Microsoft 365 & Security: Questions & Answers

QUESTION 1 · Microsoft 365 licensing

Choosing Microsoft 365 Business Premium

Submitted February 4, 2025 at 9:14 AM EST

We have 85 employees on Business Standard. Management sees Business Premium as a more expensive Office subscription. What would actually justify the upgrade for a business our size?

Phil Kinsley:

For 85 employees, I would base the decision on three jobs: managing laptops, controlling access to Microsoft 365, and investigating endpoint or email threats. Business Premium includes Intune, Entra ID P1, Defender for Business, and Defender for Office 365 Plan 1. Those are substantial additions to Business Standard, but someone still has to configure and operate them.

Pilot with users from finance, sales, and IT. Require a compliant device for a selected application, apply mobile app protection, and test an endpoint alert and suspicious email. Compare those results with the products and support effort you would otherwise need.

Business Premium is intended for organizations with up to 300 users. Confirm the exact SKU, including whether Teams is included, before ordering. The upgrade is easier to justify when it replaces a known gap or duplicate product.

QUESTION 2 · Identity and access

Checking whether MFA is actually enforced

Submitted February 14, 2025 at 2:37 PM EST

Our users all registered Microsoft Authenticator, but an audit still says MFA enforcement is inconsistent. How do I prove which accounts and applications are protected?

Phil Kinsley:

Authenticator registration tells you which methods a user has registered. It does not tell you which applications require MFA.

Start with the tenant's enforcement model: security defaults, Conditional Access, or legacy per-user MFA. For Conditional Access, check enabled policies, included users, target resources, exclusions, and grant controls. Report-only policies do not enforce access requirements.

Test an ordinary user, an administrator, a guest, and a documented exception. In each corresponding Entra sign-in event, inspect Authentication Details and the Conditional Access result. An existing MFA claim may satisfy the requirement without another prompt. Also inspect legacy-authentication sign-ins and applications outside the policy scope. Keep the policy export and matching test events together so an auditor can follow the decision.

QUESTION 3 · SharePoint and OneDrive

Putting team documents in the right place

Submitted February 26, 2025 at 11:08 AM EST

Our finance team shares everything from the finance director's OneDrive. It works, but I am concerned about what happens when that person leaves. Should these files be somewhere else?

Phil Kinsley:

Move finance-owned documents into a SharePoint team site or library with named finance owners. Keeping the department's records in the director's OneDrive makes access and handover depend on one person's account.

Agree who can read, edit, share externally, and approve access. Give the site at least two owners. Move a small sample first and check versions, permissions, retention, and links before migrating the remaining files.

Teams can provide the interface, but storage still matters. Standard channel files live in the team's SharePoint site; private and shared channels have separate SharePoint sites. Files uploaded into chats commonly live in the sender's OneDrive. Show staff where the authoritative finance library is and replace the links they actually use.

QUESTION 4 · Identity and access

Moving from security defaults to Conditional Access

Submitted March 6, 2025 at 8:46 AM EST

We now have licenses that include Entra ID P1. How would you move from security defaults to Conditional Access without creating a protection gap or locking everyone out?

Phil Kinsley:

Prepare the Conditional Access replacement before disabling security defaults. Users covered by Conditional Access need Entra ID P1 or an entitlement that includes it.

1. Create and test two cloud-only emergency administrators with independent phishing-resistant credentials.
2. Prepare baseline policies for MFA and legacy authentication blocking, with emergency accounts excluded from policies that restrict sign-in.
3. Check authentication registration, service dependencies, exclusions, and expected results with policy analysis tools.
4. In the agreed change window, disable security defaults and immediately enable the replacement policies.
5. Test administrator and ordinary-user access, then inspect the matching sign-in events.

Security defaults and enforced Conditional Access are alternative configurations. Do not disable the former and leave the replacement baseline in report-only mode. Keep a second tested administrator session and a written rollback procedure available during cutover.

QUESTION 5 · Identity and access

Deciding whether an office network should bypass MFA

Submitted March 17, 2025 at 4:22 PM EDT

The help desk wants to stop MFA prompts whenever users are in the office. Is excluding our public IP addresses from Conditional Access a reasonable compromise?

Phil Kinsley:

I would first find out why people are seeing repeated prompts. Check sign-in frequency controls, browser sessions, device registration, and the authentication method. An office-wide exclusion can conceal a session configuration problem.

A public office IP identifies a network path, not a trustworthy person or device. An attacker using a compromised office computer or remote access service can appear to come from that address. Proxies and secure access services can also change the address Entra sees.

