Microsoft has steadily tightened default security across Microsoft 365. New tenants now come with stronger protections out of the box than environments created a few years ago. The catch is that older configurations do not automatically update. When Microsoft changes a default, it applies only to new tenants. Existing settings, user consents, inbox rules, and sharing links all remain in place unless someone actively reviews and updates them.
Below are five areas worth reviewing, especially if your tenant is more than a couple of years old, was set up by a prior IT provider, or has not been audited recently.
Before getting into the list, keep a few things in mind. Some settings require Business Premium, E3, or E5 licensing, so if an option is unavailable, licensing is usually the reason. Also, a few changes will affect how your team works today and may generate support requests. There is no need to roll everything out at once.
1. Default sharing links in SharePoint and OneDrive
When users share files, the default link type determines who can access them. Older tenants often default to “Anyone with the link,” meaning the file can be opened by anyone who has the URL, without authentication or tracking.
Newer environments typically default to “Only people in your organization,” but older sites and tenant level settings may still allow open sharing. That creates risk. For example, a document shared months ago could still be accessible externally if the link was never revoked.
Review this setting in the SharePoint admin center under Policies > Sharing. Changing the default to “Specific people” ensures new links require authentication. You can also set expiration limits on any remaining open links.
2. External email forwarding
Microsoft now blocks automatic forwarding to external email addresses by default as part of its secure by default initiative. However, older rules or custom configurations may still allow it.
A user who created a forwarding rule years ago may still be sending copies of all email to a personal account.
Check the outbound spam policy in the Microsoft Defender portal under Email and Collaboration > Policies and Rules > Anti spam policies. Confirm that automatic forwarding is disabled or system controlled.
Then review existing inbox rules for users to identify any forwarding to external addresses. The Purview audit log can help track when those rules were created.
3. Historical third party app access
As of July 2025, Microsoft introduced stricter controls on user consent for third party applications. New requests now require admin approval.
The issue is older permissions. Applications granted access in the past still retain whatever permissions they were given. This can include access to mail, calendars, and files.
Review these in Entra ID under Enterprise Applications. Sort by user consent and look for anything that no longer serves a purpose. Unused or unknown apps should be removed.
4. Audit log retention
Audit log retention increased to 180 days in October 2023 for standard logging. With E5 or the Purview Audit add on, some workloads extend to one year.
For many organizations, especially in healthcare, legal, or financial services, these defaults may not meet compliance requirements. Retention expectations are often measured in years.
Audit retention policies are managed in the Purview compliance portal. If longer retention is required, licensing upgrades may be needed before making changes.
5. MFA enforcement and Security Defaults
Multi factor authentication is one of the most critical controls, and it is often inconsistent in older tenants.
New tenants typically have Security Defaults enabled, which enforces MFA automatically. Older tenants may not. There is also a common gap when Conditional Access policies are introduced. Enabling Conditional Access can disable Security Defaults, and if policies are not fully configured, some users may be left without MFA protection.
Review the following:
- Security Defaults status in Entra ID Properties
- Conditional Access policies to ensure MFA is enforced for all users
- Any admin or break glass accounts that may be excluded
This is the highest risk area, so changes should be planned and tested carefully.
Recommended rollout order
Some of these changes are invisible to users, while others will impact daily workflows.
Start with audit log retention and third party app review since they do not affect users directly.
Next, verify external forwarding settings.
Then address sharing defaults, making sure to communicate changes in advance.
Finally, review MFA and Conditional Access, as this requires the most care and planning.
FAQs
Are newer Microsoft 365 tenants fully secure by default?
They are more secure than older setups, but still require review. Items like user permissions, sharing behavior, and legacy rules should always be checked.
Is “Anyone with the link” still allowed?
Some tenants still allow it. Newer environments typically restrict this, but both tenant and site level settings should be reviewed.
Is external forwarding disabled by default?
Yes, at the tenant level. Older rules may still exist and should be audited.
How long are audit logs retained?
Standard retention is 180 days. With the right licensing, some data can extend to one year.
Does Security Defaults cover everyone?
In new tenants, yes. In older environments using Conditional Access, coverage depends entirely on how policies are configured.