What should we secure in Microsoft 365 right after a migration?

Key facts

• Identity is the first priority: MFA for all users, enforced with Conditional Access or security defaults.
• Migration service accounts and app registrations should be removed or disabled once the move is done.
• Two cloud-only break-glass accounts protect against lockout from Conditional Access mistakes.
• SPF, DKIM and DMARC must be set for every migrated mail domain.
• Microsoft Secure Score gives a prioritized list but is not a substitute for a plan.

Why the weeks after migration matter

Migrations open temporary doors. Service accounts get broad rights, admin consent is granted to migration apps, MFA prompts may be relaxed during cutover, and sharing settings are left open so content can land. Attackers also know that users expect odd sign-in prompts and new emails from IT during a move, which makes phishing easier.

Closing those doors and setting a clear baseline within the first few weeks is far easier than doing it months later, after users have built habits around the open settings.

Identity and access

Test Conditional Access in report-only mode first, then enable it in stages. A careless policy can lock out the whole organization.

• Require MFA for every user. Use Conditional Access policies with Entra ID P1 or higher, or security defaults for tenants without it.
• Prefer phishing-resistant methods such as passkeys or Windows Hello for Business for admins, and the Microsoft Authenticator app with number matching for users.
• Block legacy authentication protocols that cannot do MFA.
• Create two cloud-only break-glass accounts excluded from Conditional Access, with strong credentials stored offline and sign-in alerts.
• Reduce Global Administrator holders to a small number and use least-privilege roles. Use Privileged Identity Management for just-in-time admin access where licensed.
• Disable or delete accounts for departed users found during discovery.

Email security

Every domain moved into the tenant needs correct email authentication. Update SPF to include Microsoft 365 and remove old senders that no longer apply, enable DKIM signing in Microsoft Defender, and publish a DMARC record that starts in monitoring mode and moves toward enforcement as reports confirm legitimate senders.

Review Defender for Office 365 or Exchange Online Protection policies for anti-phishing, Safe Links and Safe Attachments where licensed. Check for mailbox forwarding rules to external addresses, which attackers often create, and restrict automatic external forwarding by default.

Data, sharing and devices

• Set SharePoint and OneDrive external sharing defaults, limit anyone links, and set expiry for guest access.
• Restrict who can invite guests and who can create Teams and Microsoft 365 Groups if your governance requires it.
• Apply Microsoft Purview retention policies so data moved from the old platform meets your retention rules.
• Enroll Windows, macOS and mobile devices in Intune and use compliance policies with Conditional Access to require managed or compliant devices for sensitive apps.
• Use app protection policies on phones that are personally owned.

Clean up the migration itself

This step is often skipped. Make a list of everything created for the move and remove or reduce it.

Monitor and keep improving

Confirm unified audit logging is on, and set alerts for risky sign-ins, new admin role assignments, and mass downloads or deletions. Review Microsoft Secure Score to find remaining gaps, but treat it as input, not a goal in itself.

Assign an owner for security settings and schedule a review in 30 and 90 days. Many organizations add a managed service or support retainer so these checks actually happen.

How Accred Consulting approaches it

Accred Consulting builds a security baseline into the migration Proposal, with scope, fixed price and timeline, so cleanup is planned rather than left for later. US-based specialists roll out Conditional Access in report-only mode before enforcing it, set up break-glass accounts, configure email authentication, and remove migration accounts and app consents. For a manufacturer with about 350 users, MFA and Conditional Access were rolled out in 6 weeks. Handover includes documentation and knowledge transfer, and optional Support retainers cover ongoing reviews.

Track record: 400+ client projects, 2,000+ migration workstreams and 150,000+ users migrated by a US-based team. Company facts · Case studies

Related questions