Treat identity as a security boundary
Microsoft 365 accounts can provide access to email, files, collaboration tools and connected applications. Identity therefore needs the same deliberate architecture as the network perimeter.
Use MFA, then strengthen it
Authenticator-based MFA is a strong baseline. Where appropriate, phishing-resistant methods such as passkeys or FIDO2 can reduce exposure to credential phishing and adversary-in-the-middle attacks.
Control how and where users sign in
Conditional Access can evaluate factors such as location, authentication method, device state and application. Policies should match business requirements and should be tested carefully so security controls do not create unnecessary outages.
Manage sessions, not just passwords
Changing a password does not always address every active session. Session revocation, sign-in frequency and token-related controls are important parts of both prevention and incident response.
Keep visibility
Review sign-in activity, risky events and administrative changes. Good identity security combines preventive controls with enough telemetry to investigate when something unusual happens.