Microsoft 365 was designed to enable productivity and collaboration while staying secure. Security, one of the pillars of the service, can be seen across the suite, from the tenant isolation and data encryption to risk-based conditional access. Microsoft 365 allows organizations to deploy multi-factor authentication services and even extend those to their on-premises applications, in addition to creating and applying data classification tags to documents and messages.

Microsoft 365 also allows organizations to apply data management policies to mobile devices, ensuring that data can't move from managed or privileged applications to unmanaged applications or wipe data in managed devices or applications if users fail to authenticate. These capabilities allow organizations to protect on-premises, cloud, and hybrid environments against attacks such as compromised accounts by detecting unknown activities through several behavioral and heuristic strategies.

In addition, security administrators can access tools such as Secure Score (https://securescore.office.com) so that they can understand their security posture and evaluate actions they can perform in order to improve.