletion or external sharing | Threshold-based patterns of deletion or sharing that differ from normal activity | Thresholds, notification options, and availability are subscription-dependent. |
| Safe Links malicious URL | Malicious URLs identified by Safe Links | Some catalog entries require Microsoft 365 E5, G5, or Defender for Office 365 Plan 2; other alert entries are available on broader plans. |
Built-in policies can set activity conditions, thresholds, and email notifications. A policy that exists in documentation may still be unavailable in your portal, or may expose fewer options, when the tenant lacks the required service.
Recommended Free Tools
Where to view and create alert policies
In the Microsoft Defender portal, go to Email & collaboration > Policies & rules > Alert policy. From there, review existing policies, inspect their conditions and thresholds, and create or edit policies that your role permits.
Rank #2
Use the narrowest administrative role
Permissions vary with the access model enabled and with the task. Microsoft documents read-only and management permissions for alert work and recommends least privilege. A Security Reader may be sufficient to investigate; a Security Administrator or a narrower Defender role may be needed to change policies. Reserve Global Administrator for emergencies or tasks that cannot be performed by another role.
Check tuning before trusting the alert list
Microsoft Defender includes built-in alert-tuning rules intended to suppress noise from common benign activity. Review those rules whenever an expected alert is missing: a tuned rule can change what appears in the portal. The tuning rules do not apply to custom detection rules or Custom TI, so those sources must be checked separately.
- Open the alert policy area and record which built-in policies are enabled.
- For each policy, verify the activity condition, threshold, recipients, and any exclusions.
- Review alert-tuning rules and document what they suppress.
- Generate or simulate a safe test event where your organization permits testing, then confirm the alert, email, and incident workflow.
- Recheck after licensing or role changes, because the available catalog and management options can change.
How to protect a Microsoft 365 tenant: a practical sequence
1. Build a license-and-control map
Create a simple inventory with four columns: user or administrator group, assigned license, desired control, and current status. Include service accounts, break-glass accounts, and external or guest access where relevant. This prevents a common failure in which an administrator owns a feature license but the users targeted by the policy do not.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →2. Establish the identity baseline
If custom policy design is not licensed or is not yet practical, evaluate security defaults for the tenant. Security defaults provide preconfigured protection against common identity-related attacks and are available to all customers. If you already use security defaults, do not add duplicative risk policies without understanding how the controls interact; overlapping policies can create confusing prompts, exclusions, or unexpected blocks.
3. Add Conditional Access deliberately
With Entra ID P1, design Conditional Access around a small number of explicit decisions: who is targeted, which cloud apps are covered, what conditions raise risk, and whether the result is a block, a stronger authentication requirement, or a restricted session. Exclude only accounts that have a documented reason and compensating control. Test with a non-administrator account before broad deployment so that a policy error does not lock out administrators.
4. Use identity risk where it is licensed
Entra ID Protection collects risk signals, reports them, and supports remediation workflows. Risk information can feed Conditional Access or a security information and event management system for further analysis. The full deployment scenario in Microsoft’s guidance requires a working Entra tenant with P2 or a trial. Some detections require Microsoft 365 E5 or Enterprise Mobility + Security E5.
Microsoft’s deployment guidance calls for a non-administrator test user and separates roles for reading ID Protection, managing ID Protection, and editing Conditional Access policies. Assign those roles independently where possible, and test the workflow from detection through remediation before enforcing an automatic block.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →5. Review Secure Score as a queue, not a verdict
Secure Score measures progress against recommended actions. A higher score means more of those recommendations have been completed; it does not mean the tenant is a percentage safe or certified against attack. Microsoft explicitly says the recommendations do not cover every attack surface and should be balanced against usability and the organization’s environment.
Rank #4
Use the recommendation list to decide what to investigate first, then validate each item against your architecture, users, and operational capacity. Secure Score can recognize alternate mitigation for some recommendations and can include Microsoft and supported third-party products, so record the actual compensating control rather than blindly applying every suggested change.
