The Chartered Institute for Public Relations (CIPR) is the professional body for public relations practitioners in the United Kingdom. The organisation supports members through professional development, training, guidance, qualifications and industry standards. As a membership-focused organisation handling business-critical communications and sensitive information, maintaining a secure and resilient digital environment is essential to supporting its operations and protecting organisational data.
As cyber security threats continue to evolve, organisations must regularly review their Microsoft 365 environments to ensure security controls remain aligned with industry best practices. CIPR sought to improve its Microsoft Secure Score and strengthen protection across its cloud services, identities, email systems and organisational data.
The review identified opportunities to enhance security configurations across Microsoft Entra ID, Exchange Online, Microsoft Defender for Office 365, Conditional Access and Microsoft Information Protection. The objective was not only to improve Secure Score metrics but also to reduce exposure to phishing attacks, strengthen access controls, improve monitoring and auditing capabilities, and support long-term security governance.
A carefully planned security improvement programme was required to implement recommended controls while maintaining a seamless experience for users and ensuring continued access to critical business applications.
We completed a comprehensive Microsoft 365 security enhancement programme covering identity management, email security, access controls and data protection.
The project began with a review of authentication and access policies. We implemented enhanced Conditional Access controls to provide granular access management and introduced geo-location restrictions that prevent access attempts from outside the United Kingdom. Risk-based authentication policies were also enabled to strengthen protection against suspicious sign-in activity while supporting regulatory compliance requirements.
Within Microsoft Defender for Office 365, we significantly improved protection against phishing and impersonation attacks. Anti-phishing controls were enhanced through advanced impersonation protection, mailbox intelligence, Safe Links protection and security tips designed to help users identify potentially malicious emails. Spam and phishing response actions were also strengthened, including increased quarantine controls, attachment filtering and restrictions on email forwarding.
Exchange Online security was improved through mailbox auditing, modern authentication, Outlook add-in restrictions, enhanced MailTips functionality and tighter controls around external calendar sharing and third-party storage integration.
In Microsoft Entra ID, multifactor authentication was expanded for both administrators and users. Additional protection was provided through Identity Protection risk policies, legacy authentication blocking, self-service password reset capabilities, least-privilege administration and improved governance of application access permissions.
To strengthen compliance and data protection, Microsoft Information Protection capabilities were enhanced through audit logging, data loss prevention policies and sensitivity label publication. The project was completed with the implementation of Microsoft 365 branding, helping to improve user confidence and strengthen recognition of legitimate company sign-in experiences.
The completed security improvement programme delivered substantial benefits across CIPR’s Microsoft 365 environment. By implementing multiple layers of protection, the organisation significantly strengthened its overall security posture and reduced exposure to common cyber threats.
Advanced phishing and impersonation controls provide greater protection against email-based attacks, helping users identify suspicious messages before they can cause disruption. Enhanced Conditional Access policies and multifactor authentication reduce the likelihood of unauthorised access, while risk-based policies provide additional protection against compromised accounts.
The introduction of comprehensive auditing, monitoring and identity protection measures has improved visibility across the environment and strengthened governance capabilities. Data protection enhancements, including DLP policies and sensitivity labels, support the secure handling of organisational information and improve compliance readiness.
The project also contributed to a stronger Microsoft Secure Score, demonstrating the implementation of industry-recognised security best practices. Most importantly, these improvements provide a more resilient and secure digital workplace while maintaining a positive and efficient user experience for staff.
