Microsoft 365 ist nicht automatisch sicher: Die sieben Stellschrauben

Microsoft 365 is often purchased as a pre-secured platform. This is only half the truth: Microsoft operates the infrastructure securely — but Identities, Configuration and Data are your responsibility. This "Shared Responsibility" is where things typically fail in practice. The good news: the critical settings are known and manageable.

1. Multi-Factor Authentication without exceptions

MFA for all accounts — including executive management and external service providers. Equally important: Disable legacy authentication (POP, IMAP, Basic Auth), as it completely bypasses MFA and is the most common entry point for account takeovers.

2. Separate administrator accounts

The everyday account is not the admin account. Administrators work with two identities: one for email and documents, and one for administration. The admin account receives no mailbox and is not used for any other purpose. This ensures that a phishing click in daily operations does not reach the data center.

3. Conditional Access instead of relying on passwords

Review access policies: evaluate context instead of just passwords—only managed devices, only expected locations, and blocked risky sign-ins. Those who implement these policies turn a stolen password into a worthless data set.

4. Limit external sharing and guest access

Teams and SharePoint allow generous sharing by default. Please verify: disable anonymous links, set expiration dates for guests, and perform regular access reviews. Otherwise, external access remains active for years — long after the project has ended.

5. Enable audit logs and notifications

Without active monitoring, no one notices when mailbox rules are created or large volumes of data are downloaded. The logs are available — they simply need to be enabled and analyzed.

6. Backup: Microsoft secures the platform, not your data

Retention periods and recycle bins are no backupOnce the retention periods have expired, deleted emails, Teams chats, and files are permanently gone — including those deleted accidentally or via ransomware. Maintaining an independent backup of Exchange, SharePoint, OneDrive, and Teams is the user's own responsibility.

7. Fully leveraging the included security features

Anti-phishing policies, Safe Links, and Safe Attachments are already included depending on the license, but are conservatively configured by default. Those who configure them correctly can filter out the majority of attacks before they reach the inbox.

The pragmatic approach

None of these measures require a large-scale project: basic hardening can be implemented within a few days, after which a quarterly review of policies, guest access, and logs. The important thing is that someone is accountable — it cannot just be 'running in the background'.

← all guides