As of 13 August 2026, AI can only partly secure Microsoft 365 for your business.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface, power-user skill, and roughly 2 hours until you can act on the result.

   How to actually do it

   1. Open the Microsoft 365 admin centre and record your licence or plan, user count, administrator roles, identity setup, email services, device management and any existing security products without pasting passwords, tokens or unnecessary personal data.
   2. Export or copy read-only configuration information from the relevant Microsoft 365 admin, Entra, Defender and Intune pages, and redact names, email addresses, tenant identifiers and secrets before using it.
   3. Paste the business context and redacted configuration into the prompt, then ask the chatbot for a prioritised plan that separates read-only checks from changes.
   4. Ask a Microsoft 365 administrator to confirm that each proposed setting exists in your licence and will not disrupt sign-in, email, devices, guests, suppliers or emergency access.
   5. Test approved changes in a small, agreed pilot group or other safe scope, using the AI-generated rollback and test instructions only as a draft for the administrator.
   6. Compare the completed settings and test results against the verification checklist and current Microsoft documentation, then have the administrator or security professional approve the production rollout and monitoring plan.

   Prompt

   Act as a Microsoft 365 security planning assistant, not an administrator. Help me improve the security of this UK business tenant without making assumptions and without claiming that a setting is safe unless it is supported by current Microsoft documentation.
   
   Business context:
   - Business type: [business type]
   - Number of users: [number]
   - Microsoft 365 licence or plan: [licence or plan]
   - Important services and devices: [services and devices]
   - Compliance or customer requirements: [requirements]
   - Tolerance for disruption: [low, medium or high]
   
   Current tenant information and exported settings:
   [paste information here]
   
   Produce:
   1. A prioritised list of security improvements, separating urgent, important and optional work.
   2. For each item, state the exact Microsoft 365 area or setting involved, the reason for the change, prerequisites, likely effect on users, rollback method and how to test it safely.
   3. A list of facts or configuration details you still need before recommending a change.
   4. Read-only checks I can run first, using Microsoft 365 admin centre steps or clearly labelled PowerShell or Microsoft Graph commands.
   5. Any commands that change configuration in a separate section. Do not include destructive commands, secrets, access tokens or real personal data, and explain the permissions each command would require.
   6. A verification checklist that a Microsoft 365 administrator or security professional can use after implementation.
   
   Do not invent tenant settings, licence features, compliance requirements, incidents or results. Do not tell me that the tenant is secure based only on this conversation. Flag recommendations that need a Microsoft 365 administrator or cybersecurity professional to review before implementation, and link to the relevant Microsoft documentation where you can.

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.