Microsoft 365 is not automatically secure after purchase
Many small businesses set up Microsoft 365 once and leave it as is. But some important protections aren't switched on everywhere or depend on the licence. And the email account is attackers' favourite target: whoever takes it over can fake invoices in your company's name. These are the settings I check first with every new client.
1. MFA for everyone
- In small environments, Microsoft's Security Defaults are the easiest way: MFA for all accounts and legacy sign-ins blocked.
- With Business Premium, Conditional Access policies offer finer control.
- Use an authenticator app or passkeys; SMS only as a fallback.
2. Separate admin accounts
- A dedicated admin account without a mailbox
- Two to four global administrators at most
- A "break glass" emergency account with a long password, stored safely
3. Disable legacy authentication
Old protocols like POP, IMAP or SMTP with basic auth bypass MFA. Microsoft has largely retired basic auth for Exchange Online; still check whether old printers, scanners or programs send mail that way.
4. Block automatic external forwarding
A classic trick after account takeover is a hidden forwarding rule. Block external auto-forwarding in the outbound spam policy and allow exceptions only deliberately.
5. SPF, DKIM, DMARC
These domain records make it harder to send mail in your name and help deliverability. Large mail providers now require them for many senders. Start DMARC with "p=none", review reports, then tighten.
6. Limit sharing in OneDrive and SharePoint
- Restrict "Anyone with the link" or set expiry dates
- Default sharing to "People in your organisation"
- Review guest access regularly
7. Logging and alerts
Keep the audit log active and set alerts for unusual sign-ins or new forwarding rules.
8. Don't forget backup
Under the shared responsibility model, protecting your data is your job. A separate backup for mail, OneDrive and SharePoint belongs in place, see backup strategies.
Checklist
FAQ
Are Security Defaults enough? A good start for very small businesses. If you need exceptions, move to Conditional Access.
How long does it take? For a ten-person business the basics usually take a day; rolling out MFA to everyone needs some support.
Conclusion
Microsoft 365 has good protections; you just need to use them. Want your setup reviewed? See Workplace & Microsoft 365.
