Microsoft has strengthened several default security settings in Microsoft 365 over the past few years. As a result, newer Microsoft 365 tenants generally receive more protection out of the box than tenants created before approximately 2022.
The problem is that legacy configurations usually remain in place.
When Microsoft changes a default setting for new tenants, it does not necessarily apply that change retroactively to existing environments. Historical user permissions, third-party application consents, inbox rules, and file-sharing links created before the update may still be active.
Here are five Microsoft 365 settings worth reviewing, especially if your tenant is more than two or three years old, was originally configured by a previous IT provider, or has not been audited recently.
Before getting started, keep a few caveats in mind. Some of these settings require Microsoft 365 Business Premium, E3, or E5 licensing. If a setting is unavailable or grayed out, your current license tier is likely the reason.
A few of these changes may also generate support requests because they alter familiar workflows. None of them need to be changed all at once.
1. The default sharing link in SharePoint and OneDrive
When someone in your organization shares a file from SharePoint or OneDrive, the link they create is assigned a default access scope.
In tenants established before Microsoft tightened its sharing defaults, that scope may still be set to “Anyone with the link.”
This setting allows anyone who receives the URL to open the file without signing in. There may be no expiration date and no reliable record of who received the link after it was forwarded.
Newer SharePoint sites created through Microsoft Teams generally default to “Only people in your organization.” However, older sites and tenant-level sharing settings may still permit anonymous “Anyone” links.
For example, a former employee who emailed a proposal to a personal account six months before leaving may still have access through that link unless someone manually revoked it.
You can find the default sharing link setting in the SharePoint admin center under Policies > Sharing.
Changing the tenant default to “Specific people” requires recipients to authenticate before opening newly shared content. You can also establish a maximum expiration period for any remaining “Anyone” links so they automatically stop working after a defined amount of time.
Rough time to change: 15 minutes. This setting does not affect existing links unless they are revoked or regenerated.
2. External email forwarding rules
Microsoft now blocks automatic email forwarding to external addresses by default at the tenant level through its outbound spam policy. This change was introduced as part of Microsoft’s secure-by-default initiative.
However, forwarding rules created before that change may still be active. Tenants with customized outbound spam policies created several years ago may also not reflect Microsoft’s current recommended settings.
An employee who configured a rule years ago to forward all company email to a personal Gmail account may still be exporting business information, depending on how the rule was created and whether it predates the policy change.
Two areas should be reviewed.
First, open the Microsoft Defender portal and go to Email & Collaboration > Policies & Rules > Anti-spam policies > Anti-spam outbound policy.
Confirm that the “Automatic forwarding rules” setting is configured as either “Off” or “Automatic – System-controlled.”
Second, audit existing inbox rules across all user mailboxes for configurations that forward messages to external addresses. The Microsoft Purview audit log can be used to search for inbox rule creation events.
Rough time: Approximately 10 minutes to verify the tenant-wide setting. Reviewing existing forwarding rules across all mailboxes will take longer.
3. Historical third-party app consents
Microsoft enabled a Microsoft-managed user consent policy by default in July 2025. The policy prevents users from independently approving most third-party applications that request access to organizational files and SharePoint sites.
New application consent requests are now generally routed to an administrator for review.
However, the change only applies to new requests.
Applications that received user consent before the policy took effect may still retain their original permissions. Those permissions may include the ability to read email, calendars, files, or other Microsoft 365 information on behalf of the user.
Some of these applications may be tools an employee installed years ago and no longer uses. Others may have been approved for a one-time project that no one remembers today.
To review existing application access, go to Microsoft Entra ID > Enterprise Applications > All applications.
Sort the applications by user consent and review which tools currently have permission to access email, files, calendars, or other organizational information.
Applications you do not recognize or no longer need can be revoked from the same area.
Rough time: Approximately 30 to 60 minutes, depending on the number of historical applications in the tenant.
4. Mailbox and tenant audit log retention
Microsoft changed the standard audit log retention period in October 2023.
Microsoft Purview Audit Standard logs are now retained for 180 days, an increase from the previous 90-day default.
Organizations with Microsoft 365 E5 licensing or the Microsoft Purview Audit Premium add-on receive one year of retention for Exchange, SharePoint, OneDrive, and Microsoft Entra ID audit records. Other activity types generally remain available for 180 days.
For organizations in healthcare, financial services, legal services, or another regulated industry, 180 days may not be enough to meet legal, contractual, or compliance obligations.
HIPAA, the FTC Safeguards Rule, and many state bar expectations concerning client information assume an organization can produce records when requested. The relevant retention period may be measured in years rather than months.
Audit retention policies can be found in the Microsoft Purview compliance portal under Audit > Audit retention policies.
Extending retention beyond 180 days requires Microsoft 365 E5 licensing or the Microsoft Purview Audit add-on.
Rough time: Approximately 15 minutes to configure once you have confirmed that your licensing supports the longer retention period.
5. MFA enforcement and Security Defaults
Multifactor authentication enforcement is one of the settings most likely to be inconsistent in older Microsoft 365 tenants.
Microsoft introduced Security Defaults in late 2019. The feature now provides baseline MFA enforcement for newly created tenants. Microsoft also progressively expanded mandatory MFA requirements for administrative actions in the Microsoft 365 admin center and Azure portal throughout 2024 and 2025.
Tenants created before Security Defaults became standard may still have no consistent baseline MFA enforcement.
There is also a common configuration issue involving Conditional Access.
Conditional Access is available with Microsoft 365 Business Premium and higher licensing tiers. When an administrator begins using Conditional Access policies, Microsoft expects the organization to manage MFA through those policies and may require Security Defaults to be disabled.
If the transition is completed too quickly or without proper testing, the tenant can be left with Security Defaults turned off and a Conditional Access policy that does not cover every user.
Review three areas.
First, open the Microsoft Entra ID admin center and go to Properties > Manage Security Defaults. Confirm whether Security Defaults is currently turned on or off.
Second, go to Protection > Conditional Access and confirm that an active policy requires MFA for all appropriate users, including administrators.
Third, pay close attention to emergency or break-glass administrator accounts. These accounts are sometimes excluded from Conditional Access so they remain available during an emergency. If they are excluded without another authentication safeguard, they may be left without MFA protection.
Rough time: Approximately one hour. The review may take longer if the tenant already contains several Conditional Access policies that must be mapped and tested.
A sensible order to roll the changes
Some of these changes are invisible to users. Others will change how employees complete familiar daily tasks.
Begin with audit log retention, setting number four, and the historical third-party application consent review, setting number three. Neither should create a noticeable user-facing impact.
Next, verify external email forwarding, setting number two. This review should also be silent unless an employee is using a legitimate external forwarding rule, which is uncommon.
The SharePoint and OneDrive sharing default, setting number one, is more likely to generate questions. Employees who are accustomed to clicking “Share” and pasting a link into an email may notice that recipients now need to authenticate.
Communicate the change before modifying the tenant-wide sharing setting.
Save the MFA and Conditional Access review, setting number five, for last.
This is the highest-stakes change and the one most likely to lock employees or administrators out of their accounts if it is configured incorrectly. Set aside enough time to map current policies, test the new configuration, and create a clear recovery plan before making broad changes.
Article used with permission from The Technology Press.