Microsoft 365 Security Hardening Guide

By Nicolás Echavarría, Managing Director & CAIO at ne Digital
Last reviewed: October 21, 2026

Advanced Microsoft 365 security hardening builds on the baseline. It adds controls that stop the techniques attackers still use successfully against tenants with MFA: token theft, adversary-in-the-middle phishing, privileged access abuse, illicit OAuth consent, legacy protocol abuse and data exfiltration. Each control maps to a specific attack path.

Most enterprises have already moved past security defaults. They have deployed MFA, basic Conditional Access policies and standard email protection. That foundation matters, but attackers have adapted to it.

Today's most damaging intrusions often begin after a user completes MFA. The attacker steals the session token, tricks the user into granting an application access, or abuses a protocol nobody remembered was still enabled.

Closing those paths requires a different approach: threat-informed hardening that goes beyond the baseline.

Baseline vs. Advanced Hardening: What Is the Difference?

A Microsoft 365 security baseline establishes the mandatory minimum configuration and the operating model that keeps it in place. It roughly aligns with Level 1 of the CIS Microsoft 365 Foundations Benchmark.

Hardening goes further. It adds defense-in-depth controls aligned with CIS Level 2, which may reduce some functionality but close attack paths that Level 1 leaves open.

Think of the baseline as the foundation and hardening as the reinforcement. Both are required, and neither replaces the other.

Which Attacks Still Succeed Against Microsoft 365 Tenants With MFA?

The attack surface of a modern Microsoft 365 tenant is no longer defined by passwords alone. These techniques routinely bypass or sidestep standard MFA.

Token theft

After a user signs in, Microsoft Entra ID issues session and refresh tokens. Attackers who steal those tokens through malware or a compromised device can replay them and access the account without ever triggering MFA again.

Adversary-in-the-middle (AiTM) phishing

AiTM phishing kits sit between the user and the real Microsoft sign-in page. The user enters their credentials and completes MFA normally, while the proxy captures the resulting session cookie.

Push notifications, SMS codes and one-time passwords are all vulnerable to this technique.

MFA fatigue

Attackers with a valid password send repeated MFA prompts until the user approves one. Number matching in Microsoft Authenticator reduces this risk, but it does not eliminate social engineering.

Illicit OAuth consent

Instead of stealing credentials, attackers convince users to grant a malicious application access to their mailbox or files. The application keeps that access even after the user changes their password.

Business email compromise

Once inside a mailbox, attackers create forwarding rules, impersonate executives and redirect payments. Weak SPF, DKIM and DMARC configurations make spoofing easier from the outside.

Privilege escalation

Attackers who compromise one account look for standing privileged roles, over-permissioned applications or service principals with broad Microsoft Graph permissions. These let them expand control across the tenant.

Advanced Identity Hardening

Identity is where most Microsoft 365 intrusions begin, so it is where hardening delivers the greatest return.

Phishing-resistant MFA

• What it is: authentication methods that cannot be relayed by a phishing proxy, such as FIDO2 security keys, passkeys (including passkeys in Microsoft Authenticator) and Windows Hello for Business.
• Attack mitigated: AiTM phishing and MFA fatigue.
• Where to configure it: authentication strengths in Microsoft Entra Conditional Access policies.
• License: Microsoft Entra ID P1.
• User impact: moderate. Rollout requires registration campaigns, so start with administrators and high-risk users.

Token Protection

• What it is: a Conditional Access session control that binds tokens to the device they were issued to. A stolen token cannot be replayed from another machine. It is included in the CIS Microsoft 365 Foundations Benchmark v7.0.0 for Exchange Online, SharePoint Online and Microsoft Teams.
• Attack mitigated: token theft and session replay.
• Where to configure it: Conditional Access session controls.
• License: Microsoft Entra ID P1.
• User impact: low on supported clients. Deploy in report-only mode first, because unsupported clients will be blocked.

Continuous Access Evaluation

• What it is: near real-time revocation of access when critical events occur, such as account disablement, password reset or detected risk.
• Attack mitigated: continued use of compromised sessions.
• License: Microsoft Entra ID P1.
• User impact: minimal.

Block device code flow and authentication transfer

• What it is: Conditional Access conditions that block the device code authentication flow and cross-device authentication transfer, except where explicitly required.
• Attack mitigated: device code phishing, a technique increasingly used to obtain tokens without stealing passwords.
• License: Microsoft Entra ID P1.
• User impact: low. Exclude only documented scenarios, such as specific conference room devices.

Risk-based policies

• What it is: Conditional Access policies that respond to sign-in risk and user risk signals from Microsoft Entra ID Protection, for example by requiring a password change or blocking access.
• Attack mitigated: credential compromise detected through anomalous behavior.
• License: Microsoft Entra ID P2, included in Microsoft 365 E5.
• User impact: low when risk thresholds are tuned.

The design and safe deployment of these Conditional Access policies is covered in depth in our guide to designing Conditional Access without disrupting business operations.

