Assessment
We review Secure Score recommendations, sign-in and audit logs, existing policies and licences. You receive a prioritised list of risks and a clear answer on what will work with your plan and what needs Business Premium.
Microsoft 365 security
Most incidents in companies start with a forged email or a stolen password. We turn on the Microsoft 365 protections that are already part of your licence but off by default, and maintain them continuously: MFA, Conditional Access, Defender, Intune and Purview.
Built for ISO 27001NIS2 DORA
- MFA for everyone
- Conditional access
- Defender for Office 365
Protection you already pay for but have not turned on
- 100 % of users with MFA, the first and mandatory step
- Secure Score measured before and after each stage
- Premium Defender, Intune, Entra ID P1 and Purview together
- NIS2 / DORA settings documented as compliance evidence
Microsoft is responsible for the platform running, while you are responsible for your tenant's settings, access and data. In the environments we take over, the picture repeats: MFA is on for only some employees, administrators use the same account for daily work, the mail filter runs on defaults, and the fact that someone signed in from another country and forwarded accounting emails to an external address is discovered weeks later. Meanwhile a Business Premium licence with Defender, Intune and Purview is already paid for, but nobody has configured them.
The Microsoft 365 security service starts with an assessment of Microsoft Secure Score and sign-in logs. Then we turn on protections according to risk level: MFA for everyone, Conditional Access by device and location, Defender for Office 365 protection against malicious links and attachments, Defender for Business for computers, Intune policies for devices, Purview DLP rules and sensitivity labels, separate administrator accounts and external sharing restrictions. We first test every change with a pilot group so that protection does not stop work. What exactly can be turned on depends on the licence, so before starting we tell you what will work with your plan and what will need Business Premium. After deployment the settings do not run on autopilot: we respond to Defender alerts, review Secure Score monthly and document the state so that you can present it to a NIS2 or ISO 27001 auditor.
What we enable
Measures that stop the most common real incidents: account takeover, phishing emails and data leaks.
MFA for everyone
Microsoft Authenticator, FIDO2 keys or passkeys for all users, SMS only as a temporary exception. Legacy protocols (basic auth) are disabled.
Conditional access
Entra ID P1 rules: sign-in only from managed devices, risky sign-ins blocked, MFA every time for administrators.
Defender for Office 365
Safe Links and Safe Attachments check links and attachments in emails, Teams and SharePoint, and anti-phishing policies protect executive and accounting addresses from impersonation.
Defender for Business
Protection for computers and servers with endpoint detection and response (EDR), automatic isolation and a vulnerability list in a single Defender portal.
Intune policies
Disk encryption, update schedules, an app list and remote data wipe on a lost computer or phone.
Purview DLP and labels
Sensitivity labels for documents and emails, and DLP rules that stop personal ID numbers, cards or contracts from being sent outside the organisation.
Administrator protection
Separate named administrator accounts, least privilege, just-in-time privileged access (PIM) with Entra ID P2 and a break-glass account kept in a safe.
Audit and monitoring
A unified audit log, alerts for forwarding rules and unusual sign-ins, and phishing simulations for employees every quarter.
What works with your licence
Microsoft 365 business plans up to 300 users and the security features they include.
| Business Basic | Business Standard | Business Premium | |
|---|---|---|---|
MFA and security defaults | |||
Conditional Access (Entra ID P1) | |||
Defender for Office 365 P1 (Safe Links, Safe Attachments) | |||
Defender for Business (EDR for computers) | |||
Intune device management | |||
Purview DLP and sensitivity labels | |||
Audit log and Secure Score | |||
External sharing rules |
How we implement it
In stages, starting from the biggest risk, with a pilot group before every change.
Identity protection
We turn on MFA for everyone, disable legacy protocols, and create separate administrator accounts and Conditional Access rules. We send employees instructions in advance, and in the first week the helpdesk helps register Authenticator.
Mail, devices, data
We configure Defender for Office 365 and Defender for Business, enrol devices in Intune, apply encryption and update policies, and create sensitivity labels and DLP rules, initially in monitoring mode only.
Maintenance
We respond to Defender and Entra ID alerts, run phishing simulations every quarter, and review Secure Score and Microsoft changes. Every month you receive a report with incidents and the state of the settings, suitable for a NIS2 or ISO 27001 audit.
Protection does not stop deletion and encryption
Defender stops most attacks, but emails and files deleted by mistake or encrypted by ransomware are not restored by Microsoft after the retention period. A security project is completed by separate Microsoft 365 backup in our data centre in Lithuania (EU).
Frequently asked questions
We have Business Standard. Is it worth switching to Premium?
If you want Conditional Access, Defender for Office 365, Defender for Business, Intune or DLP, yes. Premium includes all of that in one licence, and it is usually cheaper than buying add-ons separately. If MFA, auditing and sharing rules are enough, you can stay on Standard. We change licences through the MDP CLOUD CSP agreement, and you can switch just some of the users.
Will MFA disrupt work?
Properly configured, no. On managed company devices confirmation is rarely requested, and stricter checks apply only to risky sign-ins: from a new device, another country or at an unusual time. Most questions come in the first week, and we allocate helpdesk time for that.
What happens when Defender detects an incident?
Our engineers receive the alert, the device or account is isolated automatically when necessary, and we check the scope, remove the cause and inform you. After an incident we provide a short write-up that you can use for reporting under NIS2 requirements.
Do we also need a separate antivirus?
With Business Premium, Defender for Business covers computers and servers, and no separate product is needed. If you have Basic or Standard and do not plan to change plans, we protect computers with Bitdefender GravityZone or another EDR solution.
Do these settings fit NIS2, ISO 27001 and DORA?
Yes. MFA, access control, device policies, auditing and incident logging are common elements of these requirements. We document what is turned on and why, and we carry out the compliance assessment against NIS2 and ISO 27001 requirements with ISACA-certified specialists.
Related services
Microsoft Entra ID
We manage your company's identities in Microsoft Entra ID: single sign-on to Microsoft 365 and other systems, MFA for everyone, conditional access…
Microsoft Power Platform
We build business apps and automate processes with Microsoft Power Platform tools, most of which are already in your Microsoft 365 licence.
Expertise confirmed by certifications
This service is delivered by specialists with valid international certifications. Their expertise is confirmed by independent organisations, not by us.
-
Certified Information Security Manager
Security governance, policies and incident processes following the ISACA methodology.
-
Lead Cloud Security Manager
Cloud security is managed following ISO/IEC 27017 and 27018 practices.
-
Certified in Risk and Information Systems Control
Risks are assessed and controlled using the international IT risk methodology.
Get a quote for Microsoft 365 security
Tell us which plans and how many users you have, and we will send a quote with the scope of the Secure Score assessment within 1 business day.
We reply within 1 business day