Microsoft 365 Security Baseline for Belgian Businesses

Start by recording verified domains, tenant contacts, license levels, administrators, privileged roles, synchronization sources, enterprise applications, guest users, shared mailboxes, accepted domains, devices, and security products. Identify who owns identity, email, endpoints, data protection, and incident response. Baseline recommendations differ by license, so distinguish what is unavailable from what is available but not configured.

Export a point-in-time configuration and record the review date. This gives later changes context and helps avoid accidental lockout. Confirm that security alerts reach monitored mailboxes outside a single administrator account and that billing, domain, and emergency contacts are current.

Microsoft recommends multifactor authentication and provides security defaults for many organizations, while Conditional Access enables more specific controls where licensing supports it. Begin with privileged roles and users exposed to higher risk, then cover the wider population. Prefer phishing-resistant methods for administrators and sensitive access where practical. Do not rely on SMS as the strongest available method when better options can be deployed.

Maintain tightly controlled emergency access accounts that are excluded only where necessary, protected with strong independent credentials, monitored for use, and tested through a documented procedure. Review registration methods, remove obsolete methods, and train users to report unexpected prompts. MFA reduces risk but does not correct excessive privilege, malicious app consent, session theft, or unsafe recovery settings by itself.

Conditional Access combines signals such as user, application, location, device state, and risk to make access decisions. Design a small policy set with clear names, owners, intent, inclusions, exclusions, and change records. Typical priorities include requiring MFA for administrators, protecting Azure management, blocking legacy authentication, controlling risky sign-ins, and requiring managed devices for selected sensitive applications.

Use report-only mode and the What If tool where available, review sign-in logs, pilot with representative users, and confirm service-account dependencies before enforcement. A technically correct policy can still interrupt operations if exclusions or legacy workflows are misunderstood. Keep a rollback path and change one meaningful control at a time so outcomes remain explainable.

Keep Global Administrator assignments rare. Use the least privileged role for routine work, separate administrative and daily-use accounts, and review role assignments regularly. Where licensing allows, use time-bound activation for privileged roles. Investigate unexpected role changes and ensure administrators do not use privileged accounts for email and ordinary browsing.

Review enterprise applications, service principals, delegated permissions, application permissions, publisher status, consent grants, secrets, certificates, and owners. Remove unused applications and expired integrations carefully. Malicious or over-privileged consent can provide durable access even when a password is changed, so application governance belongs in the identity baseline.

Review anti-phishing, anti-spam, anti-malware, Safe Links, Safe Attachments, external sender indicators, mailbox forwarding, transport rules, and impersonation protection according to the available plan. Check SPF, DKIM, and DMARC for every sending domain and monitor reports before moving to strict enforcement. Examine inbox rules and forwarding during account investigations.

For SharePoint, OneDrive, and Teams, define acceptable external sharing, guest expiration, anonymous links, default link types, sensitivity, and ownership. Identify public or broadly shared sites and remove access that no longer has a business purpose. Collaboration controls should be understandable to users; otherwise they will route data through less controlled channels.

Identity decisions are stronger when device state is known. Establish supported operating systems, update expectations, encryption, screen lock, endpoint protection, and response ownership. For unmanaged devices, decide which data and applications can be accessed and whether browser-only or restricted sessions are appropriate. Test policies with real user workflows before applying them widely.

Ensure unified audit logging, sign-in logs, alerting, mailbox auditing, and relevant Defender signals are available and reviewed. Define retention based on licensing and risk. Document the first response steps for account compromise: disable or restrict access, revoke sessions, reset credentials, review authentication methods, inspect inbox rules and app consent, preserve logs, assess affected data, and communicate with the right owners.

Microsoft Secure Score provides visibility and recommended actions across supported services. Use it to identify opportunities, assign actions, and show progress, but review each recommendation in context. Microsoft explicitly notes that the score is not an absolute measure of breach likelihood and that security must be balanced with usability. A higher score is useful only when the underlying control is correctly deployed and monitored.

Create a backlog that records the recommendation, affected service, expected risk reduction, license requirement, owner, pilot group, evidence, exception, and review date. Combine score improvements with incidents, risky sign-ins, phishing reports, privileged-role changes, device coverage, recovery tests, and overdue actions to understand whether the environment is genuinely becoming more resilient.

During week one, capture the tenant inventory, confirm emergency access, protect administrators, and investigate obvious forwarding, legacy authentication, stale roles, and risky applications. In week two, pilot Conditional Access and authentication changes. In week three, tune email, sharing, guest, and device controls. In week four, validate logs, run an account-compromise exercise, close high-risk gaps, and present a prioritized roadmap with evidence.

Repeat the review after major licensing, identity, merger, supplier, or collaboration changes. Microsoft 365 changes continuously, so a baseline should have an owner and review cycle rather than becoming a one-time report that slowly stops matching the tenant.