Privileged Access Hardening

Assigning administrator roles is not the same as securing privileged access.

Just-in-time access with Privileged Identity Management

• What it is: Privileged Identity Management (PIM) makes administrator roles eligible rather than permanent. Users activate them for a limited time, with justification, MFA and, for the most sensitive roles, approval.
• Attack mitigated: privilege escalation and misuse of standing administrative access.
• License: Microsoft Entra ID P2.
• User impact: low for administrators, once activation becomes routine.

Remove standing Global Admin accounts

Keep permanent Global Admin assignments limited to monitored emergency access accounts. Assign every other administrator the least-privilege role their tasks require, using role-based access control (RBAC). Review assignments quarterly through access reviews.

Cloud-only administrator accounts

Administrative accounts should exist only in Microsoft Entra ID (formerly Azure AD), not synchronized from on-premises Active Directory. This prevents an on-premises compromise from escalating directly into cloud administrative control.

Privileged access workstations

Require administrators to use dedicated, hardened devices for privileged tasks. Enforce this through device compliance and device filters in Conditional Access.

Restricted management administrative units

• What it is: administrative units that protect sensitive accounts, such as executives or emergency access accounts, from modification by tenant-level administrators who are not explicitly assigned to them.
• Attack mitigated: account takeover through compromised helpdesk or user administrator roles.
• License: Microsoft Entra ID P1.

Application and OAuth Consent Hardening

Applications are one of the most under-governed parts of the Microsoft 365 attack surface.

Restrict user consent and enable the admin consent workflow

Prevent users from granting consent to unverified applications. Allow only low-risk permissions from verified publishers, and route every other request through the admin consent workflow for review.

• Attack mitigated: illicit consent grants.
• License: included.
• User impact: low, with a clear request process.

App governance in Microsoft Defender for Cloud Apps

App governance monitors OAuth applications for unusual activity, excessive permissions and suspicious data access. It provides threat detection specifically for application-based attacks.

• License: Microsoft Defender for Cloud Apps, included in Microsoft 365 E5.

Review over-permissioned service principals

Audit every application with high-privilege Microsoft Graph permissions, such as Mail.ReadWrite or Directory.ReadWrite.All. Many tenants carry older Azure AD-era app registrations with permissions nobody remembers granting. Remove what is unused, and reduce the rest to least-privilege access.

Workload identity protection

Apply Conditional Access and risk detection to service principals. Block them when they authenticate from unexpected locations or show risky behavior.

• License: Microsoft Entra Workload ID Premium.

Email and Exchange Online Hardening

Email remains the primary delivery vector for phishing and business email compromise.

Plan for the Exchange Web Services retirement

Exchange Web Services is being retired in Exchange Online in favor of Microsoft Graph:

• Phased disablement began on October 1, 2026. Tenants that left the EwsEnabled setting at its default are being moved to blocked.
• Permanent shutdown is scheduled for April 1, 2027, with no re-enablement.

Treat this as both a continuity issue and a hardening opportunity:

1. Review EWS usage reports and identify dependent applications, including backup, archiving and email security tools.
2. Migrate them to Microsoft Graph.
3. Where temporary continuity is required, explicitly enable EWS only for approved application IDs.

Exchange Server on-premises is not affected.

Block legacy authentication protocols

Block legacy authentication protocols, including basic authentication over IMAP, POP and SMTP AUTH, through Conditional Access and Exchange Online authentication policies. Use sign-in logs and PowerShell reports to identify remaining clients before enforcement.

Enforce DMARC at p=reject

Publish SPF and DKIM for every sending domain, including parked domains. Then move DMARC progressively from monitoring to quarantine and finally to reject. Inventory all legitimate third-party senders first.

• Attack mitigated: domain spoofing and impersonation.

Apply Defender for Office 365 strict preset policies

Apply the Strict preset security policy in Microsoft Defender for Office 365 to high-value users, such as executives, finance and administrators. This enables the most aggressive settings for anti-phishing, Safe Links and Safe Attachments, including impersonation protection.

• License: Defender for Office 365 Plan 1 (included in Microsoft 365 Business Premium) or Plan 2 (included in Microsoft 365 E5).

Reject Direct Send and block external auto-forwarding

Reject Direct Send. If your organization does not need unauthenticated Direct Send, enable it with the Exchange Online PowerShell setting Set-OrganizationConfig -RejectDirectSend $true. Direct Send can be exploited to spoof internal senders.

Block automatic forwarding. Block automatic forwarding to external domains through the outbound spam policy. This stops one of the most common mailbox persistence techniques.

SharePoint, OneDrive and Teams Hardening

Collaboration platforms hold the data attackers ultimately want.

Sensitivity labels on sites and containers

Apply sensitivity labels to SharePoint sites, Microsoft 365 groups and Teams. They can enforce privacy settings, external sharing limits and access from unmanaged devices at the container level.

