Simple ways to secure MS365 and SharePoint?

Microsoft 365 and SharePoint sit at the centre of daily work for many UK businesses. Email, files, customer records, contracts, employee documents, Teams conversations and shared project information can all pass through the Microsoft 365 environment. That convenience makes Microsoft 365 valuable, but it also means a compromised account can give an attacker access to a large amount of business information.

The good news is that organisations do not need to make Microsoft 365 difficult to use in order to improve security. A relatively small number of well-managed controls can significantly reduce the risk of account compromise, inappropriate access and accidental information disclosure.

The strongest starting points include multi-factor authentication, sensible administrator access, Conditional Access, secure SharePoint sharing, account reviews, supported devices, controlled external collaboration and strong employee awareness.

These measures also support Cyber Essentials. The current Cyber Essentials Requirements for IT Infrastructure v3.3 became effective on 27 April 2026. The National Cyber Security Centre confirms that the scheme continues to focus on five technical controls and includes cloud services within the assessment. (ncsc.gov.uk)

Cyber Essentials guidance specifically identifies Microsoft 365 as Software as a Service. The cloud provider manages the underlying service, but the customer remains responsible for configuring its Microsoft 365 environment securely. (ncsc.gov.uk)

UK Cyber Security Group provides Cyber Essentials certification and wider cyber security support for businesses that want help strengthening Microsoft 365, SharePoint and other parts of their IT environment. The company confirms that it is a registered Cyber Essentials Certification Body. (ukcybersecurity.co.uk)

Start with user accounts

The simplest way to improve Microsoft 365 security is to concentrate first on identities.

Every employee, administrator, contractor and guest accesses Microsoft 365 through an account. If an attacker compromises that account, they may be able to reach email, Teams, SharePoint, OneDrive and other connected services.

Review your current users.

Make sure every active account belongs to somebody who still needs access.

Remove old employees.

Review contractors.

Check guest accounts.

Identify administrator accounts.

Look for test accounts that people created and forgot about.

Old accounts create unnecessary opportunities for attackers. A former employee should not retain access simply because nobody remembered to disable the account.

Account reviews should become part of normal business activity rather than something that only happens before a Cyber Essentials assessment.

Make multi-factor authentication standard

Multi-factor authentication, commonly called MFA, should protect every Microsoft 365 user wherever practical.

Microsoft currently recommends using Conditional Access to require MFA for users. Microsoft also provides stronger authentication requirements for administrator accounts and other high-risk scenarios. (learn.microsoft.com)

MFA makes a stolen password much less useful.

An attacker may successfully obtain an employee’s password through phishing or another data breach. If the account also requires another authentication factor, the attacker still faces another barrier.

Protect these accounts first:

Administrators

Directors

Finance staff

Human resources

Users with access to sensitive SharePoint sites

External users

Contractors

Then extend MFA across the organisation.

Cyber Essentials v3.3 also expects organisations to use MFA for applicable cloud services where that capability exists. Microsoft 365 therefore deserves particular attention during Cyber Essentials preparation. (ncsc.gov.uk)

Use Conditional Access to control how people sign in

MFA becomes even more useful when combined with Microsoft Entra Conditional Access.

Conditional Access lets the organisation make access decisions using information about the user, device, location, authentication method and requested service.

Microsoft provides recommended Conditional Access policy templates that include requiring MFA, blocking legacy authentication, protecting administrators and restricting access from unsupported or unmanaged devices. (learn.microsoft.com)

A practical small-business approach could require MFA for all users, stronger authentication for administrators and managed devices for especially sensitive business information.

Conditional Access should remain proportionate.

Do not create complicated rules simply because the feature exists.

Start with a small number of high-value policies and test them properly.

Protect administrator accounts more carefully

Administrator accounts have powerful permissions.

A Global Administrator can make significant changes across the Microsoft 365 tenant. That makes administrator compromise much more serious than compromise of an ordinary user account.

Limit the number of administrators.

Do not give Global Administrator permissions to somebody who only manages SharePoint.

Use the lowest level of privilege necessary for the person’s role.

Where practical, administrators should use one account for normal everyday work and a separate privileged account when carrying out administration.

This means a successful phishing attack against their normal mailbox does not automatically compromise their most powerful administrator identity.

Regularly review privileged access.

Ask whether every administrator still needs the permissions assigned to them.

Remove unnecessary roles promptly.

