The security baseline
Most Microsoft 365 tenants still run on default settings. Ours don't. Every managed customer gets the same tested, layered set of protections across accounts, devices and data, applied from day one and kept current.
- NCSC device security guidance
- CIS Benchmarks
- Microsoft Zero Trust principles
Six layers, one standard
Each layer covers a different way attackers get in. Together they mean one mistake, a clicked link or a lost laptop, doesn't become a breach.
Identity
Stops stolen passwords being enough to get in.
- Multi-factor authentication on every account
- Older sign-in methods that skip MFA shut off
- Sign-ins blocked from countries you don't operate in
- Sessions re-checked, so a stolen login doesn't last
Device trust
Stops company data reaching devices you don't control.
- Only managed, healthy devices reach company data
- Unknown and unsupported devices turned away
- Unmanaged browsers can't stay signed in
Hardened Windows and Mac
Stops a lost laptop or a bad download becoming a breach.
- Full disk encryption on every device
- A locked-down configuration based on recognised guidance
- Built-in protection for saved passwords and credentials
- Devices can be wiped remotely if lost or stolen
Threat protection
Stops malware and ransomware spreading unnoticed.
- Microsoft Defender for Business on every device
- Email checked for phishing, bad links and attachments
- Your domain protected against spoofed email
- Updates rolled out on a tested schedule
Admin protection
Stops one compromised account taking over everything.
- Admin rights kept to the few people who need them
- Separate admin accounts, never used for email
- Phishing-resistant sign-in required for admins
Phones and guests
Stops company data leaking out through apps and sharing.
- Company data in Outlook and Teams protected on personal phones
- Work data can be wiped without touching personal photos
- Guests only see what's been shared with them
- Files can't be shared publicly by accident
What it means day to day
Security is easier to judge by what happens when something goes wrong.
- Someone falls for a phishing email
- The attacker has a password but no second factor, so they can't sign in.
- A laptop is left on a train
- The disk is encrypted and we can wipe it remotely. Your data stays safe.
- A sign-in comes from abroad
- It's blocked, unless you've told us someone is travelling.
- A staff member uses their own phone
- Work email and files stay inside protected apps, and can be removed if they leave.
- An admin account is targeted
- It's separate from everyday email and needs phishing-resistant sign-in, so it's a much harder target.
Rolled out without locking anyone out
Strong security only works if your team can still get their work done. Every rollout follows the same careful steps.
-
Assess
We review your tenant, devices and how people actually sign in, including travel, shared accounts and older kit.
-
Test quietly
Policies run in monitor-only mode against real sign-ins first, so we catch anything that would break before it's switched on.
-
Switch on in stages
A small pilot group goes first, then everyone else. We tell your team what will change and when.
Standard, not an add-on
Security that's sold as an extra tends to get skipped when budgets are tight. Building it into the monthly service means every customer is protected to the same level, and we can support everyone consistently.
The baseline uses tools already included in Microsoft 365 Business Premium, so you get more from licences you're already paying for.
We don't publish the exact configuration. It's tuned to each customer, and keeping the detail private is part of keeping you safe.
A head start on Cyber Essentials
The baseline covers the same areas Cyber Essentials checks: secure configuration, user access control, malware protection, security updates and firewalls.
If you need certification for a contract or tender, we can help you prepare using project time.
Start with a no-obligation baseline review
No obligation, no hard sell. Tell us about your IT and we'll come back to you.