Hardening Microsoft 365 and Collaboration Tenants

For many organizations, Microsoft 365 or a similar collaboration platform now holds the most important data they have: email, documents, chat, calendars and the identities that unlock everything else. Unlike an on-premises file server, the tenant is reachable from anywhere on the internet. An attacker with a valid password and a weak sign-in policy does not need to breach a network at all.

Default tenant settings favor ease of use. Hardening means deliberately choosing where to trade a little convenience for a lot of protection.

Lock down administrative roles

Administrative access to the tenant is the highest-value target in the environment. Treat it accordingly:

• Keep global administrators to a minimum. Use a small number of dedicated, cloud-only admin accounts that are not used for email or daily work.
• Use the least-privileged role that does the job. Built-in roles exist for user, Exchange, SharePoint, Teams and security administration. Most tasks do not need global admin.
• Use just-in-time elevation where your licensing supports it, so privileged roles are activated for a limited time with approval and a recorded reason.
• Protect admin accounts with phishing-resistant MFA, such as FIDO2 security keys or certificate-based authentication.
• Maintain emergency access accounts that are excluded from normal policies, tightly protected and monitored for any use.

Enforce conditional access

Conditional access policies decide who can sign in, from where, on what device and with what authentication. Well-designed policies typically:

• Require MFA for all users, with stronger methods required for administrators.
• Require managed or compliant devices for access to sensitive data.
• Restrict or block sign-ins from locations where the organization does not operate.
• Respond to risky sign-ins by requiring reauthentication or blocking access.

Test policies in report-only mode before enforcing them, and review exclusions regularly. A single broad exclusion created for a troubleshooting session can quietly undo the protection for an entire group.

Turn off legacy authentication

Older protocols that rely on basic authentication cannot enforce MFA, which makes them a favorite target for password spraying. Block legacy authentication through conditional access, confirm that no business process still depends on it, and replace any old devices or scripts that do. Also review OAuth application consent: restrict users from granting third-party apps broad access to mail and files without administrator approval.

Make sure you can investigate

When a mailbox or account is compromised, the audit log is how you learn what the attacker did. Confirm that unified audit logging is enabled, understand how long your licensing retains each log type, and forward important logs to your SIEM or log platform so they outlive the tenant's default retention. Alert on high-risk events such as new inbox forwarding rules, mailbox permission changes, new admin role assignments and new application consents.

Control external sharing and guest access

Collaboration platforms make it easy to share files with anyone. That is helpful until sensitive data leaves through an "anyone with the link" share. Review:

• Sharing defaults, preferring links scoped to specific people over anonymous links.
• Guest access, including who can invite guests and how often guest accounts are reviewed and removed.
• Sensitivity labels and data loss prevention for content that must not leave the organization.
• Teams external access, limiting federation to the domains you actually work with.

Government cloud environments

Organizations that handle CUI or work under DFARS clauses often consider government cloud offerings such as Microsoft's GCC and GCC High environments. These offerings differ in data residency, personnel screening, compliance coverage and feature availability. Choosing the right one depends on the data you handle and your contractual obligations, so confirm requirements with your contracting officer and the provider's current documentation. Moving to a government cloud environment does not harden the tenant for you: the same configuration work still applies.

Use a baseline and keep checking

CISA's Secure Cloud Business Applications (SCuBA) project publishes security configuration baselines for Microsoft 365 that make a useful starting point. Whatever baseline you choose, check the tenant against it on a schedule. New features, licensing changes and administrator actions cause settings to drift.

How CDT can help

CDT's hardening engineers review and secure cloud collaboration tenants against recognized baselines, and our CMMC team helps organizations align tenant configuration with the NIST SP 800-171 requirements they must meet.