You already pay for Business Premium. The controls are off.

The license is not the control

Nearly every adviser we talk to with no on-premises servers is on Microsoft 365 Business Premium. It is the right license. It includes Entra ID P1 for conditional access, Intune for device management, Defender for Business for endpoint detection, Defender for Office 365 for mail filtering, Purview for data protection, and audit logging. The cost is already on your invoice.

What we almost never find is those features turned on in a way that would satisfy an examiner, an underwriter, or an incident responder. The license was bought for Outlook and Teams. The security layer was left at defaults.

Six things to check this week

1. Is MFA enforced, or merely available?

Security defaults or a Conditional Access policy must require MFA for every user, every time, with no legacy authentication protocols allowed. Check whether any account is excluded. Shared mailboxes, service accounts, and the original admin account are the usual gaps.

2. Are devices enrolled and compliant?

Intune should know about every laptop that touches client data, enforce disk encryption, and block access from devices it does not manage. If a staff member can open the firm's SharePoint from a personal laptop with no controls, the firm has no device boundary.

3. Is Defender for Business actually deployed?

Endpoint detection and response is included, but it has to be onboarded to each device. Open the Defender portal and count the devices. If the number is lower than your headcount, the rest are unprotected.

4. Is the unified audit log on and retained?

Regulation S-P's 30-day client notice depends on knowing which mailboxes and files were accessed. Confirm auditing is enabled and that retention covers at least the period your incident response program assumes. The default retention is shorter than most firms expect.

5. Are external sharing and forwarding controlled?

Auto-forwarding to external addresses is how most business email compromise exfiltrates data, and anonymous SharePoint links are how client documents leak. Both can be restricted tenant-wide.

6. Who is a Global Administrator?

It should be two accounts, used only for administration, both protected by phishing-resistant MFA. If your IT provider's everyday account is a Global Admin, so is anyone who compromises it.

Why it matters beyond the tenant

These six settings map directly to the questions on your cyber insurance application and to the safeguards an SEC examiner expects under the amended Regulation S-P. Turning them on does not require new software. It requires someone who understands both the regulation and the tenant to configure, document, and maintain them.

That is the work we do. The assessment reviews every one of these settings against your tenant, and the ongoing engagement keeps them that way and produces the evidence. Request an assessment.