You already have Microsoft 365. How much security are you actually using?

There's a particular conversation that happens in charities every year or so. Something prompts a security review — a funder question, a near miss, a trustee reading something alarming — and the response is to look at what to buy.

Almost always, the more useful question is what you already own.

Microsoft licensing is dense enough that most organisations genuinely don't know what they're entitled to. And through the Microsoft non-profit programme, many charities hold licences with capabilities well beyond what they've configured. The security is there. It's just off.

Start with your Secure Score

Microsoft gives every tenant a Secure Score — a running assessment of your configuration against Microsoft's own recommendations, with specific actions and an estimate of the effort each takes. You'll find it in the Microsoft 365 Defender portal.

Two warnings, because Secure Score is easy to misuse.

First, it isn't a target. Chasing a number leads to enabling things that don't suit how your organisation works, and a control that gets switched off again three weeks later because it broke someone's workflow has made you less secure, not more. Second, it weights everything by Microsoft's priorities, not yours. Some high-scoring items matter little to a thirty-person charity.

Use it as a to-do list to triage, not a score to maximise.

Identity is where most of the risk actually lives

Almost every incident we see in small organisations starts with an account, not a firewall. Someone's password is reused, or phished, or guessed. So identity is where attention pays best.

Multi-factor authentication — including the accounts you forgot

Most charities have MFA on staff accounts by now. The gaps tend to be elsewhere: shared mailboxes, service accounts, the volunteer coordinator's login that was set up in 2021, the account belonging to someone who left, and — most importantly — administrator accounts.

Admin accounts are the ones worth checking today. If your IT provider has a global admin account without MFA, that single account is a route to everything you have.

Conditional Access

This is the capability charities most often own and least often use. It lets you set rules about when access is allowed — requiring MFA from unfamiliar locations, blocking legacy authentication protocols that bypass MFA entirely, requiring managed devices for sensitive applications.

Blocking legacy authentication alone closes off a large category of attacks, and for most organisations it breaks nothing, because nothing modern still uses it. It's usually one policy.

Who has privileged access?

Count your global administrators. If the number is more than two or three for an organisation of your size, that's worth a conversation. Include your IT provider's accounts in the count — they're often the ones nobody remembers.

Email, because that's where it starts

Check whether SPF, DKIM and DMARC are configured for your domain. These stop other people sending email that appears to come from you — which matters enormously for a charity, because a convincing email from your fundraising address to your donor list is a very bad day.

Then look at whether Safe Links and Safe Attachments are enabled, if your licence includes Defender for Office 365. And check your mailbox rules: attackers frequently create quiet forwarding rules after compromising an account, so a periodic look at unexpected forwarding is worth the ten minutes.

Devices — and the ones you don't manage

If you have Intune, the question is whether it's actually doing anything. Are compliance policies defined? Is disk encryption enforced? Can you wipe a lost laptop?

The harder question for charities is personal devices. Volunteers and part-time staff often use their own laptops and phones, and a blanket ban tends to be unenforceable. What works better is deciding which data genuinely requires a managed device, and applying the rule there rather than everywhere.

The oversharing problem

This one catches almost everybody. Over a few years of SharePoint and Teams use, files accumulate sharing links — "anyone with the link" links that were created for one purpose in 2022 and never expired.

For a charity holding beneficiary information, this is often the largest real data risk in the tenant, and it's invisible until you look. Microsoft provides reporting on external sharing; it's worth running and usually surprising.

This matters more now than it did two years ago, because tools like Copilot surface content based on what a user can already access. If permissions are loose, Copilot makes that visible fast.

Are you licensed for more than you use?

Worth checking properly. Organisations on Business Premium often haven't enabled Defender or Intune. Charities that received or upgraded to E5 through the non-profit programme are frequently sitting on advanced capabilities entirely unconfigured.

There's a version of this that goes the other way too — paying for licences nobody uses, or a higher tier than you need. Both are worth knowing about before your next renewal.

Where to start

If you do nothing else this month, do these three:

• Check MFA on every administrator account, including your IT provider's.
• Block legacy authentication via Conditional Access, in report-only mode first.
• Run an external sharing report in SharePoint and look at what's exposed.

None of these cost anything. All three close off risks that matter. And each takes hours rather than weeks.

Then sort what's left into now, next and later — and resist the temptation to do all of it. A charity that finishes three improvements is in better shape than one that started fifteen.