Frequently asked questions for Microsoft Security Services

It is unfortunate that you are going through a cybersecurity incident. Our security services are not just limited to the prevention of a data breach or phishing attack, but we also assist with responding and recovering your data. 

Please get in touch with us at 1800 126 499 or email us at [email protected] to get help from one of our cybersecurity experts.

Office 365 already has basic security capabilities such as multi-factor authentication (MFA), data loss prevention (DLP), mail filtering, and anti-malware. E5 subscription also has eDiscovery, a stripped-down version of Advanced Threat Protection, auto data classification with Advanced Data Governance, and Office Cloud App Security.

Enterprise Mobility + Security is Microsoft’s mobile and security management platform composed of security solutions related to identity and access management, information protection, threat protection, cloud app security, and mobile security. These security products can be implemented on top of Office 365 and extended to your third-party software investments.

Microsoft 365 combines Office 365, Windows, and selected EMS features in one bundle. Depending on the plan you choose, the security features included in Microsoft 365 can be Advanced Threat Protection, Intune, Advanced Threat Analytics, Identity and Threat Protection, Azure Active Directory, Information Protection, and Azure Advanced Threat Protection.

Compliance with government-mandated regulations such as the National Data Breach (NDB) and the General Data Protection Regulation (GDPR) is one of the major concerns of many businesses. Office 365, however, can be instrumental in complying with these policies. It already has built-in features that respond to the requirements of these regulations.

An example of this would be the encryption of physical disks; encryption of data at the application level; and encryption of emails and files in transit. It can also allow your IT to monitor and track user activities via the Office 365 audit logs. You can read more about how Office 365 helps with your compliance obligations in this blog.  

Yes it does.

First of all, you need to assess how secured your environment is by checking your Microsoft Secure Score and taking necessary steps to improve it. You also need to turn on data loss prevention (DLP) and multi-factor authentication (MFA) when you deploy Office 365. We can guide you with the right combination of tools to help you protect your Office 365 environment. Visit this page to learn more.

If you are pressed for time or have limited knowledge or understanding of how Secure Score works, we can help you assess the security weaknesses in your Microsoft Cloud environment and devise a plan to reduce your risks by booking your Secure Score Analysis.

Alternatively, you can check out this blog on how to use Secure Score to improve your security posture. 

We recommend these five best practices to help you keep your data safer in the cloud.

1. Strengthen access control.
2. Improve security posture.
3. Secure apps and data.
4. Mitigate threats.
5. Protect the network.

 You can download the infographic in this blog to get a step-by-step walkthrough on how to protect your data in the cloud and learn how to identify security threats early.

A phishing attack simulation is a controlled exercise conducted by an organisation to test and improve its employees' ability to recognise and respond to phishing attacks. These simulations are designed to mimic real-world phishing attacks, where attackers send fraudulent emails or messages to trick individuals into revealing sensitive information, such as passwords or financial details.

In today’s cybersecurity landscape where attackers are more innovative and persistent, an attack simulation helps to strengthen one of your weakest links, your people, in effectively defending your security perimeter against cyber threats.

Phishing attack simulations helps to bolster an organisation’s cybersecurity defences and create a more informed and vigilant workforce.

Here are some of the top benefits of running an attack simulation:

• Enhanced employee awareness. Regular simulations help employees become more adept at identifying phishing emails and other social engineering tactics, reducing the likelihood of falling victim to actual attacks.
  
  
• Reduced risks. Organisations can significantly reduce their risk of data breaches and financial losses when employees can recognise phishing attempts, thereby helping to safeguard sensitive information and intellectual property.
  
  
• Realistic testing. Simulations mimic real-world phishing attacks, providing employees with practical experience in a controlled environment. Employees receive instant feedback on their actions, allowing them to learn from mistakes without real-world consequences.
  
  
• Identification of weaknesses. Simulations can reveal patterns in employee behaviour, highlighting areas where additional training may be needed.

Please contact us to learn more about attack simulation for your Microsoft 365 environment.

Microsoft Defender for Office 365 Plan 2 (add-on license) or Microsoft 365 E5 includes the Attack Simulation training in the Microsoft Defender portal.

Microsoft Defender for Office 365 Plan 2 also includes everything in Plan 1 (email protection and collaboration features from zero-day malware, phishing, and business email compromise (BEC)) plus post-breach investigation, hunting, and response and automation.

