Cybersecurity
Microsoft 365 and Cloud Security for Saudi Companies
Most Saudi companies now run their email, files and Teams in Microsoft 365, but very few have changed the default security settings. Waves Telecom reviews and hardens your tenant so accounts, email and data are protected, and your setup lines up with NCA ECC, PDPL and Aramco SACS-210.
- Tenant review and hardening
- MFA and conditional access
- Email, device and data protection
10 yearsin cybersecurity
150+companies passed cybersecurity audits
Gold PartnerSophos & Fortinet
Why Microsoft 365 is the first place attackers look
Your Microsoft 365 tenant holds your email, contracts, invoices, HR files and customer data. One stolen password is often enough for an attacker to read a mailbox, set up a hidden forwarding rule and send fake payment requests to your customers from a real company address.
The problem is rarely Microsoft itself. It is how the tenant was set up: MFA only on some users, old admin accounts nobody owns, legacy sign-in methods still allowed, files shared with “anyone with the link”, and audit logs that nobody reads. These gaps are also exactly what auditors ask about.
- Accounts without MFA, or MFA that can be skipped
- Too many Global Admins, including ex-staff
- Phishing and spoofed emails reaching inboxes
- Personal laptops and phones with full access to company data
- Sensitive files shared outside the company without control
What we do in your tenant
We start with a read-only review of your tenant and its Secure Score, then agree a hardening plan with you in plain language. Changes are tested with a pilot group first, so users are not locked out and business keeps running.
The work covers identity, email, devices, data and logging, and we can extend it to your Azure subscriptions. At the end you get a documented configuration, a higher Secure Score and a clear list of what is left to do.
- MFA for every user, with stronger rules for admins
- Conditional access by location, device and risk
- Admin roles cleaned up and limited to named people
- Audit logging and alerts switched on and checked
What’s included
Tenant review and Secure Score
We review your tenant settings against Secure Score and recommended security baselines and give you a prioritised fix list.
MFA and conditional access
We enforce MFA, block legacy sign-in, and set conditional access rules by user, device, location and sign-in risk.
Admin role clean-up
We remove unused and shared admin accounts, give admins separate accounts, and assign the lowest role that does the job.
Email protection
Advanced anti-phishing, link checking and attachment sandboxing, plus SPF, DKIM and DMARC for your domains.
Device management
We enroll company laptops and phones, enforce encryption, PIN and updates, and keep company data separate on personal phones.
Data protection and backup
Sensitivity labels and data loss prevention for personal and confidential data, safer Teams, SharePoint and OneDrive sharing, and Microsoft 365 backup.
How it works
Free consultation
A short call to understand your licences, users, devices and any audit you are preparing for.
Read-only review
We review the tenant with read-only access and report the gaps, Secure Score and quick wins.
Hardening plan
We agree the changes, the order and the user communication with you before touching anything.
Pilot and roll-out
Changes go to a pilot group first, then to all users, with our engineers on hand for questions.
Handover and review
You get the documented settings, admin guidance and optional periodic reviews to keep the tenant secure.
Saudi compliance: how Microsoft 365 security maps
A hardened tenant gives you evidence for several Saudi requirements at once. We map each change to the control area it supports so you can show auditors what was done.
- NCA ECC: identity and access management, MFA and admin control, logging and incident management for cloud services.
- PDPL: sensitivity labels, data loss prevention and sharing controls help protect personal data and support breach investigation and reporting to SDAIA.
- Aramco SACS-210: MFA on email, cloud and privileged accounts; SPF, DKIM and DMARC; logs kept for at least one year; tested backups.
- Copilot: clean permissions and labels before you roll out Microsoft 365 Copilot. See our Copilot readiness service.
Products we use
We work with Microsoft Entra ID for identity and conditional access, Microsoft Defender for Office 365 and Defender for Endpoint, Microsoft Intune for devices and Microsoft Purview for labels, DLP and audit. For Azure workloads we apply Microsoft’s built-in security tools, and where you need wider protection we combine them with Sophos and Fortinet. As a Microsoft partner we can also advise on the right licence for the controls you need.
Frequently asked questions
Do we need extra licences to secure Microsoft 365?
Not always. Many controls, such as MFA, admin clean-up, sharing settings and audit logging, work on standard business plans. Conditional access, device management and advanced email and data protection features need specific plans. We tell you which controls your current licences already include before suggesting any upgrade.
Will MFA and conditional access lock our users out?
Not if it is rolled out properly. We test with a pilot group, keep emergency admin accounts excluded and monitored, and brief users before each change. Most staff only notice an extra sign-in prompt.
Is our data safe in Microsoft 365 without a separate backup?
Microsoft keeps the service running, but deleted or encrypted data is your responsibility after retention periods end. A separate Microsoft 365 backup lets you restore mailboxes, OneDrive and SharePoint after ransomware, mistakes or a departing employee. Aramco SACS-210 also expects backups to be tested.
Does this help with Aramco CCC and SACS-210?
Yes. Many SACS-210 controls sit in Microsoft 365: MFA on email and cloud, SPF, DKIM and DMARC, log retention and tested backups. 150+ companies passed supplier cybersecurity audits with our help, and we prepare the evidence auditors ask for.
Can you also secure our Azure subscriptions?
Yes. We cover Azure security basics: admin access and MFA, exposed services, network security rules, the built-in security recommendations, logging and backup of key workloads.
Should we do this before rolling out Copilot?
Yes. Copilot can find any file a user has permission to open, so over-shared files become easy to discover. We fix permissions and labels first, then support a safe Copilot rollout.
Get a free Microsoft 365 security review
Tell us about your tenant and users, and we will review your current setup and send you a clear hardening plan and quote.
- 📞 +966 58 236 5619
- 💬 +966 58 236 5619
- ✉️ info@wavestelecom.net
- 📍 3266 Adh Dhahran – Al Aqrabiyah Dist, Al Khobar 34446
