{"id":19765,"date":"2026-02-12T06:50:59","date_gmt":"2026-02-12T05:50:59","guid":{"rendered":"https:\/\/coreit.se\/okategoriserad\/are-security-features-enabled-by-default-in-microsoft-365"},"modified":"2026-03-26T07:23:58","modified_gmt":"2026-03-26T06:23:58","slug":"are-security-features-enabled-by-default-in-microsoft-365","status":"publish","type":"post","link":"https:\/\/coreit.se\/en\/faq\/are-security-features-enabled-by-default-in-microsoft-365","title":{"rendered":"Are security features enabled by default in Microsoft 365?"},"content":{"rendered":"\n
\n

Are security features enabled by default in Microsoft 365?<\/h2>\n\n
\n

Microsoft 365 comes with several security features pre-configured, but not all advanced protections are enabled by default. Basic features like email filtering, antivirus, and simple policies are active, while advanced features like multi-factor authentication, Advanced Threat Protection (ATP), Conditional Access, and Secure Score require administrative activation and customization to provide a full level of security. <\/p>\n <\/div>\n\n

\n
\n

Background and overview<\/h2>\n

Security is a core part of Microsoft 365, but to maximize protection, administrators often need to configure and enable certain features. This is because organizations’ needs and risk profiles vary. <\/p>\n\n

Basic security features<\/h3>\n

Businesses get direct protection against malware and spam via Exchange Online Protection, as well as basic antivirus for files and emails.<\/p>\n\n

Advanced security features<\/h3>\n

Features such as Advanced Threat Protection (ATP), Safe Links, Safe Attachments, Conditional Access and MFA are not always enabled by default, but require administrative configuration.<\/p>\n\n

Why some features are not active by default<\/h3>\n

Microsoft leaves flexibility for companies to customize security according to risk level, user groups and internal policies, leaving advanced settings to be manually enabled.<\/p>\n\n

Enable and configure security<\/h3>\n

Administrators use Microsoft 365 Security & Compliance Center or Azure AD to enable MFA, configure ATP, Conditional Access and check Secure Score to improve security.<\/p>\n\n

Reporting and transparency<\/h3>\n

Once activated, logs and reports provide visibility into user activity and security status, facilitating monitoring and compliance.<\/p>\n\n

Benefits of enabling security features<\/h3>\n

Fully enabled security features reduce the risk of data breaches, phishing, ransomware and other cyber threats, while strengthening your organization’s compliance and security awareness.<\/p>\n\n

Common mistakes<\/h3>\n

Relying on default settings without enabling advanced protections, or not informing users of new policies, can limit security.<\/p>\n <\/div>\n\n

\n
\n

Main points about the default activation of security features<\/h2>\n
    \n
  • Basic protection:<\/strong> Malware and spam filtering is automatically activated.<\/li>\n
  • Advanced protections:<\/strong> Advanced Threat Protection (ATP), Safe Links and Safe Attachments require activation.<\/li>\n
  • Multi-factor authentication:<\/strong> Not always enabled by default, should be enabled manually.<\/li>\n
  • Conditional Access:<\/strong> Requires configuration to manage risk levels.<\/li>\n
  • Secure Score:<\/strong> Helps administrators identify and implement additional protections.<\/li>\n
  • Reporting:<\/strong> Provides transparency and facilitates compliance once the features are activated.<\/li>\n <\/ul>\n <\/div>\n\n
    \n

    Related questions<\/h2>\n\n
    \n

    Are all security features enabled by default?<\/h3>\n

    No, basic functions are active, but advanced protections require administrative configuration.<\/p>\n <\/div>\n\n

    \n

    Which functions are active directly?<\/h3>\n

    Exchange Online Protection, basic antivirus and spam filters are examples of features that are active right away.<\/p>\n <\/div>\n\n

    \n

    How to activate MFA and ATP?<\/h3>\n

    Through the Microsoft 365 Security & Compliance Center or Azure AD, where administrators can configure policies and enable protection.<\/p>\n <\/div>\n\n

    \n

    What is Secure Score?<\/h3>\n

    A score showing the company’s security status and recommended actions to improve protection.<\/p>\n <\/div>\n\n

    \n

    Why is it important to enable advanced features?<\/h3>\n

    To protect against advanced threats such as phishing, ransomware and social engineering, which are not always stopped by basic protection.<\/p>\n <\/div>\n\n <\/div>\n <\/div>\n <\/div>\n<\/div>\n\n