Block old authentication methods

Modern Microsoft 365 environments should rely on modern authentication.

Older authentication methods can weaken security because they do not support modern controls in the same way.

Microsoft recommends blocking legacy authentication through Conditional Access as part of its baseline security approach. (learn.microsoft.com)

Review whether older applications still connect through outdated authentication methods.

Common problem areas can include old email clients, old software and applications using legacy protocols.

If the organisation still depends on one of these systems, identify the dependency and plan a safer alternative.

Leaving weaker authentication active for the whole organisation because one old application needs it creates unnecessary risk.

Make SharePoint sites easier to understand

SharePoint security becomes difficult when one large site contains everything.

A better approach involves separating information according to business purpose.

You might have one site for finance, another for HR, another for internal operations and separate sites for customer or contractor collaboration.

This creates clearer security boundaries.

The HR site can remain internal.

The finance site can have highly restricted membership.

A contractor site can contain only the documents contractors genuinely need.

Microsoft recommends separating confidential information from sites intended for external collaboration. (learn.microsoft.com)

This makes permissions much easier to manage.

It also reduces the risk of somebody accidentally giving an external user access to information that has nothing to do with their project.

Restrict anonymous sharing

SharePoint gives organisations several ways to share documents.

Some sharing links can work without the recipient authenticating.

These links provide convenience, but they offer much weaker control over who eventually receives the information.

For normal business information, authenticated sharing usually provides stronger assurance.

Use Specific people links when external sharing is necessary.

The recipient then needs to authenticate and the link only works for the intended people.

Avoid allowing broad anonymous sharing across the tenant unless the business has a clearly understood requirement.

For sensitive SharePoint sites, turn external sharing off completely.

A finance site, HR site or security documentation site rarely needs unrestricted external sharing.

Use named guest accounts for contractors

Contractors frequently need access to Microsoft 365 and SharePoint.

Do not create one shared contractor account used by several people.

Invite each contractor as an individual Microsoft Entra B2B guest.

Named accounts give you better visibility of who accessed information and make removal much easier when the contract ends.

Microsoft Entra can apply Conditional Access to external users. Microsoft also supports trust relationships with another organisation’s Microsoft Entra tenant where appropriate. (learn.microsoft.com)

For most businesses, the basic principle remains simple:

Every contractor receives their own identity.

Every contractor receives only the access they need.

Access ends when the business relationship ends.

Create separate SharePoint areas for contractors

Do not give contractors broad access to internal SharePoint and rely on individual folder permissions to keep everything else hidden.

Create a dedicated collaboration site.

Put only the relevant project information in that site.

Grant access through an appropriate Microsoft 365 or security group.

This keeps the boundary clear.

For example, an external development company may need technical documentation and project information.

It does not need HR information, internal finance records or information from unrelated customers.

A dedicated site makes that distinction much easier to manage.

Restrict downloads from unmanaged devices

Contractors and remote workers may sometimes use devices that your organisation does not manage.

Microsoft SharePoint can restrict these devices to browser-only access.

Microsoft confirms that restricted web access can prevent users on unmanaged devices from downloading, printing or synchronising SharePoint files while still allowing appropriate browser access. (learn.microsoft.com)

This is a particularly useful control for contractor access.

A contractor can work with authorised information without automatically storing permanent copies on a personal laptop.

For highly sensitive information, consider blocking unmanaged devices completely.

The right approach depends on the value of the information and the business requirement.

Manage external access carefully

External access should have an owner.

Someone inside the organisation should approve each external relationship.

Ask:

Who needs access?

Which site do they need?

Why do they need it?

How long should access last?

Who will review it?

When does the project end?

A simple access request and approval process can prevent external permissions from building up indefinitely.

Review guest accounts regularly.

If a contractor finished work three months ago, remove their access.

Do not wait for an annual audit to discover old external accounts.

Keep permissions simple

SharePoint permissions can become confusing when administrators repeatedly grant access directly to individual employees and break permission inheritance across folders.

Use groups wherever possible.

For example, create a finance group and give that group access to the finance site.

Manage employees through the group rather than assigning permissions repeatedly.

The same principle works for project teams and contractors.

Simple permission structures make review much easier.

A site owner should be able to answer:

Who has access?

Why do they have it?

Which group gives them access?

When was membership last reviewed?

If the answer requires a lengthy investigation, the permission structure has probably become too complicated.

Protect OneDrive as well

SharePoint is not the only Microsoft 365 service storing documents.

