Email security is not enough
For many Central Florida offices, Microsoft 365 is the front door to email, calendars, files, Teams conversations, invoices, customer information, and business credentials. That makes identity security more important than simply filtering suspicious messages.
A compromised user account can be used to read conversations, create forwarding rules, access shared files, impersonate an executive, or request fraudulent payments. The risk is higher when administrators use ordinary accounts for daily work, users share credentials, or former workers remain active.
Microsoft Entra ID provides identity and access controls for Microsoft 365. The exact capabilities available depend on licensing and configuration, so a business should confirm its tenant’s features rather than assume a control is included.
Decision one: how will users authenticate?
Require multifactor authentication for administrators and users. Prefer authentication methods that resist phishing where supported, such as security keys or passkeys. App-based approval is generally stronger than text messages, but any multifactor protection is better than relying only on a password.
Set clear rules for authentication recovery. A person who can reset an administrator’s authentication method may effectively control the tenant. Recovery contacts, alternate methods, and emergency procedures should be reviewed and limited.
Decision two: who receives privileged access?
Separate administrative accounts from daily-use accounts. Administrator privileges should be assigned to named individuals, limited to necessary tasks, and reviewed regularly.
Use just-in-time or time-limited privilege where available. If the business cannot implement that immediately, use a written approval process and maintain an administrator activity log.
Review the following roles carefully:
- Global administrators.
- Exchange or email administrators.
- SharePoint administrators.
- Teams administrators.
- Security and compliance administrators.
- Application administrators.
- Billing and subscription administrators.
A small organization may use an outside provider for administration. That does not eliminate the need to know which provider personnel have access, how access is approved, and how access is removed.
Decision three: what happens when a sign-in looks unusual?
Conditional Access policies can use signals such as user, location, device status, application, and risk. Organizations should start with policies that are understandable and testable. Overly broad policies can interrupt legitimate work; weak policies can leave important gaps.
At minimum, consider policies that:
- Require multifactor authentication for administrators.
- Require stronger authentication for sensitive applications.
- Block legacy authentication methods that do not support modern controls.
- Require managed or compliant devices for selected data.
- Block access from risky locations or sign-in conditions when justified.
- Protect emergency accounts from accidental lockout while monitoring them closely.
Document exclusions. An exclusion without an owner or expiration date can become a permanent bypass.
Decision four: which applications and consent grants are allowed?
Cloud applications may request permission to read mail, access files, send messages, or act on behalf of users. Review enterprise applications, app registrations, delegated permissions, and admin-consent settings.
Do not approve an application merely because an employee recognizes its name. Confirm its business purpose, data access, owner, vendor, retention practices, and removal process. Disable unused applications and investigate permissions that exceed the stated purpose.
Decision five: how will the organization detect and recover from account compromise?
Enable appropriate audit logging and alerting. Review risky sign-ins, unusual mailbox rules, suspicious forwarding, impossible travel signals, mass downloads, and unexpected privilege changes. Alerts must reach someone responsible for action.
Define a response sequence:
- Revoke active sessions and reset credentials.
- Remove unauthorized authentication methods.
- Review inbox rules, forwarding, sent items, and deleted items.
- Inspect file and SharePoint activity.
- Check privilege and application changes.
- Notify financial institutions if payment fraud may be involved.
- Preserve relevant evidence.
- Determine whether notification or contractual duties apply.
Microsoft’s own documentation and security guidance should be checked before changing tenant-wide settings because product capabilities and licensing can change.
What is confirmed and what is uncertain
Confirmed: identity is a central control plane for Microsoft 365, and Microsoft provides Entra, Conditional Access, audit, and application-governance capabilities. Confirmed: configuration and licensing determine what is available. Uncertain: whether a particular tenant is protected until its policies, roles, applications, logs, and recovery methods are reviewed.
Treat a Microsoft 365 identity review as an operating process. Review privileged roles monthly, user access at least quarterly, and applications whenever a new integration is requested. The goal is not to create friction. It is to make access intentional, visible, and reversible.