Centre for Mental Health is a leading UK charity dedicated to improving mental health outcomes through research, policy development and practical support. The organisation works with health services, policymakers and communities to promote better mental health and reduce inequalities. As a charity handling sensitive information and collaborating with multiple stakeholders, maintaining robust cybersecurity and compliance controls is essential to protecting organisational and client data while supporting effective daily operations.
As cyber threats continue to evolve, organisations increasingly need to ensure their Microsoft 365 environments are configured in line with security best practice. Centre for Mental Health wanted to review and strengthen its Microsoft 365 security posture to improve its Secure Score and reduce potential security risks.
The organisation required a comprehensive review of identity management, email security, information protection and access controls. Key objectives included enhancing protection against phishing attacks, improving administrator and user authentication, strengthening compliance controls, reducing the risk of unauthorised access and implementing greater visibility through auditing and monitoring.
The project aimed to create a more secure and resilient Microsoft 365 environment while supporting user productivity and maintaining a positive user experience.
Our team carried out a comprehensive Secure Score improvement programme across the Microsoft 365 environment, focusing on identity security, email protection, compliance and conditional access controls.
We began by enhancing Conditional Access policies to deliver more granular access management. Location-based restrictions were introduced to block login attempts from outside the United Kingdom, while risk-based authentication and additional compliance controls were configured to provide greater protection against suspicious access attempts.
Within Microsoft Defender for Office 365, several advanced anti-phishing and anti-spam protections were implemented. This included strengthening impersonation protection for both users and domains, enabling mailbox intelligence, configuring Safe Links protection for Office applications and introducing enhanced quarantine policies. Email forwarding controls were also tightened, while spam and phishing thresholds were optimised to improve security without negatively impacting legitimate communications.
The Exchange Online environment was further secured through the implementation of mailbox auditing, the restriction of external calendar sharing and additional controls around Outlook add-ins and external storage providers. Modern authentication settings were reviewed and enforced to ensure secure access methods were being used throughout the organisation.
Microsoft Entra ID security was strengthened through the implementation of multifactor authentication for all users and privileged administrators. Identity Protection policies were configured to help detect and respond to user and sign-in risks, while legacy authentication protocols were blocked. Administrative roles were reviewed to support least-privilege access principles and self-service password reset functionality was enabled to improve user experience and reduce administrative overhead.
To support compliance and information governance objectives, Microsoft Information Protection features were enabled, including audit log search capabilities, data loss prevention policies and the publication of sensitivity labels to assist with data classification and protection.
Finally, organisational branding was applied to the Microsoft 365 sign-in experience, helping to improve user confidence, reinforce brand identity and reduce the effectiveness of phishing attempts that mimic Microsoft login pages.
The project delivered a significantly stronger Microsoft 365 security posture and a measurable improvement in the organisation’s Secure Score. By introducing multiple layers of protection across identity, email and data security, Centre for Mental Health gained greater resilience against modern cyber threats.
Enhanced phishing and impersonation protections helped reduce the likelihood of malicious emails reaching users, while multifactor authentication and Conditional Access policies significantly improved protection against compromised credentials. Risk-based security controls now provide proactive monitoring and response capabilities, helping to detect suspicious activity more effectively.
Compliance and governance capabilities were strengthened through the implementation of audit logging, data loss prevention policies and sensitivity labels, giving the organisation greater visibility and control over sensitive information.
Users also benefited from a more secure and streamlined experience. Self-service password reset functionality reduced support requirements, while company branding across Microsoft 365 improved familiarity and trust during authentication processes.
Overall, the project delivered a modern, secure and compliant Microsoft 365 environment that supports the organisation’s operational needs while providing enhanced protection for users, systems and data.
- Improved Microsoft Secure Score across the Microsoft 365 environment
- Enhanced protection against phishing, spoofing and impersonation attacks
- Multifactor authentication enabled for all users and privileged accounts
- Conditional Access policies implemented with location-based restrictions
- Legacy authentication blocked to reduce attack surface
- Microsoft Entra ID Identity Protection policies enabled