Professional Advantage is a Microsoft Tier 1 CSP and can help you better optimise your licensing or set up an attack simulation for your Microsoft 365 environment.

Please reach out to us for more information.

Here are some of our pointers on how to spot a phishing email.

• Unusual, urgent request.
• Suspicious links or attachments.
• Dubious sender.
• Badly written email.
  

Read our pointers in more detail with specific examples on how a phishing email looks like as well as what to do when you encounter one in this blog.

Alternatively, you may call us at 1800 126 499 or email us at [email protected] if you need assistance with a cybersecurity incident.

Essential Eight is a baseline security strategy recommended by the Australian Signals Directorate (ASD) to protect businesses against cyber threats. It is composed of eight strategies:

1. Application Whitelisting – prevents execution of malicious programs from automatically running by having a set of pre-approved apps.
   
   
2. Application Patching – helps mitigate vulnerabilities on apps that need patching.
   
   
3. Operating System Patching – allow you to mitigate vulnerabilities on operating systems that need patching.
   
   
4. Restriction of Administrative Privileges – review admin privileges on specific IT systems and provide necessary permissions only for those who need them.
   
   
5. Configuration of Office Macros – review Office macros and current policies to prevent untrusted macros with malware from automatically running.
   
   
6. Application Hardening – ensure that unauthorised applications such as Adobe Flash Player or Java applets will not be utilised in browsers that have been known to deliver malware. 
   
   
7. Multi-Factor Authentication – use a second factor such as a physical token or mobile device to authenticate user access.
   
   
8. Review Backups – ensure regular backups of data so you can get it back in case you suffer a cyber-attack.

These eight strategies, when implemented correctly, can greatly assist in defending against common cyber threats. 

Understand further what is Essential Eight, why it's important and its maturity levels in this video.

Other resources you might be interested in: 

• Essential Eight Gap Assessment
• Our Essential Eight Consulting Services
• On-Demand Webinar: Essential Eight Cybersecurity from the Server Room to the Boardroom
  
  

Application Whitelisting focuses on going through a process of creating a list of applications required by the business, based on various user roles and activities, which effectively means that any unapproved applications (which includes malicious code that may have found its way into your environment) not part of the Whitelist will not work. It is part of the Essential Eight risk mitigation strategy by the Australian Signals Directorate.

Application Whitelisting is important for these reasons:

• It allows only trusted apps to run.
• It protects against zero-day attack.
• It reduces overall IT TCO due to the lesser effort required by IT to fix security issues.

We discussed in more detail why Application Whitelisting is essential for every business in this blog.

The concept of Managed Security Services is very similar to a regular Managed Services where your IT environment is monitored and managed proactively by a third-party IT partner. Managed Security Services offers the same kind of arrangement but with more emphasis on intrusion detection, risk intelligence, and responding to security incidences.

Visit this page to learn more about our Managed Services.

Here are some practical tips you can take to protect yourself online.

• Use strong, unique passwords. Create long passwords (12+ characters) with a mix of letters, numbers, and symbols and avoid using the same password across multiple accounts. Use a trusted password manager (like 1Password, Bitwarden, or LastPass) to generate and store credentials.
• Enable multi-factor authentication. Turn on MFA wherever possible (especially for email, banking, and social media). Use an authenticator app (e.g., Microsoft Authenticator, Google Authenticator) instead of SMS when possible for added security.
• Be cautious with emails and links. Don’t click on suspicious links or download attachments from unknown sources. Watch out for phishing scams that impersonate trusted organisations. Read our blog to learn how to spot phishing emails.
  
  
• Limit the info you share online. Avoid oversharing on social media (e.g., birthdays, addresses, travel plans). Review privacy settings on platforms like Facebook, Instagram, and LinkedIn.
  
  
• Keep your devices and apps updated. Enable automatic updates on your operating system, browsers, and antivirus software. Updates patch known vulnerabilities that attackers can exploit.
• Use secure connections. Avoid using public Wi-Fi for sensitive activities, such as online banking. Use a VPN when accessing the internet on unsecured networks.

No, it is not safe to share sensitive information like passwords, financial details, or personally identifiable information with ChatGPT or any AI chat interface. Why it’s risky:

• While OpenAI takes privacy seriously, conversations may be reviewed to improve the model, especially if you're using ChatGPT without data controls enabled. 
  
