On a Monday morning, the accountant gets an email from the "CEO" asking for an urgent wire transfer. It comes from the CEO's real mailbox: someone stole the password the week before and signed in with nothing to stop them. The company had been paying for Microsoft 365 for years. It just never configured it.
Microsoft 365 security for business depends less on the license you buy and more on what you switch on afterwards. The reviews we run keep turning up the same gaps: MFA applied halfway, Conditional Access left unused, documents with no classification, no data loss rules, and SharePoint permissions open to the whole company. That last one became urgent with Copilot, which answers using everything each user can see.
Here is each setting, along with the license it needs.
1. MFA for everyone, not just admins
Microsoft already requires MFA to get into its admin portals. According to its mandatory MFA documentation, enforcement started in October 2024 for the Azure portal, the Entra admin center and the Intune admin center, and reached the Microsoft 365 admin center in February 2025. That protects whoever runs the tenant. The CEO's mailbox and the finance folder are still exposed.
For everyone else you have two options:
- Security defaults, which come with every subscription at no extra cost. They make all users register for MFA, prompt admins on every sign-in and block legacy authentication protocols. Microsoft describes them in its security defaults guide.
- Conditional Access, which is more flexible and needs another license (next section).
One detail people forget: legacy authentication (old mail clients, printers that send over SMTP with a username and password) can't do MFA. If you don't block it, an attacker can walk in that way even when everything else is locked down.
2. Conditional Access instead of one rule for everybody
Conditional Access lets you decide who gets in, from where, on which device and with which method. For example: require phishing-resistant MFA for admins, block sign-ins from countries where you don't operate, or allow email on personal phones only through approved apps.
It requires Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium and Microsoft 365 E3. Policies based on sign-in risk need Entra ID P2 (included in E5).
Two warnings. Conditional Access and security defaults don't mix: to create your own policies you have to turn security defaults off, and at that point you should immediately enable the Microsoft-managed policies that cover the same ground. And test every new policy in report-only mode first. One badly written rule can lock the whole company out, IT included.
3. Sensitivity labels
Until a document is classified, the system can't treat it any differently from the cafeteria menu. Microsoft Purview sensitivity labels mark each file or email (say, Public, Internal, Confidential) and can apply encryption, watermarks or sharing restrictions.
According to the Business Premium documentation, that plan includes labels for email, files and Teams meetings. In Microsoft's enterprise plan comparison, E3 allows manual labeling and E5 adds automatic labeling.
We suggest starting with three or four labels. Give people twelve options and they'll pick one at random, or none.
4. Data loss prevention (DLP)
Labels say what's sensitive. DLP decides what happens when someone tries to send it out: an email with national ID and bank account numbers going to an outside address, a payroll spreadsheet shared through a public link. The policy can warn the user, ask for a justification or block the action.
Business Premium includes DLP for email and files, and E3 has the core capabilities. Purview also now supports DLP policies for Copilot that keep sensitive content out of what the assistant uses to answer.
For companies in Chile there's one more reason. Law 21.719 requires security measures proportionate to the risk of processing personal data. It is still set to take effect on December 1, 2026: the bill that would push it to December 2027 was approved in general by the Senate Constitution Committee, but it isn't law yet. A documented DLP policy is concrete evidence of those measures.
5. Review SharePoint permissions before turning on Copilot
This is where we find the most surprises. Microsoft says so in its Copilot readiness guide: by default, SharePoint sets sharing to the most permissive option. Over the years you pile up sites open to "everyone except external users", links nobody revokes and folders that inherited permissions they shouldn't have.
Before Copilot, that mess stayed hidden because nobody went looking. Copilot does look, and it answers with any file the user can access. If the salary spreadsheet sits on an open site, all it takes is someone asking about it.
To clean it up, Microsoft offers:
- Data access governance reports in the SharePoint admin center, showing overshared sites, sharing links and permissions per site.
- Restricted content discovery, which keeps specific sites out of Copilot answers while you review them.
- Access reviews delegated to site owners, who know better than IT who should be in there.
These features are part of SharePoint Advanced Management, which Microsoft says comes with the Microsoft Copilot license (the product formerly called Microsoft 365 Copilot) or can be bought as an add-on. We go deeper in Copilot data security.
Summary: which license each setting needs
| Setting | What it prevents | Minimum license (per Microsoft Learn) |
|---|---|---|
| MFA with security defaults | Credential theft | Any subscription |
| Conditional Access | Sign-ins from untrusted places or devices | Entra ID P1 (Business Premium, E3) |
| Sensitivity labels | Sensitive files handled like any other | Business Premium or E3 (manual); E5 (automatic) |
| DLP | Personal data sent or published | Business Premium or E3 (core); E5 (broader coverage) |
| SharePoint permission review | Copilot surfacing what it shouldn't | Reports via SharePoint Advanced Management (included with Copilot or as an add-on) |
One more note on email: since July 1, 2026, Defender for Office 365 Plan 1 (Safe Links, Safe Attachments and advanced phishing protection) is included in Microsoft 365 E3 and Office 365 E3, as well as Business Premium. If you're on one of those plans, you're probably already paying for it. What's left is checking that it's configured.
Frequently asked questions
Are security defaults enough?
For a small company without Entra ID P1, they're a good start. If you have Business Premium or E3, Conditional Access gives you more control and the move is worth it.
Do I need Microsoft 365 E5 to protect my information properly?
Not necessarily. Business Premium and E3 cover MFA, Conditional Access, manual labels and core DLP. E5 adds automation and risk-based detection.
Why review SharePoint before Copilot and not after?
Because Copilot answers with everything each user can see. If permissions are too open, the assistant can surface those documents from day one.
How we work at Disrupsoft
We start with an assessment of where your tenant stands today. Then we define identity, access and data policies, roll them out with the Microsoft Security tools your license already includes, and keep up monitoring and incident response. If you want to know which of these five settings you're missing, take a look at our security service and let's talk.
