Microsoft 365 Security Hardening Guide for Financial Firms 2026

If your Microsoft 365 tenant is still running on default settings, your firm is not meeting the baseline that SEC examiners, FINRA auditors, and cyber insurers now expect.

Out of the box, Microsoft 365 is built for ease of use and broad compatibility.

That design leaves real gaps: legacy authentication protocols that bypass MFA, unrestricted external sharing in SharePoint, no retention policies on Teams chats, and standing admin accounts that create unnecessary exposure.

Hardening your Microsoft 365 environment is one of the highest-leverage actions a financial firm can take to reduce breach risk, pass audits, and satisfy cyber insurance underwriters in 2026.

The controls available in the platform are genuinely strong.

The problem is that almost none of them are on by default.

A new tenant with default settings scores around 30 to 35 percent in Microsoft Secure Score, meaning roughly two-thirds of available security controls are switched off.

This guide maps the configurations that matter most to RIAs, broker-dealers, and financial advisors.

The focus is on identity, email, data protection, endpoints, and logging because those are the areas where firms face actual exam gaps, business email compromise losses, and cyber insurance claim disputes.

Key Takeaways

• Identity hardening through MFA enforcement and conditional access is the single most effective step for reducing account takeover risk at financial firms.

• Email authentication, anti-phishing policies, and blocking external mail forwarding directly address business email compromise, the leading cyber threat for advisory and broker-dealer firms.

• Logging, retention, and data protection configurations are what regulators and cyber insurers actually examine, and most default settings fail those checks.

Why Default Microsoft 365 Settings Fall Short For Financial Firms

Default Microsoft 365 settings prioritize usability and compatibility over security.

For a financial firm subject to SEC Regulation S-P, FINRA cybersecurity expectations, GLBA, or NYDFS, that tradeoff creates compliance and liability exposure that does not show up until an exam or an incident.

How Attackers Exploit Identity, Email, And File Sharing Gaps

Legacy authentication protocols like POP, IMAP, and SMTP AUTH are enabled by default and bypass MFA entirely.

Attackers know this.

Most credential-stuffing campaigns targeting financial firm mailboxes specifically probe for tenants where legacy auth is still active.

External sharing in SharePoint and OneDrive defaults to permissive settings, allowing files to be shared with anyone using a link.

That default directly conflicts with nonpublic personal information protections required under Regulation S-P.

Auto-forwarding rules to external domains are also allowed by default.

Business email compromise attacks frequently end with the attacker creating a quiet forwarding rule that redirects all client communications to an external inbox.

Exfiltration via auto-forward is one of the most documented BEC outcomes in the financial sector.

Why Regulators And Cyber Insurers Expect More Than Default Settings

SEC and FINRA cybersecurity exams increasingly ask for documentation of specific controls: MFA enforcement, audit logging retention, access reviews, and incident response procedures.

Cyber insurers are asking the same questions on renewal questionnaires, and firms running on defaults often cannot answer them accurately.

Microsoft 365 compliance requirements for financial institutions have grown more specific in 2026, with examiners looking for evidence of data retention controls, endpoint management, and email authentication records.

Default settings were not designed with exam evidence in mind.

They were designed to get a tenant functional on day one.

How Hardening Supports SEC, FINRA, GLBA, And NYDFS Readiness

Microsoft 365 contains built-in tools that map directly to regulatory requirements when configured properly.

Retention policies cover FINRA Rule 4511 electronic recordkeeping.

Sensitivity labels and DLP policies support Regulation S-P data protection requirements.

Unified audit logging supports the evidence collection that examiners request.

Hardening is not about buying additional software.

It is about activating and configuring what is already in your tenant to meet the standards your regulators and insurers expect.

Build The Identity Security Baseline First

Identity is where most financial firm breaches start and where the highest-value controls live.

Enforcing MFA for every account, moving privileged users to phishing-resistant authentication, and setting up break-glass accounts correctly eliminates the most common

account takeover paths in a single configuration pass.

