Microsoft has tightened several default settings in Microsoft 365 over the past few years. Newer tenants get more protection out of the box than tenants set up before 2022 or so.
The problem: legacy configurations stay in place. A setting changed for new tenants in 2024 doesn’t retroactively change yours. Historical user consents, inbox rules, and sharing links granted before the change are often still active.
Here are five settings worth checking — especially if your tenant is more than two or three years old, was set up by a previous IT provider, or hasn’t been audited in a while. That describes a lot of businesses across Laurel, Hattiesburg, Meridian, and the rest of the Pine Belt.
A few caveats before we start:
- Some settings require Microsoft 365 Business Premium, E3, or E5 to change. If a toggle is grayed out, license tier is usually why.
- A couple of these changes will generate support tickets because they change how something already works.
- None of them need to be flipped all at once.
1. The default sharing link in SharePoint and OneDrive
When someone shares a file from SharePoint or OneDrive, the link has a default scope. In tenants set up before Microsoft tightened new-site defaults, that scope is often “Anyone with the link” — meaning anyone who receives the URL can open the file without signing in. No expiration. No record of who else the link was forwarded to.
Newer Teams-created sites often default to “Only people in your organization.” Older sites and the tenant-level setting may still allow Anyone links. A departing employee who emailed a proposal to a personal account six months ago can still have a working link unless someone revoked it.
Where to look: SharePoint admin center → Policies → Sharing. Switching the tenant default to “Specific people” forces every new link to require authentication. You can also set a maximum expiration for remaining Anyone links.
Rough time: ~15 minutes. Existing links aren’t affected until regenerated.
2. External email forwarding rules
Microsoft now blocks automatic email forwarding to external addresses at the tenant level by default (outbound spam policy). That rolled out as part of Microsoft’s secure-by-default effort.
Forwarding rules created before that change can still be active. Tenants with custom outbound spam policies configured years ago may not reflect the current default. A user who set up a rule years ago to forward every email to personal Gmail may still be exporting your data.
Verify two things:
- In Microsoft Defender → Email & Collaboration → Policies & Rules → Anti-spam → Anti-spam outbound policy: confirm Automatic forwarding is Off or Automatic – System-controlled.
- Audit existing inbox rules for forward-to-external configurations. Microsoft Purview audit logs can show inbox rule creation events.
Rough time: ~10 minutes to verify the tenant setting; longer to review rules across all mailboxes.
This pairs directly with how ransomware crews use silent forwarding during dwell time — a theme we cover in our May ransomware walkthrough.
3. Historical third-party app consents
A Microsoft-managed user consent policy was enabled by default in July 2025, preventing users from consenting to most third-party apps that request access to files and sites. New consent requests now route to an admin.
The change applies going forward. Apps granted user consent before the policy still keep whatever permissions they were given — including the ability to read mail, calendars, and files on behalf of the user. Some of those apps may be tools an employee installed years ago and no longer uses.
Where to look: Microsoft Entra ID → Enterprise Applications → All applications. Sort by user consent. Revoke anything you don’t recognize or no longer need.
Rough time: 30–60 minutes, depending on how many historical apps are in the list.
4. Mailbox and tenant audit log retention
The default audit log retention period changed in October 2023. Audit (Standard) logs are now retained for 180 days (up from 90). Customers with E5 or the Microsoft Purview Audit (Premium) add-on get one year for Exchange, SharePoint, OneDrive, and Entra ID audit records.
If you’re in healthcare, financial services, legal, or another regulated industry — common across Mississippi — 180 days may not match your retention obligations. HIPAA, the FTC Safeguards Rule, and many client-data rules assume you can produce records on request, often measured in years, not months.
Where to look: Microsoft Purview compliance portal → Audit → Audit retention policies. Extending beyond 180 days typically requires E5 or the Purview Audit add-on.
Rough time: ~15 minutes once you’ve confirmed licensing.
5. MFA enforcement and Security Defaults
MFA enforcement is the area most likely to be inconsistent in older tenants. Microsoft introduced Security Defaults in late 2019; new tenants get MFA automatically. Microsoft has also been making MFA mandatory for many admin actions through 2024 and 2025.
Tenants created before Security Defaults may have no baseline enforcement. There’s also a common trap: when an admin enables Conditional Access (Business Premium and above), Microsoft expects you to take over MFA through that policy and may turn Security Defaults off. If the transition was rushed, you can end up with Security Defaults off and a Conditional Access policy that doesn’t cover every user.
Check three places:
- Entra ID → Properties → Manage Security Defaults — on or off?
- Protection → Conditional Access — is a policy actively enforcing MFA for all users, including admins?
- Break-glass admin accounts — sometimes excluded from Conditional Access for emergencies and left with no MFA.
Rough time: about an hour; longer if you need to map several existing Conditional Access policies.
At West Computers, we enforce Conditional Access and phishing-resistant MFA across managed Microsoft 365 environments — and we audit for exactly these legacy gaps when we take on a tenant.
A sensible order to roll the changes
Some changes are silent to users. Others change daily habits.
- Audit log retention (#4) and historical app consent review (#3) — no user-facing impact. Start here.
- External forwarding (#2) — silent unless someone has a legitimate forwarding rule (rare).
- Sharing default (#1) — will generate questions from anyone used to pasting Anyone links. Communicate before you flip it.
- MFA / Conditional Access (#5) — highest stakes; most likely to lock people out if done badly. Save for last and budget time to do it properly.
Frequently asked questions
Are my Microsoft 365 settings still vulnerable if my tenant was set up recently?
New tenants get more protection out of the box. Even so, sharing scope, historical app consents, and old inbox rules need review in any tenant regardless of age.
What is the current Microsoft 365 default for “Anyone with the link” sharing?
Many existing tenants still permit Anyone links at the tenant level. Newer Teams-created sites often default to “Only people in your organization.” Check both tenant-level and site-level settings.
Did Microsoft turn off external email forwarding by default?
Yes — the outbound spam policy now blocks automatic external forwarding by default. Existing inbox rules created before that change may still be active.
How long are Microsoft 365 audit logs kept by default?
180 days for Audit (Standard) as of October 2023. One year for key workloads with E5 or Purview Audit (Premium).
Does Security Defaults cover all my users?
On a new tenant, yes — including MFA. On an older tenant with Conditional Access enabled, Security Defaults may be off, and MFA coverage depends on how Conditional Access was configured.
Article adapted with permission from The Technology Press.