Looking for the fastest wins in your Microsoft 365 tenant settings? Start with five areas: sharing links, automatic email forwarding, third‑party app access, audit log retention, and two‑step login. Newer tenants are safer by default, but older tenants keep legacy choices until you change them.
Microsoft has tightened many defaults in Microsoft 365 in recent years. New tenants benefit right away. Older tenants do not. If your account (tenant) was created before roughly 2022—or was set up by a previous IT company—old rules, user consents, and sharing links may still be in effect.
A quick note before you dive in. Some options only appear if you have the right licenses—typically Microsoft 365 Business Premium, E3, or E5. If a toggle is unavailable, licensing is likely why. A couple of these changes will also alter familiar workflows for your team. You can phase them in; there’s no need to flip everything at once.
1) Set Safer Defaults for SharePoint and OneDrive Links
When someone shares a file, the default link scope matters. In many older tenants, the starting point is “Anyone with the link,” which lets anyone with that URL open the file without signing in. There’s no expiration and no way to track who it was forwarded to.
New SharePoint sites created through Teams usually default to “Only people in your organization,” which is better. But older sites—and the tenant‑wide default—often still allow open “Anyone” links. That means a link a former employee emailed to a personal account months ago can still work unless it was manually revoked.
To change the default, open the SharePoint admin center and go to the Sharing settings under Policies. Set the tenant default link type to “Specific people.” That forces sign‑in for new links. You can also cap the lifetime of any existing “Anyone” links so they expire automatically.
Estimated time: about 15 minutes. Existing links aren’t affected until a new link is created for the same file.
2) Stop Automatic Forwarding to Personal Email
As part of Microsoft’s secure‑by‑default push, the outbound spam policy now blocks automatic forwarding to outside addresses by default at the tenant level (Microsoft guidance).
However, older tenants may still have forwarding rules that predate the change, or custom anti‑spam configurations that never adopted the new default. A user could still be sending every message to a personal Gmail account, depending on how the rule was written and when it was created.
Check two things. In the Microsoft Defender portal, go to Email & Collaboration > Policies & Rules > Anti‑spam policies, then open the outbound policy. Make sure the Automatic forwarding option is either Off or set to Automatic (controlled by the system). Next, review existing inbox rules across mailboxes for any forward‑to‑external entries. You can query the Microsoft Purview audit log for inbox rule creation to speed this up.
Estimated time: roughly 10 minutes to confirm the tenant setting, longer to review mailbox rules across your users.
3) Remove Old Third‑Party App Access
In July 2025, Microsoft turned on a managed user consent policy by default. Most new third‑party apps that request access to files and sites now require an admin to approve them.
That change is not retroactive. Apps approved by users before that date still have the permissions they were granted—often including the ability to read mail, calendars, and files on the user’s behalf. Some of these tools were installed for a one‑off task and then forgotten.
To review access, open Microsoft Entra ID > Enterprise applications > All applications. Sort or filter to see apps with user consent and check which ones can reach mail, files, or calendars. Remove access for anything you don’t recognize or no longer need—all from that same screen.
Estimated time: 30–60 minutes, depending on how many historical apps are listed.
4) Align Audit Log Retention with Your Compliance Needs
Since October 2023, Audit (Standard) retains records for 180 days by default. With E5 licensing or the Microsoft Purview Audit (Premium) add‑on, you get one year of retention for audit events from Exchange, SharePoint, OneDrive, and Entra ID, while other activity types stay at 180 days.
If you work in regulated fields—healthcare, finance, legal, and similar—six months may not be enough. HIPAA, the FTC Safeguards Rule, and many state bar requirements assume you can produce records on request, often for years.
To configure retention, open the Microsoft Purview compliance portal and go to Audit > Audit retention policies. Extending retention beyond 180 days requires either an E5 plan or the Audit (Premium) capability in Purview. Once licensing is confirmed, setup typically takes about 15 minutes.
Estimated time: around 15 minutes after you verify licensing.
5) Make Sure Two‑Step Login Covers Everyone
Security Defaults first rolled out in late 2019 (Microsoft guidance). On new tenants, they automatically enforce two‑step login (multi‑factor authentication, MFA). Microsoft has also been rolling out requirements across 2024–2025 that force admins to use two‑step login for actions in both the Microsoft 365 admin center and the Azure portal.
Older tenants may have no baseline enforcement. There’s also a common pitfall: when you enable Conditional Access (included with Business Premium and higher), Microsoft expects you to handle MFA with those policies and can switch Security Defaults off. If that transition was rushed, you could end up with gaps—Security Defaults disabled and Conditional Access that doesn’t include everyone.
Review three areas carefully. First, in Entra ID, open Properties and check the Security Defaults setting. Next, under Protection > Conditional Access, verify a policy actually enforces two‑step login for all users and all admins. Finally, review any emergency (“break‑glass”) admin accounts; they’re often excluded from Conditional Access and unintentionally left without two‑step login.
Estimated time: about an hour, longer if you need to map several existing Conditional Access policies.
What Order Should You Tackle These?
Some changes happen behind the scenes. Others change how your team shares or signs in.
- Start with #4 (audit retention) and #3 (old app consents). No user impact.
- Then handle #2 (external forwarding). It’s quiet unless someone has a legitimate exception.
- Next do #1 (sharing defaults). Communicate the change so people aren’t surprised when a sign‑in is required.
- Save #5 (two‑step login and Conditional Access) for last and plan it carefully. Done poorly, it can lock people out.
Frequently asked questions
My tenant is new. Do I still need to review these?
Yes. New tenants are safer out of the box, but sharing defaults, user‑approved app permissions, and any inbox rules should still be checked.
What’s the current default for SharePoint sharing links?
Many existing tenants still allow “Anyone with the link” at the tenant level. New sites created from Teams generally default to “Only people in your organization.” Check both the tenant‑wide and site‑level settings to see what your users experience in practice (Microsoft guidance).
Did Microsoft block external auto‑forwarding by default?
Yes. The tenant‑level outbound spam policy blocks automatic forwarding to external recipients by default. Older inbox rules can still exist, so audit them (Microsoft guidance).
How long are audit logs kept by default?
Audit (Standard) keeps logs for 180 days as of October 2023. With E5 or the Purview Audit (Premium) add‑on, key workloads—Exchange, SharePoint, OneDrive, and Entra ID—retain one year (Microsoft guidance).
Does Security Defaults protect every user?
On a brand‑new tenant, yes. On older tenants that use Conditional Access, Security Defaults may be off, and coverage depends on how Conditional Access is configured (Microsoft guidance).
Sources and further reading
- Microsoft Learn: Manage sharing settings for SharePoint and OneDrive
- Microsoft Learn: Configuring external email forwarding in Microsoft 365
- Microsoft Learn: Configure how users consent to applications
- Microsoft Learn: Manage audit log retention policies
- Microsoft Learn: Configure Security Defaults for Microsoft Entra ID
- CISA: Microsoft 365 Secure Configuration Baselines (SCuBA)
If you’d like a second set of eyes on your tenant—especially for offices around Panama City—Flux Labs can help. Get in touch and we’ll walk you through the right changes at the right pace.
—
