Entra ID and Microsoft 365: the identity-hardening checklist for SMBs

For most SMBs, Microsoft 365 *is* the company — email, files, Teams, identity, all of it. And because identity is now the perimeter, the Entra ID tenant behind M365 is the single most valuable thing an attacker can compromise: one phished admin and the whole estate is theirs. Yet the default tenant is configured for easy onboarding, not for security. Here is the hardening checklist we actually apply — the identity equivalent of the on-prem Active Directory audit, for the cloud half of the world.

Start with identity, because that is the perimeter

Entra ID (the identity service behind M365, renamed from Azure AD) is where the real security work is. The essentials, in order of leverage:

• •MFA on everyone — enforced, not optional. This is the single highest-impact control, and Microsoft has been making it mandatory for admin and portal access precisely because its absence is how most breaches start. Turn it on for all users, not just admins.
• •Conditional Access, not just Security Defaults. Security Defaults are a good floor for the smallest tenants, but Conditional Access is where you actually express policy: require MFA by context, block or challenge risky sign-ins, restrict access by device compliance or location, and control legacy protocols. Any tenant with a paid identity plan should be on Conditional Access.
• •Kill legacy authentication. Old protocols (IMAP/POP/SMTP basic auth and their kin) bypass MFA entirely — the classic hole. Microsoft has retired basic auth in Exchange Online, but verify it is blocked tenant-wide, because an app still using it is an open door.

Lock down the admin plane

Global Administrator is the keys to the kingdom, and most tenants hand them out far too freely:

• •Few Global Admins. Microsoft's guidance is a small number (think a handful), everyone else on the least-privileged role that fits. Standing global rights on daily-driver accounts are a gift to an attacker.
• •Break-glass accounts. Two emergency access accounts, excluded from Conditional Access, with long stored credentials, so a misconfigured policy or a lost admin phone never locks you out of your own tenant.
• •Privileged Identity Management (PIM) where licensed — make admin roles *just-in-time* and approved rather than permanent, so privilege exists only when it is being used.
• •Separate admin identities from everyday user accounts; do not read email and browse the web as a Global Admin.

The rest of the checklist

• •Guest and external access. External sharing and guest accounts sprawl silently; set what is allowed and review who has access. Deactivated or forgotten guests are the same orphaned-access risk that on-prem AD accumulates.
• •Secure Score as a tracker. Microsoft Secure Score turns "are we configured well?" into a number with a to-do list — a genuinely useful baseline and progress tracker, not a vanity metric.
• •Email authentication. SPF, DKIM and DMARC on your domains so your mail is trusted and harder to spoof — table stakes that a surprising number of tenants still get wrong.
• •Logging and retention. Turn on and retain the unified audit log; you cannot investigate an incident — or meet a NIS2 reporting duty — with logs you never enabled.
• •Backup the data you assume Microsoft protects. Microsoft keeps the service running; it does not guarantee recovery of your mailboxes and files from a ransomware event or a malicious deletion the way a real backup does. M365 data needs its own backup.

The recurring theme: defaults are for onboarding, not security

None of this is exotic, and that is the point: the gaps we find are almost never sophisticated attacks defeated, they are defaults never changed — no MFA on a service account, legacy auth still on, five too many Global Admins, no break-glass, audit log off. Identity is where the breach starts, so identity is where the hardening pays off first.

What we do

We audit and harden Entra ID and Microsoft 365 the same way we audit on-prem Active Directory: a review against this checklist, then the actual configuration — MFA and Conditional Access, admin-role cleanup with break-glass and PIM, legacy-auth lockdown, guest review, email authentication, audit logging, and M365 backup. It ties straight into NIS2 readiness, because for a cloud-first SMB, securing the identity tenant *is* most of the security. If you have never had the tenant reviewed, the review itself is usually where the surprises are.