Microsoft 365 Security Hardening for MSPs: The Compliance Baseline That Covers HIPAA, SOC 2, and Cyber Insurance

TLDR: Microsoft 365's default configuration is a starting point, not a compliance posture. This guide covers the specific M365 and Entra ID settings that satisfy HIPAA technical safeguards, SOC 2 CC6 logical access controls, CIS Controls v8 requirements, and cyber insurance carrier checklists — and explains how to package the configuration work as a recurring, revenue-generating MSP service.

If you manage five clients, you probably manage five Microsoft 365 tenants. If you manage fifty, you manage fifty. And in most of those environments, the same handful of security gaps are sitting in the same places: legacy authentication still enabled, no Conditional Access policies, DMARC not enforced, unified audit logging never turned on.

The irony is that M365 already contains the controls needed to close most of these gaps. They just are not on by default. For MSPs, the gap between what ships in the box and what compliance actually requires is the service opportunity.

Why M365 Is the Highest-Impact Security Target in Your Portfolio

Microsoft 365 has approximately 345 million paid subscribers globally, making it the dominant productivity suite in virtually every industry vertical you serve ([Microsoft 365 Statistics, Medha Cloud, 2026](https://medhacloud.com/blog/microsoft-365-statistics-2026)). That ubiquity makes it the highest-value attack target in your clients' environments — and the highest-value configuration target for you.

The threat picture has sharpened. In October 2025 alone, Microsoft Defender for Office 365 blocked more than 13 million phishing emails linked to the Tycoon2FA phishing kit, including campaigns specifically designed to bypass MFA through adversary-in-the-middle token theft ([Microsoft Security Blog, January 2026](https://www.microsoft.com/en-us/security/blog/2026/01/06/phishing-actors-exploit-complex-routing-and-misconfigurations-to-spoof-domains/)). M365 is not just a productivity platform — it is the primary identity and email attack surface for the majority of your clients.

The MFA Gap: Still the Biggest Exposure in Most Tenants

MFA is the single highest-value M365 security control. Microsoft's own research demonstrates that MFA blocks more than 99.9% of automated account compromise attacks ([Microsoft Security Blog](https://www.microsoft.com/en-us/security/blog/2019/08/20/one-simple-action-you-can-take-to-prevent-99-9-percent-of-account-attacks/)). It is, by a wide margin, the most effective preventive control at the identity layer.

Despite this, enforcement gaps are widespread. Research from Expert Insights found that only 13% of SMBs enforce MFA everywhere, while 54% have no MFA protecting core accounts at all ([Expert Insights, 2025](https://expertinsights.com/user-auth/multi-factor-authentication-statistics)). The smaller the clients you serve, the more likely they fall into that 54%. For MSPs managing SMBs, enforcing MFA across every tenant is both the most immediate security improvement you can deliver and the one most frequently not yet done.

Identity Hardening in Entra ID: The Non-Negotiables

Security Defaults in Entra ID provide a baseline MFA requirement for all users and block legacy authentication protocols. For tenants without existing Conditional Access infrastructure, enabling Security Defaults is the right starting point.

For tenants with Microsoft 365 Business Premium or Azure AD P1/P2 licensing, Conditional Access policies give you granular control. The baseline policy set that satisfies HIPAA, SOC 2, CIS v8, and cyber insurance requirements includes:

**Require MFA for all users.** No exclusions for shared accounts or service accounts that can be phished. If a protocol does not support modern authentication, it should not be allowed.
**Block legacy authentication.** Basic auth — SMTP AUTH, IMAP, POP — is the most common vector for password spray attacks. Blocking it eliminates a significant attack class entirely.
**Require compliant or Hybrid Azure AD-joined devices.** For healthcare and financial clients, this ensures only managed devices can access email and cloud resources — a requirement under HIPAA and SOC 2 CC6.
**Risk-based Conditional Access via Entra ID Protection.** These policies block or require step-up MFA when the service detects anomalous sign-in behavior — compromised credentials, impossible travel, known attacker infrastructure.
**Privileged Identity Management for admin roles.** Global Administrator and other privileged roles should use phishing-resistant MFA and just-in-time access via PIM. Persistent standing admin sessions are a primary attack target.
**Restrict guest and external collaboration.** Review External Collaboration Settings in Entra and restrict B2B sharing to required partner domains only. Unrestricted external sharing is a leading SOC 2 audit finding.

Email Security: The Configuration Most Tenants Get Half Right

Email authentication — SPF, DKIM, and DMARC — is foundational, but incomplete configurations are the norm. Many tenants have SPF and DKIM records configured but no DMARC policy, meaning domain spoofing still reaches recipients without enforcement action.

A complete email security baseline includes:

**DMARC policy set to quarantine or reject.** Without a DMARC policy, SPF and DKIM provide alignment visibility but no protection. Enforcing reject prevents spoofed messages from being delivered to your clients' users — and prevents your clients' domains from being used to spoof others.
**Microsoft Defender for Office 365 anti-phishing policies.** Enable spoof intelligence, impersonation protection for executive and high-risk user accounts, and advanced phishing thresholds. The default policies are a starting point; custom policies covering specific domains and common impersonation targets are more effective.
**Safe Attachments and Safe Links.** Detonation sandboxing for attachments and URL rewriting with time-of-click scanning for links are included in Microsoft 365 Business Premium and Defender for Office 365 Plan 1. Set the action to block, not monitor — monitor mode is useful for auditing, not for protecting clients.
**Attack Simulator for phishing training.** Microsoft's built-in phishing simulation and security awareness training is included in Business Premium. Running quarterly simulations with automatic training enrollment for users who click is a documented training program requirement under HIPAA, SOC 2, and most cyber insurance policies.

