.jpg)
An assessment tells you where the gaps are. Hardening is where they actually get closed. Of everything a Microsoft 365 hardening project touches, the identity and access controls, meaning who can sign in, from where, and under what conditions, do more to prevent real-world breaches than almost anything else in the tenant. Most account compromises trace back to a gap in exactly this area.
Multi-Factor Authentication: The Non-Negotiable First Step
MFA requires a second form of verification beyond a password, and it blocks the overwhelming majority of automated account takeover attempts, even when a password has already been stolen or guessed. The distinction that trips businesses up is how MFA gets enforced. Basic "security defaults" turn MFA on tenant-wide with no flexibility, while per-user MFA (an older, less capable method) only protects the specific accounts it's manually applied to. Conditional Access based MFA is the modern approach: it applies MFA intelligently, based on risk, location, device, and application, rather than as a blunt on/off switch.
Conditional Access: Rules That Adapt to Risk
Conditional Access lets you build rules that respond to context instead of treating every sign-in the same way. Common policies include blocking legacy authentication entirely, requiring MFA when someone signs in from an unfamiliar location, requiring a compliant, managed device before granting access, blocking sign-ins flagged as high-risk, and restricting administrative actions to trusted networks or devices. Layered together, these policies do most of the heavy lifting in a hardened tenant.
Microsoft Defender: Extending Protection Across Email, Identity & Endpoints
Where MFA and Conditional Access control who gets in, Microsoft Defender watches what happens once they're inside. Defender for Office 365 screens email for phishing and malware, Defender for Identity watches for suspicious authentication activity, and Defender for Endpoint extends that protection to the devices themselves, connecting directly to broader endpoint detection and response coverage. Properly tuning these tools, rather than leaving them on default settings, is a meaningful part of the hardening work.
Other Hardening Priorities Beyond MFA and Conditional Access
A complete hardening pass typically also addresses:
- Disabling legacy authentication protocols, which don't support modern MFA and remain a common attacker entry point.
- Restricting self-service app consent, so employees can't unintentionally grant a malicious or risky third-party app access to company data.
- Tightening external sharing defaults on SharePoint, OneDrive, and Teams to something closer to need-to-know.
- Reviewing and reducing standing admin roles, moving toward least-privilege access rather than broad, permanent administrator rights.
- Enabling and properly configuring audit logging, so there's a usable record if something needs to be investigated later.
Hardening Is a Starting Point, Not a Finish Line
A freshly hardened tenant is in great shape on day one. The problem is that day one doesn't last. New employees get added, admin roles get changed to solve a one-off problem and never get reverted, and third-party apps quietly request new permissions. Keeping a hardened configuration in place requires watching for that drift and correcting it before it becomes a gap.
Our guide, Microsoft 365 Security Monitoring & Policy Enforcement: Keeping Your Tenant Secure Long-Term, covers exactly how that ongoing work happens.
Call us at 937-428-9234, email info@harbourtech.net, or contact Harbour Technology Consulting to talk through where your tenant stands today.
