Your M365 Is Configured for Convenience, Not Security — Let's Fix That

What is Microsoft 365 security and why does it matter?

Microsoft 365 security covers the configuration, management and ongoing monitoring of the security controls built into the M365 platform. Out of the box, M365 is not secure — it ships with conservative defaults designed to avoid disrupting workflows. Securing a tenant means enforcing MFA, deploying Conditional Access, configuring Defender and adding real backup.

The uncomfortable reality is that the tools are already in your licence; they are just switched off or left on baseline settings. In AMVIA's own tenant assessments, 85% of UK businesses using Microsoft 365 have at least one critical misconfiguration — most commonly missing MFA enforcement or legacy authentication left enabled. Microsoft itself reports that 99% of account compromise attacks can be blocked by enforcing MFA (Microsoft Security).

If you want a single technician-led pass over your environment first, start with a Microsoft 365 security audit — it maps every gap before anyone changes a policy.

What does AMVIA's Microsoft 365 security service include?

AMVIA audits, configures and manages the security of your Microsoft 365 environment so the tools you already pay for work as hard as they should. Every engagement starts with a baseline assessment, then a prioritised remediation plan, then ongoing management — not a one-off project that drifts back to insecure within months.

Core elements of the service:

• Microsoft 365 security audit — full tenant review against Microsoft and NCSC baselines
• Conditional Access configuration — the policy engine that gates every sign-in
• Microsoft Defender for Business management — endpoint detection and response, tuned and monitored
• MFA enforcement across all users — not just administrators
• Data Loss Prevention (DLP) policies — rules that stop sensitive data leaving the tenant
• Microsoft 365 backup and recovery — third-party point-in-time backup Microsoft does not provide

For organisations that want the whole tenant run for them rather than just secured, our managed Microsoft 365 service layers day-to-day administration on top of the security baseline.

Why is Microsoft 365's default configuration not secure?

Microsoft 365 prioritises usability over security, so a fresh tenant leaves several doors open. The platform assumes you will harden it — it does not do that for you. The most common gaps are predictable, and attackers know exactly where to look.

Default-tenant weaknesses we find repeatedly:

• MFA not enforced — users sign in with just a username and password
• Legacy authentication protocols enabled — these bypass MFA entirely
• No Conditional Access policies — any device from any location can connect
• Defender for Office 365 anti-phishing left on default settings
• No DLP policies — sensitive files shared externally without restriction
• Admin accounts unprotected by Privileged Identity Management (PIM)
• No third-party backup — Microsoft's retention is not a backup

This is not a Microsoft fault so much as a configuration responsibility. The UK Government's 2025 Cyber Security Breaches Survey found only 40% of UK businesses have two-factor authentication enabled (DSIT 2025) (gov.uk) — the single control that blocks the overwhelming majority of account takeovers.

How do Microsoft 365 licence tiers compare on security?

Your licence tier decides which security tools you can switch on. Business Basic and Standard give you almost nothing beyond basic mail filtering; Business Premium is the first tier with a genuine security stack. The table below shows what each tier actually includes.

• Microsoft 365 Business Basic (£4.60/user/month) — Exchange Online, Teams, SharePoint and OneDrive with Exchange Online Protection only. No advanced threat protection. Not a security baseline for most businesses.
• Microsoft 365 Business Standard (£9.60/user/month) — adds the Office desktop apps but does not upgrade the security stack. Third-party email security and MDM strongly recommended.
• Microsoft 365 Business Premium (£16.90/user/month) — Defender for Business, Defender for Office 365 Plan 1, Entra ID Premium P1 (Conditional Access and risk-based MFA), Microsoft Intune and basic DLP. This is the tier we recommend as a security baseline.

If you are weighing the jump, Premium's Defender for Business covers endpoint detection and response for up to 300 devices, while the enterprise Defender for Endpoint Plan 2 removes the device limit and adds advanced hunting and Sentinel integration (Microsoft 365 plans).

Does Microsoft back up your Microsoft 365 data?

No — and this is one of the most misunderstood facts in M365. Microsoft provides short-term retention (a 30-day recycle bin, 14-day Teams retention), but that is not a backup. If data is permanently deleted, corrupted or lost beyond the retention window, Microsoft cannot restore it for you (Microsoft Learn).

AMVIA deploys third-party M365 backup covering Exchange Online, SharePoint, OneDrive and Teams, with point-in-time recovery and retention periods of 1–5 years. Under the shared responsibility model, protecting your data is your job, not Microsoft's.

How do you measure Microsoft 365 security posture?

Microsoft Secure Score is a free tool in the M365 security portal that scores your tenant configuration against Microsoft's recommendations, with improvement actions ranked by impact and effort. It is the cleanest single number to track whether your security is getting better or quietly drifting backwards.

AMVIA establishes a Secure Score baseline during the initial audit, then tracks it monthly. Most AMVIA clients improve their Microsoft Secure Score by 20–40 percentage points within the first three months — most of that from enforcing MFA, killing legacy authentication and deploying Conditional Access.

How much does Microsoft 365 security management cost?

AMVIA's Microsoft 365 security management — covering the initial audit, Conditional Access configuration, Defender management, DMARC setup, DLP policies and ongoing Secure Score monitoring — starts from £5 per user per month for tenants on Business Premium. That sits on top of your Microsoft licence cost, not instead of it.

There is no per-incident surprise billing and no lock-in to a telecoms bundle: you get a single accountable provider, Microsoft-certified engineers, and a security baseline you can audit at any time.