Module 3 · Microsoft 365 Security 🔒

Microsoft 365 — Exchange Online, SharePoint, Teams, OneDrive — sits on top of Entra ID and is the email + collaboration layer for most enterprises. It is also the most common entry point for attackers in 2026: phishing → credential or session theft → mailbox exfil → BEC fraud or lateral movement to Azure. This module covers the M365 security posture, Exchange-specific controls, and the Microsoft Defender stack.

The M365 attack surface

• Authentication: Entra ID — covered in M1; the foundation
• Email: Exchange Online — phishing in/out; mailbox exfil; BEC; auto-forward abuse
• File sharing: SharePoint, OneDrive — overshared documents, external sharing, link sprawl
• Collaboration: Teams — channels, files, external guest access
• Apps: Power Platform (Power Apps, Power Automate) — citizen-developed apps with broad data access
• Endpoints: managed via Intune; Defender for Endpoint integration

Exchange Online hardening

Anti-phishing

• Microsoft Defender for Office 365 Plan 2 if budget allows; Plan 1 minimum
• Safe Links — rewrite URLs in mail; check at click time
• Safe Attachments — sandbox detonation before delivery
• Anti-phishing policies with impersonation protection (executive lookalikes, domain lookalikes)
• Mailbox auditing enabled for all mailboxes

Auth + transport

• SPF, DKIM, DMARC at p=reject for sender domain (covered in DPDP/Email security)
• Disable legacy authentication (POP, IMAP, SMTP basic) via Authentication Policies
• Outbound spam policy with high-risk send blocking
• Safe Senders / Safe Domains lists reviewed quarterly

BEC defenses

• External sender warnings on emails (banner)
• Conditional Access blocking sign-ins from unsupported countries
• Sign-in risk policies require MFA on suspicious signins
• Auto-forward to external addresses blocked or alerted
• Mailbox rule changes monitored — attackers create rules to hide their tracks

SharePoint & OneDrive

• External sharing settings per-tenant: most-restrictive default; opt-in to broader where business need
• Sensitivity labels with auto-application via Microsoft Purview
• Default link type — Specific People, not Anyone with the link
• Anonymous link expiration — 30 days max
• Block download/print for sensitivity-labeled docs
• Conditional Access for SharePoint — require compliant device for unmanaged scenarios

Teams security

• External access control — federation with which tenants?
• Guest access — restrict guest permissions per business need
• Meeting policies — anonymous join controls, lobby behavior
• App permission policies — what apps users can install in Teams
• Recording & transcription — sensitivity considerations
• Information barriers — segments that cannot communicate (compliance use case)

Power Platform — the shadow IT vector

Power Apps and Power Automate let business users build apps and workflows without IT. They can connect to any data the user has access to — and share with others. Risks:

• App reads sensitive data; shared with broad audience
• Flow auto-forwards data externally
• Connector credentials stored in user contexts; survive role changes
• DLP not native; configure DLP policies explicitly

Controls: