How do I secure MS365 and SharePoint?
How do I secure MS365 and SharePoint?
Securing Microsoft 365 and SharePoint requires much more than setting a strong password. Microsoft 365 now sits at the centre of many businesses, storing email, documents, customer information, contracts, employee records and other valuable data. A compromised Microsoft 365 account can therefore give an attacker access to a significant part of an organisation.
The strongest approach combines identity security, multi-factor authentication, Conditional Access, restricted administrator privileges, secure SharePoint sharing, device controls, information protection, email security and regular monitoring.
Cyber Essentials supports many of the same principles. The current Cyber Essentials Requirements for IT Infrastructure v3.3 explicitly identifies Microsoft 365 as Software as a Service and makes clear that the customer organisation still has responsibility for configuring cloud services securely.
UK Cyber Security Group provides Cyber Essentials certification and wider cyber security support for organisations that want to strengthen Microsoft 365, SharePoint and their broader IT environment. UK Cyber Security Group confirms that it operates as a registered Cyber Essentials Certification Body.
Start with identity because identity controls everything
Microsoft 365 security begins with Microsoft Entra ID, previously known as Azure Active Directory.
Every user, administrator, contractor and guest receives access through an identity. If an attacker compromises that identity, they may gain access to Exchange Online, SharePoint, OneDrive, Teams and connected cloud applications.
Your first priority should therefore involve securing user authentication.
A strong identity strategy should include:
Multi-factor authentication for users
Stronger protection for administrators
Conditional Access
Blocking legacy authentication
Separate administrator accounts
Regular access reviews
Removal of inactive accounts
Guest access management
Microsoft currently recommends a baseline set of Conditional Access controls that includes requiring MFA for administrators, requiring MFA for all users, securing security information registration and blocking legacy authentication. Microsoft also recommends MFA specifically for guest access.
These controls create a strong foundation for Microsoft 365.
Require multi-factor authentication for everyone
Passwords alone no longer provide enough protection for important cloud accounts.
Employees reuse passwords.
Phishing attacks steal credentials.
Attackers obtain passwords from external data breaches.
Credential stuffing attempts then test those passwords against other services.
Multi-factor authentication adds another security check.
Microsoft currently recommends a baseline Conditional Access policy covering all users and all resources that requires MFA.
Start with administrator accounts if you have not already protected them, but the stronger position involves MFA for everyone.
Your organisation should also protect:
Guest users
Contractors
Finance accounts
Senior management
IT administrators
SharePoint administrators
Exchange administrators
Service management accounts where interactive access exists
Cyber Essentials also places significant emphasis on MFA for cloud services. Under the current requirements, organisations need to make sure applicable cloud services use MFA where the service provides it.
Microsoft 365 should therefore sit near the top of any Cyber Essentials MFA review.
Use Conditional Access rather than relying only on passwords
Conditional Access lets Microsoft Entra make access decisions using more than a username and password.
Policies can consider the user, resource, authentication strength, device condition, sign-in risk and other factors.
Microsoft recommends several Conditional Access policies as a security foundation, including MFA, blocking legacy authentication and requiring appropriate device security.
A sensible business configuration might require:
MFA for all users
MFA for all guest users
Strong authentication for administrators
Compliant devices for highly sensitive systems
Restricted access from unsupported device platforms
Extra controls for risky sign-ins where licensing supports them
No persistent browser session for particularly sensitive access
The organisation should test new policies carefully before full enforcement.
Use Microsoft’s reporting capabilities to identify legitimate applications or users that a new rule could affect.
Block legacy authentication
Older authentication protocols can create a route around modern identity protections.
Microsoft states that legacy authentication clients do not support MFA and cannot provide device state information to Conditional Access.
Microsoft also states that more than 99 per cent of password spray attacks use legacy authentication protocols.
That makes blocking legacy authentication a high-value security measure.
Review whether your organisation still relies on outdated authentication for:
Old email clients
POP
IMAP
Legacy SMTP authentication
Old Office applications
Old third-party applications
Do not leave insecure authentication enabled simply because nobody knows whether something still uses it.
Identify the business dependency and replace or reconfigure the process where appropriate.
Separate administrator activity from normal work
Administrator accounts deserve stronger controls because they can make significant changes across Microsoft 365.
Do not give every IT user Global Administrator rights.
Apply least privilege.
An employee managing SharePoint may need SharePoint administration but not control of Exchange, authentication and every other Microsoft 365 service.
Where practical, administrators should use separate accounts for privileged work and ordinary everyday activity.
For example:
alex@company.co.uk for normal email and collaboration.
A separate privileged identity for administration.
This limits exposure if attackers compromise the employee’s everyday account through phishing or another attack.
Regularly review privileged roles and remove anything that no longer has a genuine business requirement.
Protect emergency administrator access
Microsoft 365 organisations should plan for an authentication failure or Conditional Access mistake.
Maintain carefully controlled emergency access arrangements so authorised personnel can recover administrative control when normal authentication fails.
Protect these accounts strongly.
Monitor their use.
Do not use them for everyday administration.
Document who can access them and when.
Any unexpected activity involving an emergency account should trigger immediate investigation.
Remove dormant Microsoft 365 accounts
Old accounts provide attackers with unnecessary targets.
Regularly review:
Former employees
Old contractors
Temporary accounts
Test accounts
Unused shared accounts
Guest identities
Dormant administrator accounts
Disable or remove identities that no longer serve a legitimate purpose.
Connect Microsoft 365 access management with your employee onboarding, role change and leaver processes.
When someone leaves, their access should not remain active simply because nobody informed IT.
Good account lifecycle management supports both Microsoft 365 security and Cyber Essentials access control requirements.
Secure SharePoint by controlling where sensitive information lives
SharePoint security becomes easier when organisations separate internal information from material intended for external collaboration.
Microsoft recommends storing confidential information in sites where external sharing remains disabled and creating separate sites where external collaboration is necessary.
This approach works particularly well for contractors, suppliers and customers.
For example, you could maintain:
An internal finance SharePoint site with no external sharing.
An internal HR site restricted to authorised employees.
A dedicated customer project site.
A separate contractor collaboration site.
A supplier document exchange site.
Avoid placing highly confidential internal documents inside a broadly shared collaboration site and attempting to manage security through individual folder permissions.
Site-level separation makes permissions easier to understand, audit and maintain.
Turn off anonymous sharing for sensitive information
SharePoint can create links that allow people to access content without authenticating.
Microsoft explains that Anyone links can work for anyone who receives the link and do not require the recipient to authenticate. Microsoft also notes that access through these links cannot provide the same identity-based audit assurance as authenticated access.
For business information, especially sensitive information, I would normally avoid anonymous sharing.
Prefer authenticated sharing.
Microsoft provides several external-sharing settings at organisation and site level. You can restrict a site so only existing guests receive access, allow new authenticated guests, or prevent external sharing completely.
The most restrictive setting between the organisation and site settings applies.
Use that hierarchy deliberately.
Make Specific people the normal sharing option
When users need to share individual documents externally, Specific people links provide a stronger approach than open links.
Microsoft states that Specific people links work only for the named recipients and require authentication.
Set secure sharing as the normal user experience.
Employees should not need to understand a complicated security decision every time they share a document.
Give them a secure default.
Then restrict broader sharing options to situations where the organisation has deliberately approved them.
This reduces accidental exposure without preventing legitimate collaboration.
Use Microsoft Entra B2B for contractors and partners
Businesses frequently need to give external organisations access to SharePoint.
Microsoft Entra B2B provides a much stronger governance model than anonymous sharing.
With B2B integration, SharePoint creates guest identities that Microsoft Entra can manage. External collaboration controls then apply to those guest identities.
This gives the organisation clearer visibility of:
Who has access
Which organisation they represent
What resources they can reach
When access should end
Whether Conditional Access applies
For contractors, give every person their own identity.
Do not create one shared contractor account.
Named identities improve accountability and make audit logs much more useful.
Create dedicated contractor SharePoint sites
Contractor security deserves particular attention because contractors often use devices that your organisation does not manage.
Create dedicated collaboration sites containing only the information those contractors need.
Do not grant contractors access to a broad internal SharePoint site simply because one folder contains relevant project documents.
Use group-based permissions.
For example:
Project owners
Internal project members
External contractor members
Read-only external reviewers
This gives you a clearer security boundary.
When the contract ends, remove the external group or guest accounts rather than searching across dozens of individual documents for permissions.
Restrict access from unmanaged devices
One of SharePoint’s strongest controls for contractor and bring-your-own-device environments involves restricted web access.
Microsoft allows organisations to limit users on unmanaged devices to browser-only SharePoint access. Under that restriction, users cannot download, print or synchronise files, and they cannot access those files through desktop Office applications.
This creates a useful model for contractors.
A contractor can view or edit authorised documents through the browser while the organisation reduces the chance that confidential files remain permanently stored on a personal laptop.
For highly sensitive information, you can block access from unmanaged devices entirely.
The right choice depends on the information and business requirement.
Use compliant devices for important access
Microsoft Intune can evaluate whether a device meets organisational security requirements.
These can include requirements such as encryption, supported operating systems, device security and protection against jailbroken or rooted devices.
Microsoft Entra can then use that compliance information when deciding whether to permit access.
For employees with access to highly sensitive SharePoint sites, requiring a managed and compliant device provides much stronger assurance.
Contractors create a more complicated decision because their device may belong to another organisation.
Where the sensitivity justifies it, issue a managed company device or use another controlled access method instead of relaxing security simply because the contractor needs access.
Use sensitivity labels for important information
Not every SharePoint document has equal sensitivity.
A public marketing document does not need the same protection as:
Employee information
Security documentation
Board information
Customer records
Legal documents
Sensitive commercial information
Microsoft Purview sensitivity labels can classify and protect information held in SharePoint and OneDrive.
Microsoft confirms that when sensitivity-label support is enabled for SharePoint and OneDrive, Office files and supported PDF documents can carry the label and associated encryption protection. The protection can remain with a document when somebody downloads it.
This gives businesses another protection layer beyond SharePoint permissions.
Use Data Loss Prevention to reduce accidental disclosure
Microsoft Purview Data Loss Prevention can identify sensitive information and apply controls when employees attempt to share it inappropriately.
DLP can operate across SharePoint and OneDrive and can use sensitivity labels as policy conditions.
A business might use DLP to identify:
Personal information
Financial information
Confidential corporate information
Sensitive customer information
Regulated information
The policy can warn the employee, restrict access or apply another appropriate action.
This can prevent a simple sharing mistake from becoming a data incident.
Protect email because phishing often starts the attack
Securing SharePoint while leaving Exchange Online exposed does not provide enough protection.
An attacker who compromises an employee’s email account may gain access to SharePoint through the same Microsoft 365 identity.
The UK Government’s Cyber Security Breaches Survey 2025 to 2026 found that 43 per cent of businesses identified a cyber breach or attack during the previous 12 months. Phishing affected 38 per cent of businesses and remained the most commonly reported attack.
Your Microsoft 365 security programme therefore needs strong email protection.
Microsoft Defender for Office 365 can provide additional phishing and malware controls.
Safe Attachments checks email attachments in a virtual environment for malicious behaviour before delivery.
Microsoft Defender for Office 365 also provides Safe Links, anti-phishing controls and impersonation protection capabilities.
Email security and SharePoint security should work together.
Protect senior employees from impersonation
Attackers frequently target senior employees, finance teams and people who can approve payments.
Configure appropriate anti-phishing and impersonation protection where your Microsoft licensing supports those capabilities.
Protect:
Directors
Finance employees
Human resources
IT administrators
Employees authorised to change bank details
Employees handling confidential customer information
Train employees to verify unusual requests through a separate trusted communication route.
A convincing email that appears to come from a director should never override a well-designed financial approval process.
Monitor Microsoft Secure Score
Microsoft Secure Score provides a useful overview of your current Microsoft security posture.
Microsoft describes Secure Score as a measurement based on recommended security actions across identities, applications, devices and data. It gives organisations a central place to identify improvement opportunities and monitor progress.
Use Secure Score regularly rather than checking it once during a security project.
Review recommended actions.
Assign owners.
Assess the business effect.
Implement appropriate improvements.
Record exceptions where another safeguard addresses the risk.
Secure Score does not prove that your organisation cannot suffer a breach. Microsoft explicitly describes it as a security-posture measurement rather than an absolute prediction of breach risk.
Treat it as a security improvement tool.
Keep SharePoint permissions simple
SharePoint permission structures can become difficult to manage when administrators repeatedly break inheritance and grant access directly to individuals.
Use groups wherever possible.
For example:
Owners
Members
Visitors
Project groups
Department groups
External guest groups
Grant the group access and manage membership through a controlled process.
Avoid individual permissions unless a genuine business requirement makes them necessary.
Review sensitive sites periodically.
Ask:
Who has access?
Why do they need it?
Are any guests still present?
Do former employees remain in groups?
Does anyone have excessive permissions?
Has external sharing changed?
Simple permissions are easier to audit and much harder to misunderstand.
Restrict who can create external sharing
Not every employee needs authority to invite external users into sensitive SharePoint environments.
Decide who can approve external collaboration.
For important sites, limit sharing responsibility to trained site owners.
Make those owners accountable for reviewing guest membership.
Document why external access exists.
Remove access when the project, contract or business relationship ends.