  
• Unlike secure messaging apps, chat interfaces like this one aren’t encrypted for sensitive data exchange.
  
• ChatGPT isn’t a secure platform for password storage, banking details, or medical records.

Yes, hackers can steal data through your smartphone, but it typically requires tricking you into installing something malicious or exploiting security gaps. Here’s how it happens:  

• Fake or rogue apps can access your contacts, messages, photos, or passwords if given permission. 
  
  
• Phishing links that look legitimate are sent via SMS or email, which can lead you to fake sites that capture your login details.
  
  
• Unsecured Wi-Fi networks can allow attackers to intercept your data. 
  
  
• Security flaws in old operating systems or apps can be exploited.
  
  
• Someone with physical access to your device can secretly install Spyware or Stalkerware. 

Microsoft Defender protects against email threats, malware, ransomware, and suspicious logins across Microsoft 365 apps, endpoints, and cloud services.

Zero Trust is a security model that assumes a breach and verifies every access request. We help you roll it out using Microsoft tools like Entra ID, Defender, and Conditional Access policies.

Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration Automated Response (SOAR) solution built on Microsoft Azure. It helps organisations detect, investigate, and respond to security threats across their digital environment.

What makes Sentinel a powerful solution?

• Native integration with Microsoft 365 and Defender XDR tools.
• Real-time visibility into your environment’s security posture.
• Supports hybrid and multi-cloud environments (including AWS and Google Cloud).
• Pay-as-you-go pricing: —no infrastructure setup or upfront cost.

Key Features

Learn more about Microsoft Sentinel in blog Modernising Security Operations with Microsoft Sentinel

Here’s a side-by-side comparison of the differences between Microsoft Sentinel and traditional SIEM solutions.

In simple terms:

• Sentinel is cloud-first, smarter, and faster to deploy—ideal for modern, hybrid, or cloud-native environments.
• Traditional SIEMs are infrastructure-heavy and often slower to adapt to evolving threats.

Yes. Sentinel can ingest data from Microsoft and third-party sources for unified SIEM and SOAR capabilities.

Popular third-party integrations with Microsoft Sentinel include, but are not limited to:

Microsoft 365 Defender Plan 2 is an advanced threat protection solution that builds on Plan 1 by offering broader, deeper security capabilities across your Microsoft environment. It includes:

• Advanced Threat Protection:
  Stops phishing, malware, and zero-day threats across email, Teams, SharePoint, and OneDrive.
  
  
• Threat Investigation Tools:
  Gives security teams access to real-time threat intelligence, advanced hunting, and threat explorer tools.
  
  
• Automated Incident Response (AIR):
  Speeds up response time by automatically investigating and remediating threats.
  
  
• Attack Simulation Training:
  Helps you test and train employees against phishing and other cyberattack scenarios.
  
  
• Cross-Domain Detection and Response (XDR):
  Integrates signals from Defender for Endpoint, Identity, Office 365, and Cloud Apps for comprehensive protection.
  
  
• Campaign Views and Threat Analytics:
  Offers visibility into threat campaigns targeting your organisation.
  
  

In terms of licensing, Defender Plan 2 is already included in Microsoft 365 E5, Office 365 E5, or can be purchased as an add-on to Microsoft 365 E3 and other lower-tier plans.

A standard Microsoft Sentinel deployment typically takes 4 to 12 weeks, depending on the size of your environment, the number of data sources, and the complexity of your detection and automation requirements.

Professional Advantage follows a structured methodology covering assessment, design, deployment, and handover, with ongoing managed services available post-deployment.

Microsoft Defender XDR is an endpoint-to-cloud detection and response platform focused on Microsoft's own security signals (endpoints, identities, email, cloud apps).

Microsoft Sentinel is a SIEM that ingests logs and signals from any source, including third-party tools like Cisco, AWS, Splunk, and SAP, and applies AI-driven analytics across your entire environment. Since 2025, both platforms have been unified in the Microsoft Defender portal, but they serve distinct, complementary roles. Most enterprise environments benefit from both. Learn more about Microsoft Sentinel in this article.

Yes. Microsoft Sentinel is a full-featured SIEM that can replace legacy platforms like Splunk and QRadar.

Microsoft now provides an AI-assisted SIEM migration experience that automates the migration of detection rules and data connectors, significantly reducing the effort required. Microsoft also offers free migration support through the Cloud Accelerate Factory program. Contact us to find out whether your organisation qualifies.