Restricted access control

Restricted access control limits access to specific SharePoint and OneDrive sites to defined security groups, even if broader permissions exist. This immediately contains overshared sensitive sites while long-term permission cleanup continues.

It is part of SharePoint Advanced Management, which is included for tenants with at least one Microsoft 365 Copilot license.

Block or limit unmanaged devices

Allow browser-only, no-download access to SharePoint and OneDrive from unmanaged devices, or block access entirely for sensitive sites. Use Conditional Access app-enforced restrictions.

Guest expiration and external access

Set automatic expiration for guest access, require regular access reviews for external users, and restrict Teams external access to approved domains.

Endpoint Hardening With Intune and Defender for Endpoint

Compromised endpoints are where token theft begins, so endpoint hardening directly protects identity.

Attack surface reduction rules

Attack surface reduction rules in Defender for Endpoint block common malware behaviors, such as Office apps launching child processes, credential theft from LSASS and execution of obfuscated scripts.

Deploy them in audit mode first, then enforce.

Windows LAPS

Windows LAPS automatically rotates and secures local administrator passwords on every device, managed through Microsoft Intune. This prevents attackers from reusing a single local admin password to move laterally.

Compliance-based access

Use Intune device management and compliance policies to require encryption, a minimum OS version and a healthy Defender status. Then make device compliance a Conditional Access requirement for sensitive resources.

Tamper protection

Enable tamper protection so attackers cannot disable Defender for Endpoint protections, even with local administrator rights.

Hardening Microsoft 365 for Copilot and AI Agents

Microsoft 365 Copilot does not create new permissions, but it makes existing permissions far easier to exploit. AI agents add a new class of identity that can act at machine speed.

Remediate oversharing first

Use Data Access Governance reports in SharePoint Advanced Management to identify overshared sites. Contain sensitive ones with restricted access control while owners clean up permissions.

Restricted content discovery can also prevent selected sites from surfacing in Copilot results.

DSPM for AI and DLP for Copilot

Microsoft Purview Data Security Posture Management (DSPM) for AI provides visibility into Copilot and third-party AI interactions involving sensitive data.

Pair it with DLP policies scoped to Microsoft 365 Copilot, as recommended in CIS v7.0.0. This prevents labeled or sensitive content from being processed in Copilot responses. Strong data governance and accurate sensitivity labels determine how effective these controls are.

Agent inventory and Entra Agent ID

As of October 2026, Microsoft Entra Agent ID is generally available. Register agents as governed identities, assign each an accountable owner, and apply Conditional Access templates for agents where licensed. That requires Microsoft Agent 365 or Microsoft 365 E7.

Restrict agent permissions

Review what each Copilot Studio agent can access and do. Limit connectors, write actions and external communications, and require human approval for high-impact operations.

For a deeper analysis of AI-specific attack techniques, see our guide to prompt injection, oversharing and excessive agency risks in Microsoft Copilot.

Advanced Hardening Checklist

How to Prioritize Advanced Hardening Without Disrupting Users

Advanced controls deliver the most value when they are sequenced by risk, not deployed all at once.

1. Start with what is time-bound or actively exploited. EWS dependency migration, phishing-resistant MFA for administrators, consent restrictions and removal of standing Global Admins should come first.
2. Deploy in report-only or audit mode. Conditional Access policies, ASR rules and DLP policies all support a testing state. Use it to measure impact before enforcement.
3. Roll out by persona. Apply the strictest controls to administrators, executives and finance first, then extend them to the wider organization.
4. Connect hardening to detection. Stream sign-in logs and audit logging data into Microsoft Sentinel or your SIEM, and build detections for consent grants, role activations and forwarding rule creation. Integrate these signals with your incident response playbooks, so a hardened control and a missed attack both produce actionable evidence.
5. Map controls to compliance. Hardening supports technical safeguard requirements in frameworks such as GDPR Article 32 and the HIPAA Security Rule. Document each control so it can serve as audit evidence.

Conclusion: From a Secure Baseline to a Hardened Tenant

A Microsoft 365 baseline proves that minimum controls are in place. Hardening proves that the attack paths still used against well-managed tenants are closed.

The difference matters. Token theft, AiTM phishing, consent abuse and oversharing do not appear in a Microsoft Secure Score summary, but they appear in incident reports every week.

Organizations that invest in threat-informed hardening gain more than stronger security:

• Fewer high-severity incidents and lower incident response costs.
• Stronger audit evidence.
• A safer foundation for Microsoft 365 Copilot and AI agents.

ne Digital helps enterprises across this journey:

• Assessing the current posture against CIS Level 2 and the threat techniques that matter most to their industry.
• Prioritizing controls by risk, licensing and user impact.
• Implementing them across Microsoft Entra, Defender, Intune, Purview and Sentinel.
• Operating them through managed services, so the tenant stays hardened as it evolves.

 Request an advanced Microsoft 365 assessment or explore our managed cybersecurity services.