What Is Microsoft 365 Security?

What Does Microsoft 365 Security Actually Mean?

When people talk about Microsoft 365 security, they mean two related things: the security capabilities that Microsoft builds into the M365 platform, and the security configuration that organisations apply to make those capabilities effective. Both matter — and confusing them is one of the most common mistakes UK businesses make.

Microsoft invests billions of dollars annually in security across its cloud platform. The infrastructure on which Microsoft 365 runs is exceptionally well-secured. But this infrastructure-level security does not protect you against the threats that matter most to UK businesses: phishing attacks that steal your users' credentials, ransomware delivered through email attachments, business email compromise that tricks your finance team, or data breaches caused by accidental oversharing. These threats require configuration of the security tools Microsoft provides — and that configuration is the responsibility of the business, not Microsoft.

Microsoft 365 Licence Tiers and Security

The security capabilities available in Microsoft 365 differ significantly between licence tiers. Understanding which tier you are on determines what security tools you have access to:

• Microsoft 365 Business Basic (from ~£5/user/month): Includes Exchange Online, Teams, SharePoint, and OneDrive. Security features are limited — Exchange Online Protection (basic email security), Security Defaults for MFA, and Microsoft Defender Antivirus. No Conditional Access, no Defender for Business, no Intune.
• Microsoft 365 Business Standard (from ~£10.30/user/month): Adds desktop Office apps to Business Basic. Same security feature set as Basic — the additional cost buys productivity apps, not additional security.
• Microsoft 365 Business Premium (from ~£19.70/user/month): Adds comprehensive security: Conditional Access (Entra ID P1), Microsoft Defender for Business (EDR), Microsoft Intune (device management), Azure Information Protection, Microsoft Defender for Office 365 Plan 1 (Safe Links, Safe Attachments, anti-phishing). This is the recommended tier for any business serious about security.

What Microsoft Defender for Business Adds

Microsoft Defender for Business is an endpoint detection and response (EDR) solution that Microsoft includes in Business Premium. It provides substantially more protection than the basic Microsoft Defender Antivirus included in all Windows devices — adding behavioural detection, threat hunting, automated investigation and remediation, and attack surface reduction rules.

Defender for Business monitors endpoint activity for suspicious behaviour, can automatically contain threats (isolating a device from the network if malware is detected), and provides a centralised view of endpoint security across all managed devices. For UK businesses without a dedicated security operations team, Defender for Business provides enterprise-grade endpoint protection that would otherwise require a significantly more expensive standalone EDR solution.

Why Out-of-Box M365 Is Not Secure Enough

Even on Business Premium, a freshly provisioned Microsoft 365 tenant is not adequately secured. Security features are available but not configured. Conditional Access policies do not exist until you create them. Defender for Business is licensed but not deployed to devices. Safe Links and Safe Attachments are available but not enabled. Legacy authentication protocols that bypass MFA are still active.

A Business Basic or Standard tenant in its default configuration is particularly exposed — it has no MFA (unless Security Defaults are enabled), no endpoint protection beyond basic antivirus, and no device management. Most of the common attacks against UK businesses — phishing, credential theft, business email compromise — succeed against un配置d M365 tenants that would have been protected by properly configured Business Premium.

The Key Security Controls for M365

Effective Microsoft 365 security requires implementing the following controls as a baseline:

• MFA for all users: Via Conditional Access (Business Premium) or Security Defaults (all tiers). Blocks 99%+ of credential-based attacks.
• Block legacy authentication: Eliminates protocols that bypass MFA. Required alongside MFA for meaningful protection.
• Defender for Business deployed: Endpoint protection on all Windows and Mac devices, centrally managed.
• Email security hardened: Anti-phishing policy with impersonation protection, Safe Links and Safe Attachments enabled.
• DMARC, DKIM, SPF configured: Email authentication records preventing domain spoofing.
• Audit logging enabled: Essential for incident investigation — without it, determining what happened after a breach is nearly impossible.

How AMVIA Manages M365 Security

AMVIA manages Microsoft 365 security for UK businesses as part of its managed IT service. This includes licence management (ensuring businesses are on Business Premium or an equivalent security-capable tier), initial hardening of the tenant configuration, ongoing monitoring of Microsoft Secure Score, management of Conditional Access policies, and Defender for Business monitoring and response. For businesses that have M365 but have never had the security configuration reviewed, AMVIA offers a Secure Score review as a starting point. Contact AMVIA on 0333 733 8050 to discuss your Microsoft 365 security requirements.