Require MFA For Every User And Every Admin

Use Microsoft Entra ID Conditional Access to enforce MFA on every sign-in for every user, including shared mailboxes and service accounts where technically feasible.

Do not rely on per-user MFA legacy settings or Security Defaults if you have Entra ID P1 or higher licensing.

Conditional Access gives you policy-level control and per-application enforcement that Security Defaults cannot match.

Every admin account must require MFA unconditionally.

Conditional Access policies targeting the "Directory Roles" condition are the cleanest way to enforce this.

Weak or missing MFA on administrator accounts remains the most common gap identified in Microsoft 365 security assessments.

Prefer Phishing-Resistant Authentication For Privileged Accounts

Authenticator app push notifications with number matching are a solid baseline, but FIDO2 security keys or Windows Hello for Business provide stronger protection because they are bound to a specific device and cannot be intercepted by a real-time phishing proxy.

For firm principals, compliance officers, and IT administrators, phishing-resistant MFA is not optional.

NYDFS and SEC guidance increasingly references this distinction.

Certificate-based authentication is another option for firms already operating a PKI infrastructure.

SIM swap attacks have compromised SMS-based MFA at several advisory firms.

If any accounts still use SMS as the only second factor, that needs to change before any other hardening work.

Use Break-Glass Accounts Without Creating New Risk

Every Entra ID tenant needs at least two break-glass accounts excluded from Conditional.

Access policies for emergency access when the primary admin accounts are locked out.

These accounts should use long, randomly generated passwords, be excluded from MFA policies by design, and trigger an alert any time they are used.

Store break-glass credentials offline, limit knowledge of them to a very small group, and audit them on a schedule.

Break-glass accounts are a necessary control gap.

The answer is tight monitoring, not elimination.

Design Conditional Access Around Firm Risk

Conditional Access is the policy engine that ties identity, device trust, location, and sign-in risk into a unified set of access rules.

A financial firm without Conditional Access policies is relying on passwords and MFA alone without any context-aware enforcement.

That is insufficient for a regulated environment in 2026.

Create Core Conditional Access Policies For All Users

Start with a small set of firm-wide policies before building out more targeted rules.

The core set should include: require MFA on all sign-ins, block sign-ins from countries the firm does not operate in using named locations, and block downloads to unmanaged devices for sensitive applications.

Microsoft's Conditional Access policy planning guidance recommends designing policies around personas rather than broad blanket rules.

For financial firms, the most useful personas are all users, admins, and external vendors or guest accounts.

Note that Microsoft retired the "Require approved client app" Conditional Access grant control in June 2026.

Any policies using that condition need to be migrated to app protection policies immediately if they have not already been.

Restrict Access By Device, Location, And Sign-In Risk

Require compliant or hybrid-joined devices for access to sensitive applications including Exchange, SharePoint, and any financial planning tools integrated with the tenant.

This control significantly reduces the risk from personal or unmanaged devices accessing client data.

Entra ID P2 includes Identity Protection, which generates sign-in risk scores based on impossible travel, unfamiliar sign-in properties, and leaked credentials.

Create a Conditional Access policy that blocks high-risk sign-ins until the risk is investigated and cleared.

This is also a commonly requested control on cyber insurance applications.

Use Named Locations Carefully Without Weakening Security

Named locations let you define trusted IP ranges and countries.

Used correctly, they let you reduce MFA friction for on-premises office access while blocking access from unexpected regions entirely.

The risk is over-trusting named locations.

If your firm's office IPs are marked as trusted and an attacker pivots through a compromised network device on your premises, the named location policy stops providing protection.

Use named locations to block unfamiliar countries, not to bypass MFA on trusted networks.

Block Legacy Access And Reduce App Consent Risk

Legacy authentication and unchecked app consent are two of the most exploited weaknesses in Microsoft 365 tenants.

Both are easy to address, and both remain active in many financial firm environments because no one has explicitly turned them off.

Disable Basic And Legacy Authentication Protocols

Create a Conditional Access policy that blocks all legacy authentication protocols for all users with no exceptions.

