Ransomware Defence for Microsoft 365: A Practical Playbook

Ransomware hits fast, spreads quietly, and locks the tools your team uses every day. For UK SMEs running on Microsoft 365, a clear, practised playbook is the difference between a short interruption and a costly outage.

This guide gives you a straight-talking blueprint to prevent, detect, contain and recover from ransomware across identities, email, endpoints and cloud data. It includes a 10-point checklist you can act on today, and shows how Jedi Services manages each control for you.

No jargon, no fluff. Practical steps that work in the real world.

What ransomware looks like in Microsoft 365

Attackers rarely start with a dramatic splash screen. More often, they:

• Steal a password via phishing, then bypass weak MFA.
• Use Business Email Compromise to forward mail, create inbox rules and harvest contacts.
• Register a rogue device and sync data from SharePoint or OneDrive.
• Launch a mass-encryption job in OneDrive or push a malicious OAuth app to access files.

From there, they may encrypt local devices, cloud files or both, then demand payment. Your best defence is layered controls that assume breach and limit blast radius.

Prevention: harden identities, endpoints and access

Prevention is still your highest return on effort. For Microsoft 365, focus on these foundations:

Endpoint protection with EDR. Deploy Endpoint Detection and Response across laptops, desktops and mobiles. EDR spots malicious behaviour, not just known malware, and can block or roll back suspicious activity. Pair with timely patching and device health checks.

Least-privilege access. Review admin roles and high-permission apps. Use just-in-time access for global admins and break-glass accounts stored offline. Remove legacy protocols like IMAP/POP where possible.

Strong MFA everywhere. Enforce phishing-resistant MFA for all users, especially admins and finance roles. Require number matching and device compliance checks, and block SMS-based MFA for admins.

Conditional access. Require trusted locations, compliant devices and healthy risk signals before granting access. Deny high-risk sign-ins, and gate sensitive apps like Exchange Online, SharePoint and OneDrive behind additional checks.

Email controls. Roll out SPF, DKIM and staged DMARC, enable impersonation protection, safe-links and safe-attachments, and protect VIP mailboxes.

How Jedi Services helps: we implement identity and access management with conditional access policies, enforce MFA and least-privilege, and roll out adaptive mobile controls. We deploy EDR to endpoints with measured responses and maintain a 90-day zero-trust roadmap to lift your baseline quickly. If you are exploring identity controls or MFA improvements, learn how we manage zero trust access and MFA under our identity and access service at the identity and access management page.

Detection: catch the early signs, 24/7

Early detection turns an incident into a non-event. You need human-led monitoring with context:

24/7 SOC. A Security Operations Centre watches alerts from Microsoft 365, endpoints and email. Analysts triage, correlate and respond using playbooks, not guesswork.

Anomaly monitoring. Track impossible travel, atypical inbox rules, suspicious OAuth consents, mass file modifications, external forwarding and unapproved device registrations.

Sign-in risk. Use Microsoft sign-in risk and user risk to trigger extra verification or block access until reviewed.

How Jedi Services helps: our managed SOC runs around the clock, watching for account takeovers, mass-encryption patterns and EDR alerts. We combine network security monitoring, threat hunting and managed detection and response to cut noise and act fast. See how our managed cybersecurity capability works across monitoring and response at our managed security services page.

Containment: stop spread, reduce damage

When something slips through, move fast to isolate:

Account controls. Force sign-out, reset tokens, revoke OAuth consents and disable risky sessions. Remove suspicious forwarding and inbox rules.

Device quarantine. Isolate affected endpoints via EDR and unified endpoint management. Block risky devices at conditional access until clean.

Cloud controls. Freeze OneDrive sync for compromised accounts, pause SharePoint access and use file restore windows to protect data. Adjust mail flow rules to sandbox or hold suspicious messages during an active campaign.

How Jedi Services helps: our analysts execute isolation runbooks within minutes, quarantining devices, suspending sessions and applying targeted mail flow controls. We coordinate with your leadership on comms and next steps, so your team stays informed and safe.

Recovery: restore cleanly and prove resilience

True resilience is being able to recover quickly without paying a ransom:

Immutable backups. Keep independent, tamper-resistant backups of Microsoft 365 mail, SharePoint and OneDrive alongside image-level device backups.