If a specific application needs a location exception, document that application, the affected users, and the reason. Test office, remote, and unmanaged-device access. Keep privileged administration protected with phishing-resistant authentication, and give any exception a review date.

QUESTION 6 · External collaboration

Investigating a guest who cannot open a shared file

Submitted March 28, 2025 at 10:53 AM EDT

A supplier can enter our Team but gets access denied on a document. Reinviting them has not helped. Which settings should I check, and in what order?

Phil Kinsley:

Start with the failed document URL and the guest's identity. Team membership alone does not tell you which SharePoint site or permissions govern that file.

1. Confirm the guest is signed in with the account that redeemed the invitation. Look for duplicate guest objects.
2. Identify the document's site and library. A private or shared channel can use a different site from the main Team.
3. Inspect the file's effective permissions, unique permissions, and the named recipients on its sharing link.
4. Check site and organization external-sharing limits, then the matching Entra sign-in for Conditional Access or cross-tenant restrictions.
5. Retest with the intended guest in a separate browser session, including a file they should not be able to open.

Reinviting the same person will not repair an incorrectly scoped link or a policy denial.

QUESTION 7 · Email security

Deploying Standard and Strict email protection

Submitted April 3, 2025 at 1:19 PM EDT

We have Defender for Office 365 but mostly default policies. Should I use the Standard and Strict presets, and how do I avoid breaking mail delivery for executives?

Phil Kinsley:

Use Standard as the baseline for a representative pilot, then test Strict with the higher-risk population. In the Defender portal, open Email & collaboration > Policies & rules > Threat policies > Preset security policies.

Check recipient assignments first. For the same protection type, Strict takes precedence over Standard, and the presets take precedence over custom policies. A custom policy with a lower priority number does not override a preset for the same recipient.

Configure impersonation protection for the users and domains that need it. Test legitimate invoices, partner messages, links, and attachments, then review quarantine and reported false positives with the help desk. Decide who can request or approve release. Make changes through the supported preset settings rather than editing the underlying generated policies.

QUESTION 8 · Email security

Configuring SPF DKIM and DMARC

Submitted April 15, 2025 at 9:42 AM EDT

Our domain has an SPF record, but customers still receive messages impersonating us. What is the practical sequence for adding DKIM and DMARC when several services send our mail?

Phil Kinsley:

SPF checks the sending path for the envelope domain. DMARC checks whether a passing SPF or DKIM result aligns with the domain in the visible From address. SPF alone will not solve impersonation.

1. Inventory every service that sends as your domain, including marketing, ticketing, and application mail.
2. Maintain one SPF record per sending domain and stay within SPF's DNS-lookup limit.
3. Enable DKIM using the records supplied for your Microsoft 365 domain. Configure aligned signing for the other senders where supported.
4. Publish DMARC with reporting, identify legitimate senders that fail alignment, and fix them before moving to quarantine or reject.
5. Inspect authentication headers on messages from each approved service.

DMARC needs aligned SPF or aligned DKIM to pass, not necessarily both. It does not prevent lookalike domains or messages sent from a genuinely compromised mailbox.

QUESTION 9 · Exchange Online

Restricting automatic external email forwarding

Submitted April 29, 2025 at 3:06 PM EDT

Some employees forward work email to personal accounts. I want to stop that, but a support mailbox legitimately forwards messages to a vendor. How should we handle the exception?

Phil Kinsley:

Set automatic external forwarding to Off for the normal population in the outbound anti-spam policy. Automatic currently behaves as Off, but an explicit setting makes your intention easier to review.

Create a separate, higher-priority outbound policy for the approved support mailbox and set forwarding to On there. Check Exchange remote-domain settings and mail flow rules as well: another blocking control can still prevent delivery.

Test personal forwarding from an ordinary mailbox, the approved vendor destination, and internal forwarding. Use message trace to check the result. Record the vendor, business owner, and review date for the exception. Investigate unexpected forwarding rules as possible compromise evidence. These settings govern automatic forwarding; they do not stop a user manually sending a message to a personal address.

QUESTION 10 · SharePoint and OneDrive

Preserving OneDrive files during an employee departure

Submitted May 7, 2025 at 8:58 AM EDT

An employee is leaving next week and their manager needs the project files. Is removing the license enough to preserve the OneDrive, or should we transfer everything first?

Phil Kinsley:

Arrange the handover before removing the license. Removing a license and deleting a user trigger different OneDrive lifecycle behavior; neither should be your file-transfer procedure.

Confirm the manager's authorized access and any retention or hold requirements. Move department-owned material into the appropriate SharePoint library, then have the manager open representative files and check versions, permissions, and working links.