Employees regularly store information in OneDrive.

Apply the same principles.

Control external sharing.

Use MFA.

Manage guest access.

Restrict unmanaged devices where appropriate.

Use information protection where business information requires it.

Remember that Teams also relies heavily on SharePoint and OneDrive for file storage.

A Microsoft 365 security review should therefore look across the wider environment rather than treating SharePoint as an isolated product.

Train employees to share information safely

Technical controls cannot prevent every mistake.

Employees need to understand what happens when they share a file.

Teach staff to distinguish between internal sharing and external sharing.

Explain why anonymous links create greater risk.

Show people how to confirm the intended recipient before sending sensitive information.

Make sure employees understand which SharePoint sites allow external collaboration.

People should also know what to do if they accidentally share a document with the wrong person.

Early reporting allows IT or the security team to remove access and investigate quickly.

Security training works best when it relates to everyday tasks rather than generic cyber security theory.

Secure email because attackers often start there

Many Microsoft 365 attacks begin with email.

Phishing remains the most commonly reported cyber attack experienced by UK businesses.

The UK Government’s Cyber Security Breaches Survey 2025 to 2026 found that 43 per cent of businesses identified a cyber breach or attack during the previous 12 months, representing approximately 612,000 UK businesses. (gov.uk)

Phishing affected 38 per cent of businesses.

Among businesses that identified a breach or attack, 88 per cent reported phishing activity. (gov.uk)

If a phishing attack compromises an employee’s Microsoft 365 identity, the attacker may then reach SharePoint and OneDrive.

Email security, identity security and SharePoint security therefore need to work together.

Watch for suspicious MFA prompts

Employees should know that an unexpected MFA request can indicate somebody already knows their password.

Teach users not to approve authentication prompts they did not initiate.

They should report unexpected requests immediately.

Administrators can then investigate authentication activity and reset credentials where appropriate.

This small awareness point can stop a compromised password from becoming a successful account takeover.

Review email forwarding

Attackers who compromise Microsoft 365 email accounts sometimes create forwarding rules.

These rules can silently send copies of emails to another address.

Review suspicious forwarding behaviour during an account investigation.

Employees should also understand that unexpected mailbox changes can indicate compromise.

Monitoring and auditing can help identify unusual activity.

Use Microsoft security monitoring

Microsoft provides security alerts and sign-in information that can help identify suspicious behaviour.

Depending on the organisation’s Microsoft licensing and security requirements, monitoring may include:

Unusual sign-ins

Repeated failed authentication

Risky authentication activity

Administrator changes

Guest invitations

Large document downloads

Permission changes

Mailbox forwarding

Security control changes

Someone should own the monitoring process.

An alert that nobody reviews provides little practical protection.

Smaller organisations may use a managed IT or managed security provider to perform this function.

Review Microsoft Secure Score

Microsoft Secure Score can help organisations identify security improvements across Microsoft services.

It provides recommendations linked with areas such as identities, applications, devices and information protection.

Review the recommendations regularly.

Do not chase a score simply for the sake of achieving a larger number.

Evaluate each recommendation against your business environment.

Implement the changes that improve security and make sense for the organisation.

Secure Score works best as a management aid rather than a target.

Keep employee devices supported

Microsoft 365 security also depends on the device used to access it.

A strongly protected Microsoft account can still face risk when an employee uses an unsupported or compromised laptop.

Cyber Essentials requires organisations to use licensed and supported software within scope and manage security updates appropriately. (ncsc.gov.uk)

Maintain an inventory of employee devices.

Know which operating system each device uses.

Make sure the vendor still provides security fixes.

Apply relevant updates.

Use appropriate endpoint protection.

Remove equipment that no longer meets the organisation’s security requirements.

Use device compliance where appropriate

Microsoft Intune can help organisations manage corporate devices and assess whether they meet required security settings.

Conditional Access can then use device compliance as part of the access decision.

For example, an organisation could require a compliant company laptop before allowing access to particularly sensitive Microsoft 365 resources.

Do not automatically apply managed-device requirements to external users without considering how external device trust works.

Microsoft notes that external users may have devices managed by their own organisation. Cross-tenant trust can allow the resource organisation to accept device compliance claims from the external user’s home tenant where the relationship justifies that trust. (learn.microsoft.com)

Where you cannot trust an external device, browser-only SharePoint access can provide a useful alternative.