Tested RPO/RTO. Define realistic Recovery Point Objective and Recovery Time Objective per system. Test restores regularly so you know what to expect.

Rapid restore. Use version history and point-in-time recovery for OneDrive and SharePoint. For endpoints, leverage image-level restores to known-good states.

How Jedi Services helps: we run a 3-2-1 backup strategy with immutable cloud copies and regular restore tests. We document RPO/RTOs and provide clear runbooks for leaders and IT. If you want to strengthen cloud data safeguards, see our guidance on cloud data security controls at our cloud security page.

Real-world attack path: BEC to OneDrive encryption

The threat: a finance mailbox is phished. The attacker sets an inbox rule to hide replies and enables external forwarding. Using the same password, they access OneDrive and launch a mass file edit that encrypts and re-uploads content.

Our response: the SOC flags new forwarding plus mass file modifications. We force sign-out, reset credentials, remove rules, and quarantine the user's devices via EDR. Conditional access blocks sign-in until the device is compliant. We restore affected OneDrive libraries to a clean version from before the encryption window and review third-party app consents.

The 10-point ransomware checklist for Microsoft 365

• Enforce MFA with number matching and device checks for all users.
• Deploy EDR to every endpoint and enable automatic isolation.
• Apply conditional access to require compliant devices and trusted locations.
• Remove legacy auth and minimise admin roles with just-in-time access.
• Roll out SPF, DKIM and DMARC with monitoring, plus impersonation protection.
• Monitor for anomalous sign-ins, OAuth consents and inbox rule changes.
• Implement immutable, independent backups for Microsoft 365 and devices.
• Document and test RPO/RTO; rehearse restore and isolation steps quarterly.
• Train staff with phishing simulations tailored to current lures.
• Maintain an incident runbook and on-call contacts for rapid action.

Jedi Services operates this checklist as a managed program with 24/7 oversight, no dashboards for you to learn, and clear monthly reporting.

How Jedi Services runs the controls

Prevention. We deploy EDR, enforce least-privilege and conditional access, and secure email domains. Policies are tuned to your risk and workflow, including BYOD support.

Detection. Our managed SOC watches Microsoft 365 telemetry and endpoints day and night, correlating signals such as mass file edits, risky sign-ins and device posture changes.

Containment. We execute playbooks to isolate devices, suspend sessions, revoke tokens and halt malicious mail flows. You get concise updates and next actions.

Recovery. We maintain immutable backups and practise restores. When needed, we guide leaders through communication, evidence capture and safe return to service.

If you need immediate help following an incident, our cyber incident response team is available. Read how we handle containment and recovery at our incident response and ransomware recovery page.

Common questions

• What is the best security prevention for a ransomware attack? A layered approach. Combine EDR on every endpoint, phishing-resistant MFA, least-privilege access, conditional access and strong email filtering. No single control is enough, but together they cut risk significantly.
• How can ransomware be prevented? Reduce entry points and blast radius. Patch quickly, block legacy protocols, train staff against phishing, enforce MFA, use EDR and monitor for anomalies. Backups do not prevent attacks, but they make you recoverable.
• What are the two main defences against ransomware? Preventive hardening (EDR, MFA, least-privilege, conditional access and email controls) and recoverability (immutable backups with tested restores). Detection and response glue these together.
• What is a cyber incident response? A structured process to identify, contain, eradicate and recover from a security event, followed by lessons learned. It includes decision-making, communications, evidence handling and technical remediation.
• What is the best way to prevent data loss? Keep immutable, independent backups and test restores regularly. Pair this with least-privilege access, versioning in OneDrive and SharePoint, and sensible retention policies.

Light-touch next steps

If you want a quick, honest view of your Microsoft 365 exposure, ask us for a no-obligation review. We will map your controls against the checklist and give you a clear plan to close gaps. If you need around-the-clock protection with fast human help, explore our managed security service and SOC coverage at our managed SOC and detection page. For broader day-to-day support alongside security, see how our team delivers responsive IT support for UK SMEs at our IT support services page.

Summary

Ransomware is relentless, but it is not unbeatable. Harden identities and devices, watch for anomalies 24/7, isolate fast, and restore with confidence from immutable backups. Codify this into a repeatable playbook and rehearse it. Jedi Services manages each step as one joined-up capability so your business can stay focused on customers, not crisis.