5 Microsoft 365 settings worth checking in your tenant

Article Summary: Microsoft has tightened many Microsoft 365 security settings over the past few years, but those changes don’t always reach older environments. Tenants set up before 2022, or configured by a previous IT provider and left alone, often still run on legacy settings. The usual problem areas are file sharing, email forwarding, third-party app access, audit log retention, and MFA enforcement. Here are five settings worth checking.

Microsoft keeps making its defaults safer. New Microsoft 365 environments now get more protection out of the box than ones set up a few years ago. The catch is that old configurations stay put. When Microsoft changes a default for new tenants, your existing settings often stay the same. Older app permissions, inbox rules, and sharing links also keep working.

At Pacific Edge Technology, these are the first five Microsoft 365 security settings we check for businesses across Richland, Kennewick, and Pasco. They matter most if your environment is more than two or three years old. They also matter if a previous IT provider set it up, or if nobody has audited it in a while.

A few notes before you start

Some of these settings require Microsoft 365 Business Premium, E3, or E5 licensing. If a toggle is grayed out, your license level is the most likely reason. A couple of these changes will also prompt questions from your team, because they change how something already works. You don’t need to change everything at once.

1. The default sharing link in SharePoint and OneDrive

Sharing defaults are among the most overlooked Microsoft 365 security settings. When someone shares a file from SharePoint or OneDrive, the link has a default scope. In many older tenants, that default is “Anyone with the link.” Anyone who receives the URL can open the file without signing in. The link may never expire, and you have no record of who else received it.

That creates real exposure. Picture an employee who emailed a proposal to their personal account before leaving the company. That link still works unless someone turned it off.

How to fix it

You’ll find the default link type in the SharePoint admin center under Policies > Sharing. Switch the default to “Specific people” or “Only people in your organization.” Every new link will then require the recipient to sign in or verify their identity. You can also set an expiration limit so any remaining “Anyone” links time out automatically.

Keep in mind that changing the default only affects new links. Existing “Anyone” links keep working until they expire, someone removes them, or you turn off “Anyone” sharing completely.

Rough time: 15 minutes.

2. External email forwarding

Microsoft now blocks automatic forwarding to outside email addresses by default through the outbound spam policy. This change came as part of Microsoft’s secure-by-default effort.

Older tenants don’t always follow the new default, though. Someone may have customized the outbound spam policy years ago, or allowed forwarding for certain users. In that case, a user who forwards all their email to a personal Gmail account could still be sending your data outside the company.

How to check it

First, open the Microsoft Defender portal. Go to Email & Collaboration > Policies & Rules > Threat policies > Anti-spam policies, then open the outbound policy. Confirm that “Automatic forwarding rules” says “Off” or “Automatic – System-controlled.” Check any custom outbound policies too, since they can override the default.

Next, review existing forwarding across your mailboxes. The Exchange admin center includes an auto-forwarded messages report that shows who is forwarding mail outside the company. The Purview audit log only goes back 180 days by default, so it won’t show rules created years ago.

Rough time: 10 minutes for the policy check, longer to review mailboxes.

3. Old third-party app permissions

In July 2025, Microsoft turned on a Microsoft-managed user consent policy by default. It stops users from approving most third-party apps that want access to their files and sites. Instead, those requests now go to an administrator for review.

That change only applies going forward. Apps that users approved before the policy still keep their permissions. Some can read email, calendars, and files on the user’s behalf. Many are tools an employee tried years ago and forgot about, or apps from a one-off project nobody remembers approving.

How to review them

In the Microsoft Entra admin center, go to Enterprise applications > All applications. Open each app you don’t recognize and check its Permissions tab. Look for user-granted access to mail, files, or calendars. If you don’t recognize an app or no longer need it, revoke its access or delete it.

Rough time: 30 to 60 minutes, depending on how many apps you find.

4. Audit log retention

Microsoft changed its default audit log retention in October 2023. Audit (Standard) now keeps logs for 180 days, up from 90. With E5 licensing or the Microsoft Purview Audit (Premium) add-on, you get one year of retention for Exchange, SharePoint, OneDrive, and Entra ID records. Other activity types stay at 180 days.

For businesses in healthcare, financial services, legal, or other regulated industries, 180 days may fall short. Rules like HIPAA, the FTC Safeguards Rule, and state bar requirements often expect you to produce records on request. Those timeframes are often measured in years, not months.

How to extend it

Go to the Microsoft Purview portal and open Audit > Audit retention policies. Keeping logs longer than 180 days requires E5 or the Purview Audit add-on. Once you confirm your license supports it, setup takes about 15 minutes.

5. MFA enforcement and Security Defaults

Of all the Microsoft 365 security settings on this list, MFA is the most likely to have gaps in older environments. Microsoft introduced Security Defaults in late 2019. It now requires MFA automatically on new tenants. Microsoft has also started requiring MFA for admin sign-ins to the Azure portal and Microsoft 365 admin center.

Older tenants are a different story. Some never had Security Defaults turned on, and others had it switched off along the way. A common trap happens when a business moves to Conditional Access, which comes with Business Premium and above. You have to turn Security Defaults off to use Conditional Access. If someone rushed that switch, you can end up with Security Defaults off and a Conditional Access policy that misses some users.

How to check it

Check three things in the Microsoft Entra admin center. First, go to Properties > Manage security defaults to see whether Security Defaults is on or off. Second, under Protection > Conditional Access, confirm a policy requires MFA for all users, including administrators.

Third, look closely at your emergency “break-glass” admin accounts. Admins sometimes exclude these from Conditional Access so they can always get in. Those accounts still need strong protection, such as a hardware security key.

Rough time: about an hour, or longer if you have several Conditional Access policies to map.

A sensible order for making these changes

Some changes to your Microsoft 365 security settings are invisible to your team. Others affect how people work every day, so the order matters.

Start with #4 and #3. Extending audit retention and reviewing old app permissions won’t affect anyone’s daily work.

Next, do #2. Checking external forwarding usually goes unnoticed, since legitimate forwarding to outside addresses is rare.

Then tackle #1. Changing the sharing default will prompt questions, especially from people used to pasting share links into emails. Let your team know before you make the switch.

Save #5 for last. MFA and Conditional Access carry the highest stakes. A mistake here can lock people out, so give it the time it needs.

If you’re a Tri-Cities business and would rather have an expert handle this, get in touch with Pacific Edge Technology. We’ll audit your Microsoft 365 security settings and roll out the changes safely, without disrupting your team.

Microsoft 365 Security Settings FAQs

Do I need to check these settings if my tenant is new?

New tenants get safer Microsoft 365 security settings out of the box than older ones. Even so, every business should review sharing settings, app permissions, and inbox rules, no matter how new the tenant is.

Does Microsoft 365 still allow “Anyone with the link” sharing?

In many existing tenants, yes. Check both the tenant-wide setting in the SharePoint admin center and the settings on individual sites. Together, they determine what your users can actually do.

Did Microsoft turn off external email forwarding by default?

Yes. Microsoft’s outbound spam policy now blocks automatic forwarding to outside addresses by default. However, older tenants may have custom policies that still allow it, so confirm your settings and review existing forwarding.

How long does Microsoft 365 keep audit logs?

Audit (Standard) keeps logs for 180 days, as of October 2023. With E5 or the Purview Audit (Premium) add-on, you get one year for Exchange, SharePoint, OneDrive, and Entra ID.

Does Security Defaults protect all my users?

On a new tenant, yes, including MFA. On an older tenant that uses Conditional Access, Security Defaults is turned off. Your MFA coverage then depends entirely on how someone set up your Conditional Access policies.

Article used with permission from The Technology Press.