Protect sensitive information with Microsoft Purview

Some organisations need stronger controls over documents even after an authorised employee downloads them.

Microsoft Purview can support information classification and data protection.

Sensitivity labels can help identify confidential information and apply appropriate controls.

Data Loss Prevention can detect sensitive information and restrict inappropriate sharing where the organisation has configured relevant policies.

These controls can provide additional protection for information such as:

Personal data

Financial records

Confidential customer information

Security documentation

Commercially sensitive material

Do not make classification unnecessarily complicated.

Employees need labels and rules they can understand.

Use secure defaults

Good Microsoft 365 security should not depend on every employee making a perfect security decision.

Configure the environment so the safer option becomes the normal option.

For example:

Require MFA automatically.

Make authenticated sharing the normal SharePoint option.

Restrict external sharing on confidential sites.

Remove administrator access where it is unnecessary.

Block older authentication.

Restrict unmanaged devices.

Use groups for permissions.

Automate account removal where practical.

This approach reduces reliance on employee memory.

Review Microsoft 365 after staff changes

Joiners, movers and leavers create important security events.

When somebody joins:

Create the account they need.

Give appropriate access.

Enable MFA.

Provide security awareness.

When somebody changes role:

Review their existing access.

Remove permissions that no longer apply.

Grant only the access required for the new role.

When somebody leaves:

Disable the account promptly.

Revoke active sessions where appropriate.

Transfer business information.

Remove them from groups.

Review shared access.

These processes support Cyber Essentials user access control requirements and good Microsoft 365 governance.

What are the key requirements for achieving Cyber Essentials certification?

Cyber Essentials focuses on five core technical controls: firewalls, secure configuration, security update management, user access control and malware protection.

Microsoft 365 has a particularly strong relationship with secure configuration and user access control.

Cyber Essentials v3.3 specifically includes organisational services such as Microsoft 365 within its cloud service definitions. The current requirements explain that SaaS providers deliver and manage the underlying application while the customer remains responsible for securely configuring the service. (ncsc.gov.uk)

For Microsoft 365, preparation should therefore include account management, MFA, administrator privileges, secure configuration and access control.

Employee endpoints also remain relevant because they connect to Microsoft 365 and organisational information.

How can I prepare my small business for Cyber Essentials assessment?

Start by documenting the environment.

Identify employees.

List company devices.

Record operating systems.

Identify Microsoft 365 accounts.

Review administrators.

Check MFA.

Review SharePoint guest access.

Remove old accounts.

Check security updates.

Confirm endpoint protection.

Review cloud services used throughout the organisation.

The NCSC provides the current Cyber Essentials assessment questions and Requirements for IT Infrastructure v3.3 through its Cyber Essentials resources. (ncsc.gov.uk)

Use the current question set before starting the formal assessment.

This helps identify gaps early.

Small organisations do not need unnecessary complexity.

Accurate information and good configuration matter more than complicated documentation.

What software solutions support compliance with Cyber Essentials standards?

Several Microsoft security services can support a Cyber Essentials programme.

Microsoft Entra can support MFA, identity management and Conditional Access.

Microsoft Intune can support endpoint management and device compliance.

Microsoft Defender can provide endpoint and email security capabilities.

SharePoint administration controls can restrict external sharing and unmanaged-device access.

Microsoft Purview can support information protection.

Asset and vulnerability management services can help organisations maintain visibility of endpoints and security weaknesses.

No single software product guarantees Cyber Essentials certification.

A security service only provides value when the organisation configures it properly and manages it consistently.

Cyber Essentials assesses whether the required controls are in place across the relevant environment.

Can I renew my Cyber Essentials certification through an online service?

Yes.

Cyber Essentials operates through an online assessment process and requires annual certification to maintain a current certificate.

Review Microsoft 365 before every renewal.

Do not copy previous answers without confirming that they remain accurate.

A Microsoft 365 environment can change considerably during a year.

New users join.

Employees leave.

Contractors gain access.

New SharePoint sites appear.

Cloud applications change.

Administrator roles may change.

A regular security review makes annual Cyber Essentials certification much easier.

UK Cyber Security Group supports Cyber Essentials applicants through the official certification process and offers different levels of assistance depending on the organisation’s needs. (ukcybersecurity.co.uk)

Which companies provide Cyber Essentials certification services in the UK?

Cyber Essentials certification comes through Certification Bodies operating within the official IASME delivery framework.

