2.3 Configuring Org Settings: Security, Privacy & Profile
Key Takeaways
- The Microsoft 365 admin center's Settings → Org settings page groups org-wide toggles into categories including Organization profile, Security & privacy, Services, and Reports
- Release preferences let admins choose Standard release (default, broad rollout) or Targeted release (early access to changes) and can be applied to the whole org or to specific users
- Modern Authentication cannot be turned off for new tenants; the legacy Basic Authentication toggle is being removed and Basic auth is disabled by default across Exchange Online, SharePoint, and Teams
- Self-service password reset can be enabled at the org level in Org settings, but the deeper per-user, per-group, and writeback configuration lives in Microsoft Entra ID
- Org settings holds org-level toggles only — Conditional Access, Defender, and Purview policies are configured in their dedicated admin centers covered in later chapters
Quick Answer: The Microsoft 365 admin center's Settings → Org settings page is where org-wide toggles live. The blueprint covers two categories: Organization profile (org name, release preferences, data location) and Security & privacy (Modern Authentication, self-service password reset, password expiration policy, privacy profile, Customer Lockbox). These are org-level switches; deeper per-feature policy lives in Entra ID, Defender, and Purview, which are covered in later chapters.
Where Org Settings Lives
In the Microsoft 365 admin center (admin.microsoft.com), navigate to Settings → Org settings. The page presents a set of category cards and a tabbed list of individual toggles. The two categories the MS-102 blueprint calls out are Organization profile and Security & privacy; a third, Services, contains per-workload org-level toggles (such as Microsoft Teams settings, User Owned Apps, and Bookings) that are useful but not the focus of this section.
A guiding principle for the exam: Org settings holds org-level switches. When a feature needs finer policy — per-group, per-application, conditional logic, or alerting — that policy lives in a dedicated admin center. This section covers the org-level toggles; the deeper Identity, Defender, and Purview chapters handle the rest.
Organization Profile
The Organization profile card collects org-wide attributes that show up in Microsoft 365 surfaces and in partner/admin communications.
Organization Name and Contact Preferences
- Organization name — displayed in the M365 admin center, in product UX, and in customer-facing surfaces like the Microsoft 365 launchpad. Used by Microsoft to identify the tenant in support contexts.
- Contact preferences — phone numbers and email addresses Microsoft uses for service health and admin communications. Keep these current — service incident notifications go here.
Release Preferences
Microsoft 365 rolls out changes in two channels:
| Release option | Who gets changes | When |
|---|---|---|
| Standard release (default) | Everyone in the tenant | After Targeted release has validated the change |
| Targeted release | A selected subset of users or the entire org | Earlier than Standard release, ahead of general availability |
You can configure Targeted release two ways:
- Targeted release for everyone — the whole org receives changes early. Useful for a small org that wants the newest features.
- Targeted release for selected users — only designated users (typically IT admins or a pilot group) receive early changes; everyone else stays on Standard release. This is the recommended production pattern because it lets IT validate changes before they reach the broader workforce.
Release preference is set in Settings → Org settings → Organization profile → Release preferences. Changes can take up to 24 hours to take effect.
Data Location and Region
The Data location card shows where each workload's customer data is stored at rest (Exchange Online mailboxes, SharePoint/OneDrive content, Teams chat data). The list reflects the tenant's primary datacenter geo chosen at creation. Some workloads support a multi-geo configuration (Exchange Online Multi-Geo, SharePoint Multi-Geo) that expands storage locations; the basic data location card does not configure multi-geo, it only reports current at-rest location.
Additional Profile Settings
- Custom theme / logo — org branding shown across M365 app headers (also configurable from the Themes card in the admin center)
- Helpdesk information — support contact shown in the M365 help pane
- Release track announcements — opt in to emails about upcoming changes
Security & Privacy
The Security & privacy card (under Org settings) surfaces org-level security toggles. These are the ones the MS-102 blueprint expects you to recognize here.
Modern Authentication
Modern Authentication (based on OAuth 2.0 and the Microsoft Authentication Library) is the default and only supported sign-in stack for Microsoft 365. The org-level toggle historically allowed admins to turn Modern Auth off for Exchange Online; for new tenants Modern Auth is always on and cannot be disabled, and the corresponding toggle for Basic Authentication (legacy SMTP/POP/IMAP/ActiveSync legacy auth) has been retired — Basic auth is disabled by default across Exchange Online, SharePoint, and Teams.
For the exam, remember: you cannot turn Modern Authentication off in current Microsoft 365 tenants, and Basic authentication protocols are off by default. Any remaining Basic auth need (such as SMTP AUTH for a legacy device) is re-enabled narrowly via authenticated submission or the Exchange Online SMTP AUTH end-per-user toggle, not via the Org settings Modern Auth switch.
