What Is Microsoft 365 Security?

Most UK businesses assume Microsoft 365 is secure because Microsoft is a large, trusted vendor. That assumption is where the risk starts. This guide explains what Microsoft 365 security actually involves, which licence tier gives you real protection, and the controls every tenant needs before it is safe to rely on.

What Does Microsoft 365 Security Actually Mean?

Microsoft 365 security is the deliberate configuration of the security tools Microsoft provides, not an assumption that the platform is safe by default. There are two different things at play: the capabilities Microsoft builds into M365, and the configuration your business must apply to make them effective. Confusing the two is the most expensive mistake UK SMEs make.

Microsoft invests heavily in securing its cloud infrastructure. The datacentres, networks and application platforms M365 runs on are well protected against infrastructure-level threats. But that does nothing to stop the attacks that actually cause damage: phishing that steals credentials, ransomware delivered by email, business email compromise that diverts payments, and breaches caused by misconfigured sharing.

With 43% of UK businesses experiencing a cybersecurity breach in 2025 (Department for Science, Innovation and Technology), and 85% of breached businesses identifying phishing as the attack vector (DSIT Cyber Security Breaches Survey 2025), the threats Microsoft's infrastructure security does not address are exactly the ones most likely to hit you. Under Microsoft's shared responsibility model, configuring those controls is the customer's job, not Microsoft's.

Which Microsoft 365 Licence Tier Includes Real Security?

The security tools you have depend entirely on your licence tier. Business Basic and Standard share the same limited security feature set; only Business Premium adds the stack a UK SME actually needs — Conditional Access, Defender for Business, Intune and advanced email protection. Paying more for Standard buys Office apps, not security.

Prices are Microsoft list prices per user per month, annual commitment, ex VAT (Microsoft 365 UK). The jump from Standard to Premium is the only step that adds meaningful protection, which is why we recommend Business Premium for any business that needs more than the bare minimum.

What Does Microsoft Defender for Business Add?

Microsoft Defender for Business, included in Business Premium, is an endpoint detection and response (EDR) tool that goes well beyond the basic Defender Antivirus built into Windows. Where antivirus matches known signatures, EDR adds behavioural detection, automated investigation and remediation, attack surface reduction rules, and threat hunting.

Defender for Business monitors activity across every enrolled device, can isolate a compromised machine from the network automatically, and gives you one dashboard showing the security status of the whole organisation. For a UK business without its own security operations centre, it delivers enterprise-grade endpoint protection that would otherwise need a far more expensive standalone EDR product and dedicated staff to run it.

Why Isn't Microsoft 365 Secure Out of the Box?

Even on Business Premium, a freshly provisioned tenant is not secured. The tools are licensed but none are configured. Conditional Access policies do not exist until you create them, Defender for Business is not yet deployed to devices, Safe Links and Safe Attachments are off, legacy authentication that bypasses MFA is still active, and admin accounts hold permanent elevated privileges.

A Basic or Standard tenant in its default state is more exposed still: no enforced MFA unless Security Defaults are switched on, no EDR, no device management and no advanced email security. The common attacks against UK businesses — phishing, credential theft, business email compromise and ransomware — routinely succeed against unconfigured tenants that properly configured Business Premium would have stopped. That gap between available capability and actual configuration is where most M365 security risk sits.

Which Security Controls Does Every M365 Tenant Need?

Every M365 tenant needs the same baseline regardless of size: enforced MFA, blocked legacy authentication, deployed EDR, hardened email and protected admin accounts. These controls close the vulnerabilities attackers exploit most often, and most can be configured in days rather than months.

• MFA for all users — enforced via Conditional Access on Business Premium or Security Defaults on lower tiers. MFA blocks over 99% of credential-based account compromise attacks (Microsoft). It is the single highest-impact control available. See our MFA setup guide for Microsoft 365.
• Legacy authentication blocked — protocols such as IMAP, POP3 and basic SMTP do not support MFA and are used to bypass it. Blocking them via Conditional Access removes the most common MFA bypass.
• Defender for Business deployed — EDR on all Windows and Mac devices, with attack surface reduction rules enabled and managed centrally.
• Email security hardened — anti-phishing policies with impersonation protection for executives and domains, plus Safe Links and Safe Attachments for email and Teams.
• DMARC, DKIM and SPF configured — email authentication records that stop attackers spoofing your domain to phish your clients and suppliers.
• Admin accounts protected with PIM — Privileged Identity Management replacing permanent admin rights with just-in-time elevation, approval and audit logging.
• Audit logging enabled — essential for incident forensics, made more critical by the fact that only 14% of UK businesses have a formal incident response plan (DSIT 2025).

How Does Microsoft Secure Score Measure Your Configuration?

Microsoft Secure Score is a free tool in every tenant at security.microsoft.com that scores your configuration against Microsoft's recommended actions as a percentage. The industry average sits around 50% (2025 industry benchmarking), meaning the typical organisation has implemented only half the recommended controls; a score above 70% indicates a well-hardened environment.

Secure Score gives an ordered list of improvement actions with impact ratings, so it is straightforward to prioritise the changes that matter most. We use it both as a baseline assessment for new clients and as an ongoing monitoring tool, reviewing the score quarterly so new Microsoft recommendations are assessed and applied where appropriate.

How Does M365 Security Fit a Wider Cybersecurity Strategy?

Microsoft 365 security is one layer of a broader strategy, not the whole of it. M365 covers identity (Entra ID and Conditional Access), endpoint (Defender for Business), email (Defender for Office 365) and data (Purview). Those controls should sit alongside network security, staff awareness training, an incident response plan, and backup and recovery — the connective tissue of managed cybersecurity.

For businesses pursuing certification, a correctly configured Business Premium tenant supports several Cyber Essentials technical requirements, including access control, malware protection and secure configuration. We advise on M365 configuration in the context of compliance requirements and the wider security picture, so the platform reinforces your strategy rather than sitting in isolation.

How Does AMVIA Manage Microsoft 365 Security?

AMVIA manages Microsoft 365 security for UK businesses as part of a managed service: licence management to keep you on a security-capable tier, initial tenant hardening, ongoing Secure Score monitoring, Conditional Access policy management, and Defender for Business monitoring and incident response. Our security stack is Microsoft Defender plus the Barracuda suite, run by Microsoft-certified engineers.

If you have M365 but the security configuration has never been reviewed, a Secure Score review is the right starting point — it identifies the highest-impact improvements for your specific environment and licence tier. Contact AMVIA on 0333 733 8050 to discuss your requirements.