This creates a controlled process rather than allowing external access to grow indefinitely.
Review guests regularly
Guest accounts often survive much longer than the business relationship that created them.
Review guest users on a regular basis.
Ask the relevant business owner to confirm that each external person still needs access.
Remove guests who no longer require it.
Review external sharing links at the same time.
If the contractor finished six months ago, their account should not remain active simply because nobody remembered to remove it.
Access reviews should become part of normal Microsoft 365 governance.
Protect OneDrive as well as SharePoint
Employees often hold business information in OneDrive.
Apply the same security thinking.
Control external sharing.
Use identity protection.
Use sensitivity labels where appropriate.
Apply DLP.
Protect access from unmanaged devices.
Remember that Teams also stores much of its file content in SharePoint and OneDrive.
Securing Microsoft 365 therefore requires an integrated approach rather than securing each interface independently.
Maintain audit visibility
Microsoft 365 activity logs can help identify suspicious behaviour and support investigations.
Important events can include:
Unusual sign-ins
Guest invitations
External sharing
Large downloads
Administrator changes
Permission changes
Mailbox forwarding
Security policy changes
Account changes
Monitor activity according to the risk level of your organisation.
A small business may use Microsoft security alerts and managed security support.
A larger or higher-risk organisation may feed Microsoft 365 activity into wider security monitoring.
The important point is that somebody receives, reviews and acts on meaningful alerts.
What are the key requirements for achieving Cyber Essentials certification?
Cyber Essentials focuses on five technical controls: firewalls, secure configuration, security update management, user access control and malware protection.
Microsoft 365 contributes particularly strongly to secure configuration and user access control.
For Microsoft 365 preparation, review:
MFA
Administrator access
Guest access
Unsupported authentication methods
Secure cloud configuration
User accounts
Access permissions
Endpoints that connect to Microsoft 365
Cyber Essentials v3.3 identifies Microsoft 365 as SaaS and explains that the organisation remains responsible for securely configuring the service.
Do not assume Microsoft’s responsibility for the cloud platform removes your responsibility for tenant configuration.
Microsoft protects the underlying service.
You still decide who accesses it and how securely they authenticate.
How can I prepare my small business for Cyber Essentials assessment?
Start with your users, devices and cloud services.
Identify everyone with a Microsoft 365 account.
Review administrators.
Enable MFA.
Check cloud authentication.
Remove dormant accounts.
Review SharePoint external sharing.
Check employee devices for supported operating systems and security updates.
Make sure endpoints use appropriate malware protection.
Review firewalls and internet access.
The current Cyber Essentials requirements are v3.3 for applications started from 27 April 2026.
Use the current NCSC assessment questions rather than relying on an old Cyber Essentials submission.
Small businesses do not need unnecessary complexity.
They need clear ownership, good configuration and accurate evidence.
What software solutions support compliance with Cyber Essentials standards?
Several Microsoft services can support a Cyber Essentials security programme.
Microsoft Entra can support identity management, MFA and Conditional Access.
Microsoft Intune can support device management and compliance.
Microsoft Defender can support endpoint and email protection.
Microsoft Purview can support information classification and DLP.
SharePoint administration can support controlled external sharing and unmanaged-device restrictions.
Microsoft Secure Score can help management identify security improvement opportunities.
These tools do not automatically create compliance.
Configuration matters.
Ownership matters.
Regular review matters.
An organisation needs to understand which controls apply and confirm that they operate effectively.
Can I renew my Cyber Essentials certification through an online service?
Yes.
Cyber Essentials uses an online assessment process, and organisations need to renew certification each year to maintain current status.
Microsoft 365 security should receive a fresh review during every renewal.
Do not copy last year’s answers without checking the tenant.
During the year, businesses may add:
New employees
New SharePoint sites
New external guests
New Microsoft applications
New contractors
Additional administrators
New devices
Changes to remote working
Each change can affect the accuracy of the next Cyber Essentials assessment.
Maintaining Microsoft 365 security throughout the year makes annual renewal much easier.
Which companies provide Cyber Essentials certification services in the UK?
Cyber Essentials certification comes through authorised Certification Bodies operating within the IASME scheme.
UK Cyber Security Group provides Cyber Essentials certification and states that it is a registered Cyber Essentials Certification Body. The company supports businesses through the application process and wider cyber security improvement work.
When selecting a provider, consider whether it understands modern Microsoft 365 environments as well as the Cyber Essentials assessment itself.
Microsoft 365 now forms a major part of the IT environment for many UK organisations.
