Configuration settings are an important aspect of cloud security. The default settings for many cloud services may not match the settings you need. The default settings are not designed for maximum security, and failing to review them can result in services that should be private being made public.

To ensure maximum security of your Microsoft Office 365 cloud service, you should review these configuration settings recently highlighted by the Cybersecurity and Infrastructure Security Agency (CISA), a part of the Department of Homeland Security.

CISA Office 365 Security Recommendations

• Multifactor authentication. Administrators have privileged access to Office 365, but multifactor authentication (MFA) to their accounts is not a default setting. Your Global Administrator should enable the Conditional Access policy to apply multifactor authentication.
• Mailbox auditing. Since January 2019, mailbox auditing will be enabled when Office 365 is set up. For existing Office 365 environments, you must actively choose to turn it on. To consolidate mailbox logging with other services such as SharePoint Online, your administrator must turn on unified audit logging.
• Password sync. Migrating to Office 365 creates identities in the cloud based on on-premises Active Directory identities. The on-premises data is authoritative. By enabling Password Sync, passwords for the cloud identities can be updated with passwords from the on premises identities; however, this makes administrator cloud identities vulnerable if the on-premises data is co-opted by a hacker. Disabling password sync will prevent that from occurring.
• Insecure email protocols. Older email protocols such as POP3, IMAP, and SMTP don’t offer high levels of security, and they should preferably be disabled; Azure Active Directory allows authentication with MFA. However, some older email clients require the older, insecure protocols. Businesses should seek to migrate all users to modern email clients or use conditional access policies to limit the use of the insecure protocols.

Office 365 provides a range of tools for businesses to use to secure their Office 365 environment. Anti-malware, anti-phishing, and anti-spam controls are all available.

Additional Office 365 Security Considerations

In addition to the priority security configurations highlighted by CISA, there are other potential security concerns in Office 365. These include users’ grants of permissions to third-party apps that integrate with Office 365, which can be difficult to discover. Certain Office 365 subscriptions lack data loss prevention capabilities and have limited threat management features.

Prescient Solutions offers Office 365 services. As a Microsoft Partner, our team has deep knowledge of Microsoft’s cloud services. In addition, security certifications ensure our team is up to date on the latest information security threats and solutions. Whether you need help completing a migration to Office 365 or ensuring your use of the cloud is safe, the Prescient Solutions team has the knowledge and skills to implement a robust, secure environment. Contact us to learn more about how our IT consulting and managed services can help your Chicago-area business achieve high levels of security in Office 365 and other cloud environments.