October 20, 2026
A Sensible Microsoft 365 Security Baseline for Growing Organisations
The identity, device, email and information controls that provide a strong foundation without making work unnecessarily difficult.
Start with identity
Require multi-factor authentication, block legacy authentication and use separate administrator accounts. Identity is the control plane for the modern workplace.
Apply conditional access
Access policies should consider user risk, device state, location and the sensitivity of the resource. Begin with report-only testing before enforcing broad changes.
Improve email protection
Configure anti-phishing controls and domain authentication using SPF, DKIM and DMARC. Review forwarding rules and suspicious login alerts.
Manage devices
Define a minimum device standard, require encryption and maintain a reliable process for leavers and lost devices.
Protect information
Use sensible sharing defaults, retention and data classification. Security should guide users toward safe choices rather than relying only on policy documents.