6. Operationalize alerts
After identity controls are in place, review alert policies for privilege changes, malware, phishing, unusual deletion, and external sharing. Confirm the relevant category is available under your subscription, set recipients who can act, and document the threshold that should trigger investigation. Tune benign activity carefully and revisit the rules after organizational changes, because suppression can hide a signal that becomes important later.
What does Microsoft Secure Score actually tell you?
Secure Score tells you how much of Microsoft’s recommended security work your tenant has completed. It is useful for prioritization and accountability, but it is not a complete inventory of attack surface, a probability of compromise, or a guarantee of protection.
| Published recommendation | Secure Score points | How to interpret the number |
|---|---|---|
| Ensure all users can complete multifactor authentication for secure access | 9 points | Recommendation points awarded for completing the action; not an estimate of breach reduction. |
| Require multifactor authentication for administrative roles | 10 points | A prioritization value for that recommendation, not a measure of administrator risk eliminated. |
| Enable a policy to block legacy authentication when security defaults are enabled | 7 points | Progress against one control; it does not represent total identity security. |
Microsoft’s own description is the right mental model: the recommendations are “a good baseline,” not coverage of every attack surface. A lower score can identify unfinished hygiene; a high score still requires logging, incident response, data governance, endpoint controls, and review of risks that the recommendation set does not measure.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Understanding the Entra ID Protection dashboard
The dashboard presents metric cards and recent risk activities. Microsoft documents a 24-hour refresh frequency for the “number of attacks blocked” metric. That is documented product behavior at the time of writing, not a service-level guarantee or evidence that every attack was blocked.
The dashboard can aggregate signals from Entra ID Protection and other Microsoft security products when Defender for Identity is configured. Investigate the underlying risk activity, affected user, detection type, and remediation state instead of treating the headline count as a security outcome.
Common problems and how to fix them
A Conditional Access option is missing
- Confirm the targeted users have Entra ID P1 or an equivalent bundle.
- Check whether the tenant is using security defaults, which may already provide a baseline but not the custom controls you are trying to configure.
- Verify that your administrative role allows policy editing.
- Recheck the current licensing reference because bundle names and entitlements change.
The ID Protection dashboard opens but recommendations are unavailable
- Dashboard visibility with Free, P1, or P2 does not include the full P2 recommendation set.
- Confirm P2 is assigned to the relevant users and that the feature is enabled for the tenant.
- Check whether the detection you expect requires Microsoft 365 E5 or Enterprise Mobility + Security E5.
An expected alert never appears
- Check whether the alert category is licensed for the tenant; Safe Links malicious-URL entries are an example of catalog items that can require E5/G5 or Defender for Office 365 Plan 2.
- Review policy conditions, thresholds, exclusions, and notification recipients.
- Inspect built-in alert-tuning rules for suppression.
- Confirm your role can view the alert and that the event occurred in the service covered by the policy.
Administrators are locked out after a policy change
- Use a documented break-glass account protected and monitored separately from normal administrator accounts.
- Test policies with a non-administrator account before enforcing them broadly.
- Use least-privilege roles and keep Global Administrator access for emergency recovery or tasks with no narrower alternative.
Should you use a FIDO2 security key?
A FIDO2 security key can be an option for administrator multifactor authentication, especially where phishing-resistant sign-in is a priority. The documentation considered here does not identify supported models or confirm compatibility with a particular tenant’s authentication configuration. Verify support for the tenant, browsers, devices, recovery process, and account types before selecting a model. A key strengthens an authentication method; it does not provide tenant-wide protection by itself and does not replace licensing, alert review, or recovery planning.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallQuick Recap
A concise administrator checklist
- Inventory exact user and administrator licenses.
- Map each desired security control to its current entitlement.
- Decide whether security defaults are the appropriate baseline.
- Use P1 Conditional Access features only after testing scope, exclusions, and recovery.
- Use P2 risk policies and full ID Protection recommendations only where the affected users are entitled.
- Review Secure Score recommendations without treating the score as a safety percentage.
- Inspect Defender alert policies, thresholds, recipients, and tuning rules.
- Assign Security Reader, Security Administrator, or narrower roles instead of defaulting to Global Administrator.
- Document tests, exceptions, break-glass access, and the date of the next license review.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
