Microsoft 365 Business Premium security baseline

The client’s licence already pays for Conditional Access, Intune, Defender for Business and Defender for Office 365. Owning them and having them configured are two different things.

We configure them as one baseline, put each change in front of users only after it has been tested against how the client works, and write down every decision so your team can support it afterwards.

Request a quote for this project Other security & compliance projects

What’s in the licence

The parts of Business Premium this project configures, plus the one piece that lives outside the tenant.

Entra ID P1
Conditional Access policies, MFA for every user, legacy sign-ins blocked, emergency access accounts.
Intune Plan 1
Compliance policies that define a healthy device, and Conditional Access that acts on them.
Defender for Business
Devices onboarded, so threats on them are seen and acted on from one console.
Defender for Office 365 Plan 1
Safe Links, Safe Attachments and impersonation protection for inbound mail.
The client’s DNS
SPF, DKIM and DMARC for each domain, with a plan to reach enforcement.

What a sign-in has to get past once the baseline is in

A correct password proves very little. Conditional Access lets the tenant ask more questions before it lets anyone in, and each question is a judgement about the client’s people, devices and old systems.

Conditional Access evaluates every policy that applies to a sign-in together, and a block always wins. We’ve drawn the checks in a line to make them easier to follow.

  1. Is this one of the emergency access accounts?

    At least two cloud-only administrator accounts, left out of every Conditional Access policy so that a faulty policy or an MFA outage can’t lock everyone out of the tenant. Microsoft now requires MFA to reach its admin portals, so these accounts still need a strong sign-in method of their own, such as a FIDO2 security key kept somewhere safe, and they stay out of day-to-day use.

    If yes Exempt, by designThe way back in if something goes wrong

  2. Is it using legacy authentication?

    Older protocols and clients that sign in with only a username and password can’t do MFA, so a stolen password still works on them whatever else is configured. Blocking them is one setting. Finding what still depends on them takes longer: often a scan-to-email copier, a website form or an old application that sends mail. The sign-in logs name them before the block goes on, so the change doesn’t turn into a morning of support calls.

    If yes BlockedOld protocols can’t do MFA

  3. Has the person proved it’s them?

    MFA for every user, including the directors and the shared accounts that MFA plans tend to leave out. Anything that can’t take part is excluded by name, and the as-built records why. Administrator roles get a stricter policy than everyone else, because they are the accounts an attacker most wants.

    If not yet MFA challengeEvery user, every app

  4. Is the device compliant?

    Intune compliance policies describe a healthy device: encrypted, on a supported operating system, protected by Defender, locked with a PIN or password. On their own they only report. They protect something once Conditional Access acts on the result, so the decision is where a compliant device is required and where a personal phone or home computer is acceptable. Compliance only means something for devices enrolled in Intune; if the client’s aren’t yet, that is our Entra ID and Intune device management project.

    If not Blocked for the apps you chooseDecided app by app with you

  5. Signed in

    A known person, on a modern client, with a second factor, from a device the client trusts.

After sign-in, Defender for Business is watching the device

Onboarding brings the client’s Windows and macOS devices into Defender for Business, so threats on them are detected, investigated and contained from one console instead of being discovered after the fact.

The judgement call is the antivirus already installed. Defender can run in passive mode alongside another product or take over as the primary one, and two products both trying to scan the same files is a reliable source of slow machines. Which way the client goes is decided with you.

Every policy starts in report-only

Locking the accounts team out on a Monday morning is a quick way to lose a client’s trust in security. Conditional Access has a report-only mode for avoiding that, and we use it for every policy.

The state switch on each Conditional Access policy. Report-only logs what the policy would have done without stopping anyone.

  1. Policies go in as report-only

    Each one is evaluated against real sign-ins, so you can see what it would do before it does anything.

  2. The sign-in logs are worked through

    Every sign-in a policy would have blocked or challenged is accounted for. It is either fixed, or it becomes a named exception in the as-built with a reason next to it.

  3. Users hear about it first

    Through a contact at the client, people know when they’ll be asked to set up MFA and what it will look like, before the prompt appears.

  4. Policies switch on as one planned change

    If the tenant relies on security defaults today, they can’t run alongside Conditional Access. Turning defaults off and policies on happens together, so the tenant is never left with neither.

Inbound mail protection, and proof that outbound mail is the client’s

Coming inDefender for Office 365

Microsoft applies a built-in level of protection to every tenant. The baseline sets the client’s own policies on top of it, using Microsoft’s preset policies or tuned ones depending on how much quarantine the business can live with.

  • Safe Links checks a link at the time it’s clicked, as well as when the message arrives.
  • Safe Attachments opens files in a sandbox before they reach the inbox.
  • Impersonation protection watches for mail pretending to be the directors or whoever approves payments.

If mail passes through another filtering service before Microsoft 365, every message looks as if it came from that service, so enhanced filtering for connectors has to be set for Defender to judge the real sender.

Going outSPF, DKIM and DMARC

These records let other mail systems check that a message claiming to be from the client’s domain really is. Microsoft 365 itself is straightforward. Everything else that sends as the client takes longer: the accounting package emailing invoices, the CRM, the website, the marketing platform.

Each of those has to pass SPF or DKIM in its own right before DMARC can be enforced. SPF also allows only ten DNS lookups, so adding every service’s include line eventually breaks it, and someone has to decide which senders sign with DKIM instead.

  1. Monitor

    Nothing is stopped. Aggregate reports show every service sending as the domain, including ones nobody remembered.

    v=DMARC1; p=none; rua=mailto:dmarc@example.com

  2. Quarantine

    Mail that fails the checks goes to the recipient’s junk folder. Mistakes are recoverable at this stage.

    v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com

  3. Reject

    Mail that fails is refused outright. Nobody can convincingly send as the domain, including a forgotten system of the client’s own.

    v=DMARC1; p=reject; rua=mailto:dmarc@example.com

The project ends with an enforcement plan. Moving up the ladder before every legitimate sender passes means real invoices and enquiries stop arriving. So DMARC is published with reporting on, and the enforcement plan sets out which senders still need fixing, in what order, and what to check before each step.

What the client ends up with

  • A configured tenant

    Conditional Access, Intune compliance, Defender for Business, Defender for Office 365 and mail authentication set up to work together, rather than as five separate features.

  • As-built documentation

    Every policy, who it applies to, who is excluded and why. It’s the document your service desk will reach for the first time a user can’t sign in.

  • A DMARC enforcement plan

    The senders still to fix, the order to fix them in, and what to check before moving from monitoring to quarantine and then to reject.

Hand us the tenant work and keep the client

Delivered remotely as a white-label project, under your brand or as your named specialist partner. We quote and invoice you at a fixed price for the agreed scope, and the ongoing service stays with you. See the rest of our security & compliance projects.

Request a quote for this project