MDR watches for threats. Who's checking your Microsoft 365 settings?

We were talking to a client recently about our cyber assurance service and how it compares with managed detection and response, or MDR, which they had been quoted for separately. A lot of it overlaps, and we said so. The difference that mattered to them was in what we watch.

As well as security events, we keep an eye on the Microsoft 365 settings themselves: the policies that decide who can sign in, which devices can open client files, what happens to a suspicious email and how sensitive data is handled. Setting those up properly is the first job. Making sure they stay that way is the second, and in our experience it is the one that gets forgotten.

What MDR does

An MDR service combines tooling with people. The tooling collects signals from your tenant and devices, and the people investigate the alerts, look for anything the tooling missed and act to contain an attack when one is found. Some providers will do the containment for you, others will phone you and tell you what to do. Either way it is useful work and we are not arguing against it.

What the service description rarely tells you is who is responsible for the configuration that all of this sits on top of. If a Conditional Access policy gets switched off, that is not an attack and it will not raise an incident. Detection and response is what MDR is built for, and most providers stop there. A few will check configuration as an extra, but the name on the proposal does not tell you whether yours does, so you have to ask.

How a sensible change becomes a gap

The pattern we see most often goes like this. Someone cannot get into an application they need for a deadline. An administrator, under a bit of pressure, switches the relevant Conditional Access policy to report-only mode to rule it out. The person gets in, the ticket is closed and everyone moves on. Nobody goes back to switch the policy on again.

The policy is still listed in the admin centre and still looks like it is doing something. In report-only mode it is not. Entra evaluates it and logs what it would have done, but it does not enforce anything, so the business believes it has a control that it no longer has.

Nobody attacked anything here. It was a reasonable change made for a good reason, and it only became a problem because nobody owned putting it back. The change will be in the audit log, but an audit log is only useful if someone reads it and compares it with what the setup is supposed to look like.

We wrote recently about getting the Microsoft 365 basics in place. This is the follow-on question: once the basics are in, who is checking they are still in six months later?

The settings that matter

Microsoft spreads the security controls across four admin centres. This is the short version of what we check in each.

Service	What we check
Entra	Sign-in rules, MFA requirements, Conditional Access and who holds admin roles.
Defender	The policies that handle phishing, malicious attachments and threats on devices.
Intune	Device configuration and compliance rules, and which users and devices they apply to.
Purview	Data loss prevention and the other policies protecting sensitive information, where licensed.

We agree the configuration with you at the start, then our platform compares the live tenant against it continuously, alongside the security events. Exactly which controls are in scope depends on your licences and what we agreed.

A weakened control is a reason to act on its own. It should not have to turn into an incident before anyone looks at it. For a firm handling client money or client files, a Conditional Access policy that has quietly stopped enforcing is worth fixing today rather than after the breach.

Spotting drift is the easy part

An alert saying a setting has changed still leaves someone with a decision. Was the change deliberate? Does the business need it? Should the setting go back, or should the agreed configuration be updated to match?

That is the part we take on under the managed service. We establish the baseline, roll the controls out without locking anyone out, and keep checking for departures from it. When we find one that was not intended we put it right, and when it was intended we update the baseline so it does not keep tripping alerts.

The baseline also has to move with the business. People join and leave, laptops get replaced, someone works from abroad for a month. Legitimate changes need reviewing and temporary exceptions need an owner and an end date, otherwise a workaround put in for one person becomes the way the whole firm works.

There is a side benefit. When a customer or insurer sends a security questionnaire, you have a written assessment and a monthly record of the controls being maintained, rather than a best guess at what the settings were the last time anyone looked.

Why we do both

Keeping the configuration right reduces the number of gaps an attacker can use. Detection and response deals with the attacks that get through anyway. Neither replaces the other, and for a small firm there is a practical advantage in one provider being responsible for both: you can ask the same people about a suspicious sign-in and about whether your MFA policy is still enforced.

That was the answer we gave our client. The uplift does not end when the initial work is signed off. The settings we put in are maintained, and the monitoring and incident response sit on top of them.

Four questions to ask your provider

If you are comparing services, or you already pay for MDR, these are worth putting to them:

1. Which Microsoft 365 security policies do you check? Ask specifically about Entra, Defender, Intune and Purview, and get the scope in writing.
2. Do you compare the live configuration against what we agreed, and how often? A log of changes is not the same as someone checking whether the controls still do what they should.
3. When a policy changes, who notices and who puts it right? If the answer is “we tell you”, the work is still yours.
4. What monitoring and incident response is included, and during which hours? Policy upkeep and threat response both need clear coverage.

If you cannot get a straight answer to any of these, that tells you something as well.

At &DEV, Managed includes enforcing the controls, ongoing policy upkeep and monthly reporting. Managed Plus adds round-the-clock monitoring and incident response on top, so the configuration and the security events are looked after by the same team.