Microsoft 365 is an identity system before it is an email system
For many Central Florida offices, Microsoft 365 controls access to email, calendars, files, collaboration spaces, applications, and administrative settings. A compromised account can therefore affect more than a mailbox.
The practical question is not whether Microsoft 365 has security features. It does. The question is whether the tenant’s identity decisions match the business’s needs and are reviewed over time.
Question one: who has privileged access?
Export or review the list of users with tenant, application, security, billing, or compliance administration rights. Require a business reason for each assignment.
Administrators should normally use separate privileged accounts for administrative work. Daily browsing and email should not depend on a highly privileged identity. Maintain at least two emergency recovery paths, but protect them carefully, monitor their use, and test them under controlled conditions.
Question two: is MFA actually enforced?
“Users can register MFA” is not the same as “MFA is required.” Review Conditional Access or equivalent authentication policies, exclusions, legacy protocols, service accounts, and break-glass accounts.
CISA recommends MFA for email, file storage, remote access, and privileged access, with phishing-resistant methods preferred when available. The strongest practical choice depends on licensing, device support, user population, and recovery procedures.
Question three: are authentication methods controlled?
Review who can add or change authentication methods, whether users receive alerts about changes, and whether help-desk resets require meaningful identity verification.
A help desk should never treat a convincing voice, familiar name, or urgent request as sufficient proof. Establish a documented process for high-risk resets and changes to recovery information.
Question four: are risky sign-ins assigned to someone?
Determine who receives alerts for impossible travel, unfamiliar locations, risky users, suspicious applications, and unusual mailbox activity. The business should know what happens after an alert arrives.
A useful response sequence may include confirming the user, revoking active sessions, resetting credentials, reviewing authentication changes, examining mailbox rules, and checking for unauthorized file access.
Question five: are external users and guests reviewed?
Guest access often remains after a project ends. Review guest accounts, external sharing links, team membership, application consent, and inactive accounts.
Ask each business owner whether the access is still necessary, what information the guest can reach, and who is responsible for removal. Use expiration settings where available.
Question six: are applications granted excessive consent?
Third-party applications may request access to mail, files, calendars, or directory information. Review application permissions and consent history. Require administrative approval for sensitive permissions, and remove applications with no current business purpose.
Do not assume that a familiar application is automatically safe. Confirm its owner, purpose, data access, vendor security information, and offboarding process.
Question seven: are audit logs useful and retained?
Confirm that the tenant produces logs for sign-ins, administrative actions, mailbox changes, application consent, file access, and security alerts relevant to the organization. Determine retention periods and who can retrieve evidence.
Logging should support decisions. If nobody reviews a signal or knows how to export the record, the business may have visibility without operational value.
Question eight: can the office recover identity access?
Write and test the process for a locked-out administrator, lost authentication device, compromised account, or unavailable primary IT contact. Include alternate administrators, verified contact methods, vendor support information, and a secure location for recovery documentation.
Do not put recovery secrets in an ordinary shared folder. Separate sensitive recovery material from general office documentation and restrict access.
What Microsoft confirms and what remains business-specific
Microsoft’s current security guidance describes AI agents and other nonhuman actors as identities requiring ownership, scope, lifecycle management, and auditability. Microsoft also continues to expand identity, Conditional Access, and AI security capabilities.
Those product capabilities do not automatically create a sound program. Licensing, feature availability, configuration, and rollout status vary. Some features may be preview, region-dependent, or unavailable in a particular subscription.
A monthly evidence packet
Keep a small packet containing:
- Privileged-role export.
- MFA and Conditional Access summary.
- Guest and inactive-account review.
- Application-consent review.
- High-risk alert disposition.
- Recovery-account test record.
- Open actions and owners.
Redact secrets and unnecessary personal information. The packet should show that reviews occurred, not expose credentials.
Actions this week
- Review privileged accounts.
- Confirm MFA enforcement and exclusions.
- Remove stale guests.
- Check mailbox forwarding rules.
- Assign an owner for identity alerts.
- Test one controlled recovery scenario.
Microsoft 365 security improves when identity decisions become routine management work rather than one-time configuration.