Legacy authentication includes POP3, IMAP4, SMTP AUTH (when used for older clients), and MAPI over HTTP for older Outlook clients.

These protocols do not support modern authentication, which means they bypass MFA entirely.

Blocking legacy authentication with Conditional Access is one of the single most impactful steps you can take to reduce account takeover risk.

Microsoft began blocking legacy auth by default for new tenants, but many existing tenants that have been in place for years still have it enabled.

Audit SMTP AUTH And Other Exception Scenarios

The most common pushback when blocking legacy auth is SMTP AUTH, which some firms use for multifunction printers, automated reporting tools, or legacy line-of-business applications.

These are legitimate scenarios, but the answer is not to leave legacy auth open for all users.

Audit which mailboxes actually need SMTP AUTH.

Disable it at the organization level and re-enable it only for specific service accounts that genuinely require it.

Document every exception, because those exceptions will be asked about during an audit.

Turn Off User Consent And Add Admin Review Workflows

By default, users can grant third-party applications access to their mailbox, calendar, and files without any admin visibility.

Microsoft announced secure-by-default changes in mid-2025 to block legacy authentication and require admin consent for third-party apps, but you should not wait for Microsoft to enforce this.

Disable user consent entirely.

Configure the admin consent workflow in Entra ID so that users can submit a request for app access and an admin can approve or deny it.

This closes one of the most underappreciated OAuth abuse paths in modern ransomware and data exfiltration campaigns.

Harden Email Against Phishing And Impersonation

Email is the primary attack surface for financial firms, and Microsoft Defender for Office 365 contains strong protections that are not fully active in default configurations.

Getting email hardening right covers the most common BEC and phishing vectors targeting RIAs and broker-dealers.

Configure Defender For Office 365 Baselines

Microsoft provides Standard and Strict preset security policies in Defender for Office 365.

Apply the Standard preset to all users as a starting point and move higher-risk users, executives, and compliance officers to the Strict preset.

The preset policies activate anti-spam, anti-malware, anti-phishing, Safe Links, and Safe Attachments in a tested configuration.

Exchange Online Protection's default anti-phishing configuration does not include impersonation protection, which means executives can be spoofed by default unless you configure it explicitly.

Use Safe Links, Safe Attachments, And Anti-Phishing Policies

Safe Links rewrites URLs at click time and checks them against Microsoft's threat intelligence.

Enable it for email, Teams messages, SharePoint, and OneDrive.

Safe Attachments sandboxes email attachments before delivery.

For anti-phishing policies, configure impersonation protection for your executives, key staff, and the counterparty firms your team works with most.

Enable mailbox intelligence so the system learns your users' communication patterns and flags unusual sender behavior.

These are the controls that catch targeted spear-phishing attempts, not bulk spam.

Deploy Email Authentication And External Mail Controls

Publish SPF, DKIM, and DMARC records for every domain used for email.

Set DMARC to at least quarantine, to move to reject.

Most institutional counterparties now require DMARC enforcement.

O365 phishing protection in 2026 depends heavily on DMARC and DKIM alignment as part of the overall defense chain.

Add an external sender banner to all inbound email that originates outside the firm.

Disable user-controlled mail forwarding to external domains at the tenant level using a mail flow rule and a Conditional Access-backed policy in Exchange Online.

Protect Client Data Across Email, SharePoint, And OneDrive

Data protection in Microsoft 365 spans sensitivity classification, access controls, sharing restrictions, and retention.

Getting these configurations right is what separates a firm that can demonstrate Regulation S-P compliance from one that has to scramble during an exam.

Apply Sensitivity Labels And Data Loss Prevention Policies

Configure sensitivity labels in Microsoft Purview for at least three tiers: public, internal, and confidential.

Apply labels automatically to content containing Social Security numbers, account numbers, and other nonpublic personal information.

Labels drive encryption, access controls, and DLP enforcement.

DLP policies in Purview can detect and block accidental sharing of sensitive financial data across email, SharePoint, OneDrive, and Teams.