Self-Service Password Reset (Org-Level Toggle)
The Org settings Security & privacy page includes a toggle for Self-service password reset. Turning this on at the org level lets users reset their own passwords. The deeper configuration — which users or groups can reset, whether they must use mobile app vs SMS vs email, and whether password writeback to on-premises Active Directory is enabled — is configured in Microsoft Entra ID → Password reset (covered in the Identity chapter).
Password Expiration Policy
The Org settings Security & privacy page includes a Password expiration policy toggle. Microsoft's recommendation, and the default for Microsoft 365 cloud-only accounts, is that passwords never expire — this reduces helpdesk load and the risky behavior of users writing passwords down. You can re-enable expiration (e.g., require passwords to change every 90 days) if a compliance policy demands it, but Microsoft's published guidance is to keep expiration off and rely on MFA plus risk-based Conditional Access instead.
Exam note: Password expiration in Entra ID is separate from on-premises Active Directory fine-grained password policies. In a hybrid environment, the on-prem password policy still applies to synced accounts.
Privacy Profile and Data Subject Requests
Microsoft 365 includes a privacy profile capability for documenting your organization's privacy practices and handling Data Subject Requests (DSRs) — formal requests from individuals to access, export, or delete their personal data. The org-level privacy profile is where you designate a contact for privacy inquiries and describe how your org responds to DSRs. The actual fulfillment of a DSR — finding and exporting or deleting a person's data across Exchange, SharePoint, OneDrive, and Teams — is performed in Microsoft Purview compliance portal → Privacy solutions, not in the Org settings page itself.
Customer Lockbox
Customer Lockbox is an org-level toggle that requires Microsoft engineers to obtain explicit, time-boxed approval from your designated approvers before accessing your customer content during support cases. When enabled, a support request that requires access to customer data triggers an approval flow; access is denied if no approver responds in time. Customer Lockbox is included in Microsoft 365 E5 and in standalone SKUs; it is not available in lower-tier plans.
Microsoft Privacy Statement and Reports
The Security & privacy page also links to the Microsoft Privacy Statement and to Microsoft's transparency reports. These are informational links rather than configuration toggles, but the blueprint expects you to know they live here.
Org-Level vs Per-Feature Configuration
A common exam trap is confusing the org-level toggle in Org settings with the deeper policy that lives elsewhere. Use this distinction:
| Setting | Org settings (this page) | Dedicated admin center |
|---|---|---|
| MFA | Awareness / status view only | Entra ID → Security → Conditional Access (per-user and per-group policy) |
| Security defaults | Awareness view; not toggled here | Entra ID → Properties → Manage Security defaults |
| Self-service password reset | Org-level on/off toggle | Entra ID → Password reset (per-group, methods, writeback) |
| Password expiration | Org-level policy | Entra ID per-user password policy for finer control |
| Conditional Access | Not here | Entra ID → Security → Conditional Access (full policy engine) |
| Threat protection | Not here | Microsoft Defender portal (anti-phish, anti-malware, Safe Links) |
| Data loss prevention | Not here | Microsoft Purview compliance portal (DLP policies, retention) |
Security defaults note: Microsoft Entra ID Security defaults are a baseline set of protections (requiring MFA for all users, blocking legacy authentication) intended for orgs without Conditional Access. They are toggled in Entra ID → Properties → Manage Security defaults, not in Org settings. Security defaults and Conditional Access are mutually exclusive — you cannot use both. Conditional Access is covered in the Identity chapter.
Key Takeaways
- Org settings is the home for org-level toggles; deeper per-feature policy lives in Entra ID, Defender, or Purview
- Release preferences control whether users get Standard or Targeted release; Targeted release for selected users is the recommended production pattern
- Modern Authentication is always on for current tenants; Basic authentication is off by default
- Self-service password reset has an org-level toggle in Org settings but the methods, scope, and writeback are configured in Entra ID
- Customer Lockbox requires Microsoft approval before Microsoft engineers access customer content and is available in E5 and standalone SKUs
Your IT director wants a small pilot group of admins to receive Microsoft 365 feature changes before the rest of the company, while everyone else stays on the default rollout. Which configuration should you set in Org settings?
A compliance officer asks you to enforce 90-day password expiration across all cloud-only Microsoft 365 users. What should you tell them about Microsoft's default and recommendation?
Which statement correctly distinguishes the self-service password reset toggle in Microsoft 365 admin center Org settings from the deeper configuration in Microsoft Entra ID?