For any OneDrive left behind, inspect the tenant's unlicensed-account report and the lifecycle rules that apply to that account. Separately check the deleted-user OneDrive retention setting if the identity will be deleted. Microsoft has changed unlicensed-account enforcement over time, so do not apply a remembered archive deadline to every account. Finish license removal only after the required content is accessible and the remaining deadlines are recorded.

QUESTION 11 · External collaboration

Reducing exposure from SharePoint sharing links

Submitted May 19, 2025 at 12:34 PM EDT

We found sensitive files shared with Anyone links. Can we change the default to Specific people and assume the existing exposure is fixed?

Phil Kinsley:

No. Changing the default to Specific people changes future sharing choices; it does not revoke existing Anyone links.

Identify the sensitive files, active links, direct permissions, and broad groups that provide access. Remove the unwanted Anyone links and issue replacements to named recipients. Check the organization and site sharing settings so users cannot immediately recreate the same exposure where anonymous sharing is unnecessary.

Test the old link in a signed-out browser. It should no longer provide access. Test the replacement with an intended recipient and an unrelated account. Keep the site's owner responsible for later access reviews. The default link type is useful, but the existing links and permissions determine whether the files are still exposed.

QUESTION 12 · Microsoft Teams

Choosing between Teams external access and guest access

Submitted May 30, 2025 at 4:11 PM EDT

A project manager says we should enable guest access because our external chat is already allowed. Are those effectively the same thing, and where do shared channels fit?

Phil Kinsley:

External access supports conversations with people in other organizations, such as federated chat and calls. It does not make that person a member of your Team or grant access to its files.

Guest access creates a guest identity in your tenant and lets you assign access to a Team and other resources. Shared channels use Entra B2B direct connect and require compatible cross-tenant settings in both organizations; they are a separate collaboration model.

Choose from the work the partner needs to do. A short conversation may need external access only. An ongoing project may need guest membership or a shared channel. Test with a real partner account and check the backing SharePoint site, channel membership, and access-removal process.

QUESTION 13 · Intune and endpoints

Understanding Intune enrollment configuration and compliance

Submitted June 5, 2025 at 10:27 AM EDT

Our dashboard shows nearly every laptop enrolled in Intune. Leadership wants to describe them as compliant and secure. What else should I verify before making that claim?

Phil Kinsley:

Enrollment means Intune has a management relationship with the laptop. It does not prove that the required settings applied or that access depends on compliance.

Check three things: policy assignment, recent per-setting results, and the access decision. Review the tenant setting for devices with no compliance policy assigned. If compliance gates access, Microsoft recommends treating those devices as Not compliant. Also inspect the compliance-status validity period and stale device records.

Test a deliberately noncompliant pilot device against an application protected by Conditional Access. Confirm that the device is denied for the intended reason. Report how many active laptops met a defined baseline on the assessment date, and list the missing or stale devices separately. Avoid describing the entire enrolled fleet as secure.

QUESTION 14 · Intune and endpoints

Troubleshooting a noncompliant device

Submitted June 17, 2025 at 2:05 PM EDT

One Windows laptop is blocked from Microsoft 365 even though BitLocker is on and updates look current. How do I troubleshoot it without excluding the user from the compliance policy?

Phil Kinsley:

Find the blocked Entra sign-in first. Record the device ID, application, time, and failed Conditional Access control. Then open the matching Intune record rather than assuming the laptop name identifies the right object.

Inspect the individual compliance setting that failed, the last check-in, the grace period, and any Defender machine-risk signal used by the policy. BitLocker being enabled does not prove that minimum OS version, Secure Boot, or another condition passed.

Correct that condition, initiate a supported sync, and retest the same application after reporting updates. If the sign-in points to a stale registration, investigate that mismatch before deleting records. Removing the user from the policy can restore access while leaving the actual problem unresolved.

QUESTION 15 · Intune and endpoints

Protecting work data on personal phones

Submitted June 27, 2025 at 9:31 AM EDT

Employees will use Outlook on personal phones, but they will not accept full device management. Can we protect work email and remove company data when somebody leaves?

Phil Kinsley:

Yes, for supported apps on supported iOS and Android devices. Intune app protection can restrict organizational data in apps such as Outlook without enrolling the entire personal device. Users still need the appropriate entitlement and platform prerequisites.

Pilot app protection with work accounts, then use the Conditional Access Require app protection policy control for the intended mobile access. Test copying into personal apps, saving attachments, opening links, and work and personal accounts in the same app.

Test a selective wipe before relying on it for departures. Wipe behavior depends on the app communicating with the service, so it is not an immediate erasure of every copy on an offline phone. Explain that the policy protects managed work data and does not give IT full control over the personal device.