A provider should understand cloud authentication, MFA, SharePoint access, Microsoft Entra, endpoint security and remote working.
Which UK-based firms offer Cyber Essentials consultancy services?
UK businesses can obtain support from Cyber Essentials Certification Bodies, cyber security consultancies and managed security providers.
UK Cyber Security Group provides Cyber Essentials certification alongside broader security services and guidance.
A capable consultancy should help improve your real security rather than simply change questionnaire wording.
For Microsoft 365, useful support may include:
Reviewing Microsoft Entra security
MFA coverage
Conditional Access
Administrator permissions
SharePoint external sharing
Guest access
Device controls
Email security
Information protection
Security monitoring
Cyber Essentials readiness
The strongest outcome combines successful certification with a Microsoft 365 environment that is genuinely harder to compromise.
Current UK cyber statistics make Microsoft 365 security important
The Cyber Security Breaches Survey 2025 to 2026 found that 43 per cent of UK businesses identified a cyber breach or attack in the previous 12 months. That equates to approximately 612,000 businesses.
The rate reached 65 per cent among medium businesses and 69 per cent among large businesses. Small businesses reported 46 per cent.
Phishing affected 38 per cent of businesses.
People impersonating organisations or staff affected 12 per cent.
Malware affected 7 per cent.
Microsoft 365 controls directly address many of the routes that attackers exploit during these incidents.
MFA helps reduce the usefulness of stolen passwords.
Email security reduces phishing exposure.
Conditional Access can restrict suspicious authentication.
SharePoint access controls reduce unnecessary data exposure.
Sensitivity labels and DLP can reduce information leakage.
Monitoring can help identify suspicious activity before it develops into a larger incident.
A practical Microsoft 365 security baseline
For most UK organisations, I would aim for the following baseline:
Require MFA for every user.
Apply stronger controls to administrators.
Block legacy authentication.
Use separate administrator identities.
Review privileged roles.
Remove unused accounts promptly.
Use Conditional Access.
Manage employee devices.
Restrict unsupported devices.
Use dedicated SharePoint sites for sensitive information.
Disable unnecessary anonymous sharing.
Use authenticated guest identities.
Prefer Specific people sharing.
Create dedicated sites for contractors.
Restrict unmanaged devices to browser access where appropriate.
Block unmanaged devices from highly sensitive information.
Review guest accounts.
Review external sharing.
Use sensitivity labels.
Use DLP where sensitive information justifies it.
Strengthen Exchange Online phishing protection.
Monitor Secure Score.
Review security alerts.
Keep operating systems and applications supported.
Test your employee leaver process.
Audit permissions regularly.
This creates a much stronger Microsoft 365 security position while supporting many Cyber Essentials requirements.
Make Microsoft 365 security part of normal business activity
The answer to “How do I secure MS365 and sharepoint?” should not involve one security setting.
Start with identity.
Require MFA.
Use Conditional Access.
Protect administrators.
Remove old accounts.
Secure employee devices.
Separate sensitive SharePoint information from external collaboration.
Avoid anonymous sharing for confidential business documents.
Use named guest identities for contractors.
Restrict unmanaged-device downloads.
Apply sensitivity labels and DLP where information requires stronger protection.
Protect Exchange Online because phishing frequently provides the first route into Microsoft 365.
Monitor Secure Score and security alerts so your organisation keeps improving.
Microsoft’s current guidance recommends MFA, blocking legacy authentication and Conditional Access as core identity protections. Microsoft also recommends limiting SharePoint access from unmanaged devices and separating confidential sites from sites intended for external collaboration.
Cyber Essentials reinforces many of the same fundamentals. Its current requirements treat Microsoft 365 as a cloud service that the customer still needs to configure securely.
UK Cyber Security Group provides Cyber Essentials certification and wider cyber security support for organisations that want to improve these controls and demonstrate stronger security to customers, partners and supply chains.
A well-secured Microsoft 365 environment gives your organisation more than better audit readiness. It protects identities, restricts unnecessary access, makes external collaboration safer and reduces the chance that one stolen password or incorrectly shared SharePoint document becomes a serious business incident.
UK Cyber Security Group Ltd is here to help
Please check out our Free Cyber Insurance
Other blog posts, Your ISO 27001 Questions Answered, Get ISO 27001 Certified ,
If you would like to know more, do get in touch as we are happy to answer any questions. Looking to improve your cybersecurity but not sure where to start? Begin by getting certified in Cyber Essentials, the UK government’s scheme that covers all the technical controls that will provide the protection that you need to help guard against criminal attacks. Or just get in touch by clicking contact us
