Microsoft 365 security with Entra ID: switch on what you pay for.
Most hacked accounts had no second step at sign-in. That step is in every licence.
Short answer
Securing Microsoft 365 starts at sign-in. Microsoft Entra ID, the service that manages all accounts, can enforce two-step verification and use conditional access to decide from which devices and countries someone may get in. Business Premium adds Defender for Business. Jevana switches those settings on, tests them with your staff and checks monthly that they are still on.
In this order
- 01
A second step for everyone
Signing in asks for a confirmation in an app. No exception for the director.
- 02
Close the old doors
Outdated ways of signing in that have no second step are switched off.
- 03
Administrators apart
Managing is done with a separate account that is used for nothing else.
- 04
Rules for access
Only known devices, only from countries where you work. This is conditional access.
- 05
Watching along
Alerts about suspicious sign-ins and forwarding rules come in to us.
What the terms mean
Microsoft Entra ID
The new name of Azure Active Directory, since 2023.
- The address book of all accounts, groups and devices
- The place where every sign-in is assessed
- Also the sign-in for other software that logs in through Microsoft
MFA
Multi-factor authentication, also called two-step verification.
- Password plus a confirmation on your phone
- An app is safer than a code by text message
- For administrators preferably a physical key
Conditional access
Rules that are checked at every sign-in.
- May this device get in, and is it up to date
- Does the country match where this person works
- Does this application need an extra check
Defender for Business
Security on the laptop itself, included with Business Premium.
- Recognises and blocks malicious software
- Can cut an infected laptop off the network
- Reports what happened, so someone can step in
The weak spot is the exception
In most environments two-step verification is on. And in most there are two or three accounts for which it has been turned off: the scanner, an old admin account, the owner who found it awkward.
That is where an attacker gets in. Securing is therefore less a matter of switching something on than of removing the exceptions one by one, and then checking that no new ones appear.
Questions
Is MFA enough to secure Microsoft 365?
MFA stops most attacks, but it is not enough. Attackers use fake sign-in pages that also intercept the second step, or old protocols that do not know it. So alongside MFA you want at least outdated sign-ins switched off, separate admin accounts and an alert for suspicious sign-ins. With Premium, device checks come on top.
What is conditional access?
Conditional access is a part of Microsoft Entra ID that checks rules at every sign-in before someone gets in. A rule can be: only from a managed laptop, only from the Netherlands and neighbouring countries, or always an extra confirmation for the finance team. It is available from Business Premium.
What does Defender for Business do?
Defender for Business watches laptops and phones for malicious software and suspicious behaviour. Unlike a classic virus scanner, it looks at what a program does, and it can isolate an infected device from a distance. It comes with Microsoft 365 Business Premium. It only works well if someone reads the alerts, and that is what we do.
How can you tell whether an account has been taken over?
By a few usual traces: a sign-in from an unexpected country, a new rule that forwards or hides mail automatically, an unknown device that has been registered, or colleagues receiving odd mail from that address. Microsoft records those events. We get alerts about them and look at them before the user notices anything.
What is Microsoft Entra ID?
Microsoft Entra ID is the service that holds all accounts, groups and devices of a Microsoft 365 environment and checks every sign-in. Until 2023 it was called Azure Active Directory; only the name has changed. Every Microsoft 365 licence includes the basic version. The fuller version, with conditional access, comes with Business Premium.
Goes well with
-
Intune and Autopilot
Laptops, phones and tablets managed centrally with Microsoft Intune, and new laptops that set themselves up.
-
Cybersecurity for SMEs
The measures that stop most attacks, in an order a small business can follow.
-
Microsoft 365 management
Accounts, licences, security and Microsoft's changes kept up, for a fixed fee.
-
Password management
A password vault for the whole team, so shared passwords no longer sit in a spreadsheet.
-
NIS2
What the Cyberbeveiligingswet asks of you technically, even if it does not cover you but covers your clients.
From the knowledge base
-
Microsoft 365 Business Basic, Standard or Premium: which do you need?
The three business licences side by side: what is in them, who needs which, and why you can mix them without trouble.
-
A colleague clicked a phishing link: what do you do now?
Someone clicked or typed in their password. What to do straight away, what to check afterwards and when you have to report it.
-
SPF, DKIM and DMARC explained: why does your email end up in spam?
Three DNS settings decide whether your business email arrives. What they do, what goes wrong and why you should not set them up halfway.
-
Ransomware: what do you do in the first hours?
Files encrypted and a ransom note on the screen. What to do straight away, what to leave alone and how to get back to work.
Tell us what you run.
An introduction costs nothing. You talk straight away to one of the two people who will actually do the work.
or email info@jevana.systems