Start with the financial services DLP templates that Microsoft provides and tune them against your firm's actual data patterns.

Email protection and DLP configuration for finance firms requires ongoing tuning to reduce false positives without removing real controls.

Tighten External Sharing And Collaboration Settings

SharePoint and OneDrive external sharing defaults are too permissive for a financial firm.

Restrict sharing to specific approved domains only and disable anonymous link sharing entirely at the tenant level.

Enable guest access expiration policies so that external collaborators automatically lose access after a defined period.

Require external recipients to authenticate before accessing shared content.

These settings reduce the risk of client data lingering in accessible shared links that were created months or years earlier.

Align Retention And Discovery Controls With Regulatory Needs

Configure retention policies in Microsoft Purview for email, Teams chats, SharePoint documents, and OneDrive files that match your firm's regulatory retention obligations.

FINRA Rule 4511 requires a minimum three-year retention period for most business records, with six years for certain communications.

Use preservation locks on retention policies where required to prevent policy modification or deletion.

This matters for regulatory defense: a retention policy with a preservation lock demonstrates that records have not been altered.

Configure eDiscovery (Premium) to support litigation holds and regulatory exam requests, because Microsoft 365 compliance for financial institutions increasingly requires pulling email and Teams data on short notice.

Secure Endpoints And Devices Connected To The Tenant

An identity hardened to the highest standard still loses against an attacker with physical or remote access to an unmanaged device.

Endpoint management through Intune and endpoint protection through Defender for

Endpoint closes that gap for every device connecting to your tenant.

Use Intune Compliance Policies To Enforce Device Trust

Enroll all corporate Windows and macOS devices in Microsoft Intune.

Configure compliance policies that require OS version minimums, BitLocker encryption, screen lock passcodes, and no known malware.

Pair Intune compliance policies with Conditional Access so that non-compliant devices are blocked from accessing firm data automatically.

For mobile devices, enforce approved app policies through Intune app protection.

Prevent users from copying client data from managed apps into personal apps on the same device.

This matters for SMS, email forwarding, and file transfers that bypass firm-controlled channels.

Deploy Defender For Endpoint For Detection And Response

Replace traditional antivirus with Microsoft Defender for Endpoint, which provides endpoint detection and response, automated investigation, and behavioral analysis rather than signature-only scanning.

Enable tamper protection to prevent local users or malware from disabling the agent.

Turn on automated investigation and response so that Defender can contain isolated threats without waiting for manual intervention.

For smaller advisory firms, this automated response capability provides around-the-clock protection even without a dedicated security operations team.

Reduce Endpoint Exposure With Encryption And Application Controls

Require BitLocker on every Windows device with recovery keys escrowed in Entra ID.

If a laptop is lost or stolen, BitLocker prevents access to client data at rest, which is directly relevant to Regulation S-P breach notification thresholds.

Consider Application Control policies through Windows Defender Application Control or AppLocker to limit which applications can execute on endpoints.

This is a higher-effort control, but it is increasingly requested by cyber insurers for firms handling significant amounts of client financial data.

Strengthen Admin Control And Privileged Access

Administrative accounts are the highest-value target in any Microsoft 365 tenant.

Gaining access to a Global Administrator account gives an attacker the ability to disable security controls, export all user data, add new domains, and lock out legitimate administrators.

Reducing standing privilege and moving to just-in-time access for all admin roles directly limits that exposure.

Reduce Standing Privilege Across Administrator Roles

Audit every account that holds a privileged role in Entra ID.

Most financial firms have far more Global Administrator assignments than necessary because adding the role is easier than scoping a more limited one.

Replace Global Administrator with least-privilege roles wherever possible: Exchange Administrator for email management, SharePoint Administrator for site management, and so on.

Remove admin roles from accounts used for day-to-day work.

An advisor or compliance officer who also holds a Global Admin role creates unnecessary risk every time they browse the web or open an email from that account.

Use Privileged Identity Management For Just-In-Time Access

Privileged Identity Management in Entra ID P2 converts eligible admin role assignments into time-limited activations.