UK Cyber Security Group confirms that it is a registered Cyber Essentials Certification Body and provides certification support for UK organisations. (ukcybersecurity.co.uk)

Its current Cyber Essentials service includes assessment support for businesses that want help progressing through the certification process. (ukcybersecurity.co.uk)

When your business depends heavily on Microsoft 365, choose a provider that understands cloud environments.

The assessor or consultant should understand Microsoft Entra, MFA, Microsoft 365 user access, remote working, SharePoint and modern endpoint security.

Cloud security now forms a major part of Cyber Essentials for many organisations.

Which UK-based firms offer Cyber Essentials consultancy services?

A number of UK cyber security organisations provide Cyber Essentials preparation support.

UK Cyber Security Group provides Cyber Essentials certification together with wider cyber security services for organisations that require additional assistance. The company describes itself as a registered Certification Body and provides support with the certification process. (ukcybersecurity.co.uk)

Consultancy can prove especially useful where Microsoft 365 has grown without central management.

A business may discover old accounts, inconsistent MFA, broad administrator access, uncontrolled SharePoint sharing and unmanaged contractors.

The strongest consultancy approach should fix the underlying security position rather than merely help the organisation write an assessment answer.

A simple Microsoft 365 and SharePoint security checklist

1. Require MFA for all Microsoft 365 users.
2. Apply stronger protection to administrator accounts.
3. Reduce the number of Global Administrators.
4. Use separate privileged accounts where practical.
5. Block legacy authentication.
6. Review inactive employee accounts.
7. Remove old guest identities.
8. Use individual contractor accounts.
9. Put contractor information in dedicated SharePoint sites.
10. Disable unnecessary anonymous sharing.
11. Use authenticated sharing for business information.
12. Restrict unmanaged devices where appropriate.
13. Keep corporate endpoints supported and updated.
14. Review SharePoint groups and site membership.
15. Review administrator privileges regularly.
16. Monitor suspicious authentication activity.
17. Investigate unexpected MFA prompts.
18. Review suspicious mailbox forwarding.
19. Use information protection where sensitive data justifies it.
20. Connect account management with employee onboarding and departures.
21. Review Microsoft Secure Score periodically.
22. Train employees to recognise phishing and sharing mistakes.
23. Review important security settings throughout the year.
24. Include Microsoft 365 in Cyber Essentials preparation.

This provides a strong starting point without making the Microsoft 365 environment unnecessarily difficult to use.

Keep the approach practical

Simple ways to secure MS365 and SharePoint? starts with getting the basics right.

Protect every user with MFA.

Protect administrators more strongly.

Remove accounts people no longer need.

Use Conditional Access.

Block older authentication.

Make SharePoint permissions simple.

Use dedicated areas for external collaboration.

Give contractors individual guest identities.

Limit access from unmanaged devices.

Train employees to share information carefully.

Keep devices supported.

Monitor important security events.

Review the environment regularly.

These measures address many of the weaknesses that attackers commonly exploit.

The latest UK Government survey found that 43 per cent of businesses identified a cyber breach or attack during the previous 12 months, while phishing remained the leading reported attack and affected 38 per cent of businesses. (gov.uk)

That makes identity protection and employee awareness especially important for Microsoft 365 environments.

Cyber Essentials provides a practical framework for reviewing many of these controls. The current v3.3 requirements explicitly include Microsoft 365 as an organisational cloud service and make clear that the customer organisation remains responsible for secure configuration. (ncsc.gov.uk)

UK Cyber Security Group provides Cyber Essentials certification and support for businesses that want to strengthen their technical security while demonstrating that they meet the Government-backed scheme requirements. (ukcybersecurity.co.uk)

The best Microsoft 365 security strategy does not make collaboration impossible. It gives the right people appropriate access, prevents unnecessary exposure and creates controls that employees can follow every day. When identity, SharePoint, devices and employee behaviour work together, Microsoft 365 becomes a much stronger environment for storing and sharing business information.

UK Cyber Security Group Ltd is here to help

Please check out our Free Cyber Insurance

Other blog posts, Your ISO 27001 Questions Answered, Get ISO 27001 Certified ,

If you would like to know more, do get in touch as we are happy to answer any questions. Looking to improve your cybersecurity but not sure where to start? Begin by getting certified in Cyber Essentials, the UK government’s scheme that covers all the technical controls that will provide the protection that you need to help guard against criminal attacks. Or just get in touch by clicking contact us