Data Protection: DLP, Sensitivity Labels, and Audit Logging

Data Loss Prevention policies in Microsoft Purview identify and protect sensitive data — PHI identifiers, Social Security numbers, credit card numbers — across Exchange Online, SharePoint, OneDrive, and Teams. For healthcare clients, HIPAA-specific DLP templates block or warn when ePHI is shared externally without authorization. These templates map directly to the HIPAA technical safeguard for transmission security (45 CFR 164.312(e)).

Sensitivity labels apply persistent encryption and rights management to documents and emails at the point of classification. For HIPAA and SOC 2, labels that encrypt PHI or PII provide a technical safeguard that survives the document leaving M365's boundaries — critical when clients share records with external partners or business associates.

Unified Audit Log must be verified as active for every tenant. The audit log is the primary evidence source for SOC 2 CC7 monitoring controls, HIPAA audit control requirements (45 CFR 164.312(b)), and incident investigation evidence that cyber insurance carriers and auditors request after a breach. Confirm it is on and that log retention settings match each client's compliance obligations.

Retention policies and Legal Hold satisfy SOC 2 availability criteria and HIPAA's six-year record retention requirement. Configure email and Teams message retention policies aligned to each client's regulatory obligations before an incident — not after.

How M365 Hardening Maps Across HIPAA, SOC 2, CIS v8, and Cyber Insurance

For clients managing multiple frameworks simultaneously, the same M365 controls produce compliance evidence across all of them:

**MFA via Conditional Access** maps to HIPAA 164.312(d) person or entity authentication, SOC 2 CC6.1 logical access, CIS v8 Control 6 (IG1), and the MFA requirement now near-universal across cyber insurance carriers.
**Blocking legacy authentication** maps to HIPAA 164.312(a)(1) access control, SOC 2 CC6.1, and CIS v8 Control 4.8.
**Safe Attachments and Safe Links** map to HIPAA 164.306(a)(1) risk management, SOC 2 CC6.7, and CIS v8 Control 9.7.
**DMARC enforcement** maps to HIPAA 164.306(a)(1), SOC 2 CC6.7, and CIS v8 Control 9.5.
**DLP policies for PHI and PII** map to HIPAA 164.312(e)(1) transmission security, SOC 2 CC6.7, and CIS v8 Control 3.7.
**Unified Audit Log** maps to HIPAA 164.312(b) audit controls, SOC 2 CC7.2, and CIS v8 Control 8.2.

This multi-framework mapping is what makes M365 hardening a high-leverage compliance project. The same configuration pass delivers evidence-ready controls across frameworks simultaneously. For clients building toward SOC 2 readiness, the M365 work directly covers the CC6 logical access criteria — see the SOC 2 compliance checklist for MSPs for the full framework mapping. And for clients subject to CJIS — law enforcement agencies and criminal justice technology vendors — the identity hardening and audit logging controls above satisfy significant portions of the CJIS Security Policy access control and audit requirements. See the CJIS compliance guide for MSPs for the complete breakdown.

Packaging M365 Hardening as a Recurring MSP Service

M365 security hardening is most valuable as a structured, documented service — not a one-off configuration pass that drifts over time as Microsoft adds features, client operations change, and new attack techniques emerge. A practical service structure:

**M365 Security Assessment ($1,500–$3,000 project).** Evaluate a client's tenant against the baseline controls above. Deliver a gap report with prioritized remediation recommendations and a compliance mapping against whichever frameworks apply to that client. This is a natural starting point for new client onboarding and a defensible assessment for clients preparing for a HIPAA audit or SOC 2 examination. See how [MSP security assessments](/msp-security-assessment) fit into a broader compliance delivery model.
**M365 Hardening Implementation ($2,000–$5,000 project).** Implement the Conditional Access policy set, email authentication stack, DLP policies, sensitivity label taxonomy, audit log configuration, and retention policies. Deliver a configuration runbook documenting every setting and the compliance rationale behind it.
**Quarterly M365 Security Review ($300–$600/quarter).** Review Secure Score trends, failed sign-in anomalies, guest access sprawl, new risky third-party app grants, and alert policy outputs. Update policies when Microsoft releases new controls or when a client's operations change. Deliver a one-page summary at QBRs showing posture improvement over time.

Bundled into a broader compliance program, M365 hardening becomes the technical foundation that makes every other framework deliverable possible. A client cannot claim to have implemented HIPAA technical safeguards without configuring their largest productivity and email platform. The configuration work is the compliance work — which means the compliance revenue starts here.

For a complete view of how to structure compliance assessments and recurring services across your client portfolio, explore the MSP compliance services model.

*Ready to run M365 security posture assessments across your full client portfolio from a single multi-tenant dashboard — and map the findings to HIPAA, SOC 2, CIS v8, and cyber insurance requirements automatically? Start free with Nuronus — 2 clients, no credit card required.*