6 min read
Hardening Microsoft 365 without breaking sign-in
A practical sequence for enabling phishing-resistant MFA, blocking legacy authentication, and restricting external forwarding in Entra ID and Exchange Online.
Start with visibility, not lockouts
The biggest mistake teams make when hardening Microsoft 365 is flipping a Conditional Access policy from Off to On without checking which service accounts, copiers, or executives still rely on legacy flows.
Before enforcing any policy, create two cloud-only emergency access (break-glass) Global Administrator accounts protected by FIDO2 hardware keys and excluded from Conditional Access.
Step 1: Require phishing-resistant MFA for administrators
Standard push notifications can be bypassed by adversary-in-the-middle (AiTM) reverse-proxy phishing kits. Require FIDO2 security keys, Windows Hello for Business, or Authenticator number-matching for all built-in Entra ID admin roles.
Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess" New-MgIdentityConditionalAccessPolicy -DisplayName "Require Admin Phishing-Resistant MFA" -State "enabledForReportingButNotEnforced"
Step 2: Block legacy authentication protocols
IMAP, POP3, and older Office clients do not support modern MFA. Over 90% of successful password-spray attacks against Microsoft 365 enter through legacy protocols.
Set-OrganizationConfig -DefaultAuthenticationPolicy "Block-Legacy-Auth"
Free tool
Look up your Microsoft 365 tenant and public mail records →No sign-up required. Free Pistos Pharos utility.