Instead of holding a standing admin role, a user requests activation, justifies, and receives the role for a defined time window, typically one to four hours.

PIM creates an audit trail of every admin role activation, including who activated it, when, why, and what they did.

That audit trail is directly useful during a FINRA or SEC exam.

The Microsoft 365 and Entra hardening checklist for 2026 consistently identifies PIM adoption as one of the highest-impact identity controls remaining in most financial firm environments.

Separate Daily Accounts From Elevated Administrative Access

Create dedicated admin accounts that are used only for administrative tasks and never for email, web browsing, or daily productivity work.

These accounts should have no mailbox, be excluded from standard productivity licenses, and be monitored for any sign-in outside of expected administrative activity patterns.

Cloud-only accounts for admin roles provide better isolation than synced on-premises accounts because a compromised on-premises environment cannot directly pivot to cloud admin access.

Enable Logging, Monitoring, And Faster Incident Response

Logging and monitoring determine whether your firm can detect a breach, respond to an incident, and provide evidence during a regulatory exam.

Most financial firms have logging technically enabled but have not verified retention periods, forwarding configurations, or alert coverage.

Confirming these controls is not a one-time task.

Verify Audit Logging And Mailbox Auditing Are Active

Confirm that the Unified Audit Log is enabled in the Microsoft Purview compliance portal.

For tenants on E3 licensing, audit log retention defaults to 90 days.

For E5, it extends to one year.

Most regulatory and cyber insurance requirements ask for 12-month log retention at minimum, so confirm your configuration matches that standard.

Mailbox auditing is enabled by default for Exchange Online, but confirm that the audit actions captured include mail item access, forwarding rule changes, and permission changes.

CISA's Microsoft expanded cloud logs implementation playbook is a practical reference for confirming what is being captured and what is not.

Send High-Value Signals To Sentinel Or Another SIEM

Forward Unified Audit Log data, Entra ID sign-in logs, and Defender alerts to Microsoft Sentinel or another SIEM platform for 12-month retention and cross-source correlation.

Local log retention inside Microsoft 365 is not sufficient for a full incident investigation because short retention windows may expire before a compromise is detected.

Sentinel's out-of-the-box analytics rules for Microsoft 365 cover impossible travel, mass file downloads, suspicious sign-in patterns, and admin privilege escalation.

Enable these rules as a starting point before building custom detections.

Monitor Risky Behaviors, Sign-In Events, And Data Access Patterns

Configure alert policies in the Microsoft Purview compliance portal and in Microsoft Defender to fire on high-risk events: mailbox forwarding rule creation, unusual file download volumes, suspicious admin activity, and blocked sign-ins from risky users.

Enable Continuous Access Evaluation, which revokes active session tokens within minutes of a detected risk event rather than waiting for the token to expire naturally.

This matters in BEC scenarios where an attacker has authenticated successfully and is actively working inside a compromised mailbox.

Control Third-Party Apps, Vendors, And Cloud Integrations

Third-party applications and vendor access are two of the most undermanaged risk areas in financial firms' Microsoft 365 environments.

Many ransomware and data exfiltration campaigns now use compromised OAuth applications rather than credential theft because app-based access can persist even after a password reset.

Review Tenant-Wide Permissions And OAuth Exposure

Audit every third-party application registered in your Entra ID tenant.

Pay specific attention to applications with tenant-wide read or write permissions on mail, files, or calendars.

An application with tenant-wide mail read permission can access every mailbox in the firm with a single OAuth token.

Microsoft Defender for Cloud Apps provides an OAuth app inventory with risk scoring.

Use it to identify and revoke permissions for applications that are unused, unrecognized, or over-privileged.

This review should be on a quarterly schedule, not a one-time event.

Use Guest Access Instead Of Shared Credentials For Vendors

Bring vendors, consultants, and external IT partners into the tenant as Entra ID guest users with Conditional Access policies applied.

Do not share internal user credentials or create unlicensed generic accounts for vendor access.

