Once a breach is detected, the first priority is to limit the damage by containing the incident. Disconnect affected systems from the network to prevent the breach from spreading. This may involve temporarily shutting down email accounts, isolating servers, or blocking specific access points.

Microsoft 365 Business Premium provides several features to help identify what happened and quickly contain the breach:

• Account Containment Actions – IT administrators can disable compromised accounts, revoke active sessions, and reset Multi-Factor Authentication (MFA) to contain the breach and prevent further unauthorized access.
• Geolocation Access Restrictions – Conditional Access policies can restrict access to only trusted locations, such as the office or New Zealand, helping to contain the breach and prevent external actors from gaining further access.
• Microsoft Defender for Office 365 – Detects compromised email accounts and allows administrators to revoke access. It also provides security alerts to notify IT teams of suspicious activity, providing an additional security layer that can assist with a rapid response.
• Microsoft Defender for Business – Identifies malware, isolates infected endpoints, and mitigates threats.
• Microsoft 365 Compliance Center –Audits user activity and identifies unauthorized access to sensitive files.
• Microsoft Entra ID Conditional Access –Restricts access based on device security, allowing only firm-owned or approved devices to connect.

For firms requiring advanced threat analytics and incident response, additional services such as Microsoft Defender for Endpoint P2 (available as an add-on) can provide deeper insights and proactive security measures.

Once containment is in place, the next step is to bring together key stakeholders to evaluate the exposure and determine the business response. This meeting should include IT and management, with legal counsel and a communications expert available if necessary.

The meeting should assess what sensitive data has been compromised and whether external reporting obligations apply. Microsoft 365 Audit Logs provide detailed insights into which users accessed or shared data, helping you determine the extent of the breach.

Decide on next steps, such as notifying affected clients, reporting to regulators, and implementing stronger access controls to prevent future incidents. If needed, Microsoft Data Loss Prevention (DLP) policies can be adjusted to restrict access to sensitive information moving forward.

Once the immediate threat has been addressed, it’s essential to evaluate your firm’s security posture and implement stronger safeguards where necessary. To determine the appropriate level of security for your firm, follow this process:

• Identify What Data You Have and Where It Is Stored –Conduct an inventory of the types of sensitive data your firm handles, including client records, financial documents, and internal communications. Assess where this data is stored, whether on-premise servers, cloud storage like OneDrive and SharePoint, or local devices.

• Review Security Policies and Procedures – Ensure existing policies align with industry best practices and regulatory requirements. Consider implementing:

  Application Whitelisting – Restricting which applications can run on company devices, preventing unauthorized or malicious software from being installed.

  Local PC Admin Access Control – Limiting administrator privileges on local PCs to reduce the risk of malware installation.

  Administrative Access Control – Ensuring only authorized users have access to critical systems and sensitive data.

  Document and Application Access Management – Using Microsoft Entra ID Conditional Access to enforce least-privilege access for applications and files.

• Assess Compliance Requirements – Determine if additional security measures are required to meet legal, regulatory, or cyber insurance obligations.
• Audit User Access and Permissions – Verify that only authorized personnel have access to sensitive data and applications.
• Evaluate Security Tools –Assess whether your current Microsoft 365 security stack, including Defender for Business and Conditional Access, is sufficient or if additional layers (e.g., Defender for Endpoint P2) are needed.
• Implement Ongoing Monitoring and Training – Use Microsoft Defender for Business to continuously monitor security threats and detect anomalies in real time. Microsoft Security Awareness Training provides phishing simulations and user-based risk assessments to educate staff on cybersecurity best practices, reducing the risk of human error.
• Develop an Incident Response Plan – Create or refine your response strategy to ensure your team knows exactly how to act in the event of another breach.

The best way to handle a breach is to be prepared before one occurs. One crucial step is ensuring that logging and monitoring features are properly configured. In Microsoft 365 Business Premium, some logging features may not be enabled by default, and it’s important to verify that:

• Unified Audit Logging (UAL) is enabled in Microsoft Purview Compliance Center to ensure activity tracking across Exchange, SharePoint, OneDrive, and Entra ID.
• Microsoft Entra ID Sign-in and Audit Logs are reviewed regularly, noting that Business Premium retains logs for only 7 days unless upgraded.
• Threat intelligence features in Microsoft Defender for Business are actively monitored for security alerts and unusual activity.

Innessco helps businesses implement robust cybersecurity frameworks, incident response plans, and proactive monitoring to minimise risks and improve response times.