Microsoft 365 Security Hardening: From 37% to 89% Secure Score
How a growing business transformed a newly migrated but under-secured Microsoft 365 environment into a more controlled, resilient and professionally branded platform.
The challenge
After five years of significant growth, a business had outgrown its previous collaboration and email platform and migrated to Microsoft 365. An external provider had completed the migration, but the client was left to operate the new tenant without a follow-up security review, governance plan or recommendations for ongoing improvement.
Microsoft 365 was working, but successful migration alone did not mean the environment was appropriately protected. As the organisation continued to grow, the gaps in identity management, email authentication, information protection and collaboration governance created avoidable business risks.
What the security audit uncovered
Incomplete email authentication
Important DNS-based protections against domain spoofing were missing or incomplete, reducing the organisation’s ability to authenticate legitimate outgoing email.
Secure Score of just 37%
Microsoft Secure Score highlighted a substantial number of recommended security controls and governance settings that had not yet been implemented.
Unprotected privileged accounts
Three Global Administrator accounts had been created for third-party access. They did not belong to employees and lacked appropriate security controls, increasing the risk associated with privileged access.
Limited information governance
The tenant lacked mature sensitivity labelling, data loss prevention and consistent policies governing email, meetings and cloud file sharing.
The objective
Strengthen the Microsoft 365 tenant without disrupting day-to-day operations. The work needed to protect the business’s email reputation, reduce unnecessary privileged access, introduce practical data protection controls and help staff understand how to work securely within the platform.
The implementation
Configured SPF and DMARC DNS records and enabled DKIM signing for outgoing mail. Together, these controls help receiving mail systems assess whether messages are authorised to use the organisation’s domain and reduce the opportunities for email spoofing. They strengthen authentication, although they do not eliminate every form of impersonation or phishing.
Identified three third-party Global Administrator accounts without suitable protection and brought their access and security posture into the tenant hardening review. The aim was to reduce unnecessary exposure from highly privileged accounts and establish more accountable administration.
Reviewed Microsoft recommendations, prioritised applicable controls and implemented missing security policies. Where the client’s chosen third-party anti-malware solution provided mitigation, this was considered as part of the wider risk assessment rather than treating the score as the only measure of security.
Created policies for classifying sensitive documents and emails using Microsoft 365 sensitivity labels. Developed a training plan to explain the purpose of the labels, when they should be used and how employees could apply them consistently.
Introduced data loss prevention policies intended to reduce inappropriate sharing of sensitive information by email and support the organisation’s UK GDPR data-handling obligations. Technical controls were combined with user awareness rather than treated as a substitute for broader compliance processes.
Established policies for Microsoft Teams meetings and for sharing content through OneDrive and SharePoint, giving the organisation clearer boundaries around collaboration and external access.
Introduced additional anti-spoofing and anti-spam policies for incoming and outgoing email. Outbound restrictions also helped reduce the risk of compromised or misused accounts sending large volumes of messages, with legitimate mass-mailing activity limited to the marketing function.
Branded the Microsoft 365 sign-in and portal experience to reflect the client’s identity and prepared branded Teams meeting backgrounds, giving employees and customers a more consistent professional experience.
The measurable improvement
Over the course of a couple of days, the tenant’s reported Microsoft Secure Score increased from 37% to 89%. Remaining recommendations were reviewed in the context of the client’s environment, including controls addressed through third-party security software.
The outcome
Better protection, stronger governance and greater confidence
- Improved security posture: Microsoft Secure Score increased from 37% to 89% following a targeted hardening programme.
- Stronger email authentication: SPF, DKIM and DMARC helped receiving systems distinguish authorised messages from attempts to spoof the business’s domain.
- Reduced unwanted email: The client reported noticeably less spam after email security policies were strengthened.
- Clearer data-handling rules: Sensitivity labels, data loss prevention policies and staff training supported more consistent treatment of confidential information.
- Safer collaboration: Teams, OneDrive and SharePoint settings were reviewed and governed through defined policies.
- Improved outbound safeguards: Restrictions on bulk sending reduced opportunities for misuse and helped protect customer relationships and the organisation’s reputation.
- More professional identity: Microsoft 365 portal branding and Teams backgrounds reinforced a consistent company image.
- Better evidence of security investment: The documented improvements supported conversations about cyber risk, insurance and Cyber Essentials readiness, without constituting certification in themselves.
Why this project mattered
A cloud migration is not the end of an IT transformation. Without appropriate identity controls, email authentication, information protection and staff guidance, a newly deployed platform can leave significant risks unaddressed.
This engagement combined technical configuration with practical governance and training. It moved the business from simply using Microsoft 365 to managing it as a business-critical platform, with controls designed to protect its people, information and reputation.
Is your Microsoft 365 tenant as secure as it should be?
From Microsoft 365 security audits and email authentication to data protection, tenant hardening and user guidance, Paul Clarke IT Consultancy can help you identify gaps and build a more secure environment.