Guest user access can be scoped to specific applications, governed by access expiration policies, and audited in the sign-in logs.

Shared credentials cannot be audited meaningfully, do not expire unless manually revoked, and create liability when a vendor relationship ends.

Extend Oversight To SaaS And Cloud App Activity

Enable Microsoft Defender for Cloud Apps connected to your Microsoft 365 tenant to monitor for shadow IT, unusual data transfer volumes, and risky application behaviors.

For financial firms using Orion, eMoney, Tamarac, or Redtail alongside Microsoft 365, Defender for Cloud Apps provides visibility into data flows between platforms.

Configure app governance policies to alert on applications that suddenly increase data access volume or begin accessing resources outside their original scope.

This control catches the early indicators of OAuth token abuse before it escalates into a full data exfiltration event.

Prioritize Licensing, Posture Reviews, And Common Fixes

Licensing determines which security controls are available to you.

Most financial firms are either underbuying or not activating what they have already paid for.

Starting with the right plan and using Secure Score as a structured roadmap rather than a report card helps turn configuration work into a continuous improvement process.

Choose The Right Microsoft 365 Plan For Security And Compliance

Microsoft 365 Business Premium is the appropriate starting tier for most small RIAs and advisory firms.

It includes Defender for Business (the SMB version of Defender for Endpoint), Intune, Entra ID P1, and Defender for Office 365 Plan 1.

Impersonation protection, Safe Links, and Safe Attachments are included at this tier.

Mid-sized broker-dealers and firms with more complex compliance requirements typically need Microsoft 365 E3 with E5 Security or E5 Compliance add-ons to access Defender for

Endpoint Plan 2, Entra ID P2 (which includes PIM and Identity Protection), Microsoft

Purview advanced compliance features and one-year audit log retention.

The compliance and security features that examiners expect are generally not available in the lower-tier plans.

Use Secure Score As A Roadmap Rather Than A Vanity Metric

Microsoft Secure Score measures your tenant's configuration against a set of recommended controls and assigns a percentage score.

The score is useful as a structured gap list, not as a compliance certification.

Work through Secure Score recommendations by sorting them by impact and effort.

Address identity and email controls first because they carry the highest impact for the lowest implementation cost.

Use the score to track progress over time and to document improvement for cyber insurance renewals and exam preparation.

Fix The Misconfigurations Financial Firms Miss Most Often

The controls that financial firms most consistently get wrong in practice include:

• Legacy authentication still active because no one ran the audit or created the blocking policy.

• SMTP AUTH is open globally rather than scoped to specific service accounts.

• No retention policies on Teams chats or OneDrive files, only on email.

• Default SharePoint external sharing settings allow anonymous link sharing.

• Standing Global Administrator accounts are used for daily work.

• No SIEM integration, meaning audit logs exist but are not actionable.

• User consent enabled for third-party apps, leaving OAuth exposure unchecked.

• Impersonation protection not configured in anti-phishing policies.

These are not exotic misconfigurations.

They appear consistently in Microsoft 365 security assessments across financial firms because default settings left them open.

No one went back to close them.

How Secure Wealth IT Helps

Secure Wealth IT delivers full Microsoft 365 hardening for RIAs, broker-dealers, hedge funds, and family offices. We configure conditional access, anti-phishing policies, DLP, sensitivity labels, retention policies for FINRA Rule 4511, eDiscovery for exam readiness, and continuous monitoring. Every configuration is documented and reviewed annually.

Next Steps for Your RIA or Broker-Dealer Firm

Secure Wealth IT helps Registered Investment Advisors, broker-dealers, and financial advisors stay secure, compliant, and audit-ready. Explore these free tools and resources:

Free Financial Calculators: calculator.securewealthit.com

Compliance Self-Assessment Tool: regulations.securewealthit.com

Resource Library: Browse free RIA and broker-dealer guides

Watch on YouTube: Secure Wealth IT YouTube channel

Talk to a Specialist: Schedule a free consultation

For more information about this topic, visit us at https://www.securewealthit.com