Professional Advantage can aid with end-to-end SIEM migration services, including rule translation, data onboarding, and team enablement. Sign up here for a commitment-free 1-hour consultation to learn how we can help.

Yes. Microsoft Sentinel has over 350 pre-built data connectors for third-party platforms, including Cisco, AWS, GCP, Palo Alto, Fortinet, SAP, Okta, and many more.

Its codeless connector platform allows custom integrations with virtually any data source. The connector ecosystem was significantly expanded at Microsoft Ignite 2025 and RSAC 2026 with new AWS, GCP, and DSPM integrations.

Yes. Microsoft Sentinel is now suitable for organisations of all sizes. The 50 GB/day commitment tier introduced in 2025 was specifically designed to make Sentinel more accessible and cost-predictable for smaller organisations.

Professional Advantage works with SMBs across Australia to right-size Sentinel deployments and provide managed services that fill SOC capability gaps without requiring a full in-house security team.

Essential Eight is a baseline security strategy recommended by the Australian Signals Directorate (ASD) to protect businesses against cyber threats. It is composed of eight strategies:

1. Application Control
   prevents execution of malicious programs from automatically running by having a set of pre-approved apps.
2. Patch Applications
   helps mitigate vulnerabilities on apps that need patching.
3. Patch Operating System
   allow you to mitigate vulnerabilities on operating systems that need patching.
4. Restriction of Administrative Privileges
   review admin privileges on specific IT systems and provide necessary permissions only for those who need them.
5. Configure Microsoft Office Macros
   review Office macros and current policies to prevent untrusted macros with malware from automatically running.
6. User Application Hardening
   ensure that unauthorised applications such as Adobe Flash Player or Java applets will not be utilised in browsers that have been known to deliver malware.
7. Multi-Factor Authentication (MFA)
   use a second factor such as a physical token or mobile device to authenticate user access.
8. Review Backups
   ensure regular backups of data so you can get it back in case you suffer a cyber-attack.

When implemented correctly, these eight strategies can greatly help defend against common cyber threats. Understand further what the Essential Eight is, why it's important and its maturity levels in this video.

The Essential Eight is mandatory for all non-corporate Commonwealth entities under the Australian Government's Protective Security Policy Framework (PSPF).

For private sector organisations, it is not legislated, but it is increasingly expected. Evidence of Essential Eight compliance is now a common requirement in government and defence procurement processes, and organisations in regulated industries such as financial services, healthcare, and critical infrastructure are under growing pressure to adopt it as a baseline standard.

Even outside regulated sectors, the framework represents the ASD's best-practice recommendation for any Australian organisation running internet-connected systems.

Maturity Level 2 is the target benchmark for most Australian organisations and the mandatory minimum for Commonwealth entities. Under the updated November 2023 model, reaching it requires:

• Phishing-resistant MFA for all users, including workstation login. Standard push notification or SMS-based MFA no longer qualifies.
• Critical vulnerabilities patched within 48 hours and internet-facing applications patched within two weeks.
• Application control with Microsoft's recommended application blocklist in place and rulesets reviewed annually.
• Both ASD and vendor hardening guidance applied to all systems, the more stringent requirement takes precedence where they conflict.
• Privileged access validated on first request and automatically disabled after 12 months if not revalidated.
• Centralised event logging across internet-facing infrastructure, with a documented and tested incident response plan.
• Immutable, regularly tested backups prioritised by business criticality.

If your organisation achieved Maturity Level 2 before the 2023 update, it is worth reassessing. The requirements have changed materially, particularly around MFA and privileged access governance.

It depends on your starting point, target maturity level, and the complexity of your environment, but here's a realistic guide:

1. Gap Assessment: 2-4 weeks from scoping session to final report, for most mid-sized to enterprise organisations.
2. Reaching Maturity Level 1: Typically 1-3 months, assuming Microsoft 365 is already in place and the primary work is configuration and policy deployment.
3. Reaching Maturity Level 2: Typically 3-6 months, with the most time-intensive workstreams being phishing-resistant MFA rollout, privileged access governance, and centralised logging.
4. Reaching Maturity Level 3: 6-12+ months, depending on the complexity of your environment and the degree of architectural change required (such as Secure Admin Workstation deployment).

The good news for Microsoft 365 and Azure customers is that much of the required capability already exists in your stack. In many cases, implementation is faster and less costly than organisations expect.