Most small businesses run on Microsoft 365: e-mail, Teams, OneDrive and SharePoint. Microsoft gives you strong security controls, but many of the most useful ones are not switched on when you buy the subscription, and nobody comes back to turn them on later.
Here are ten settings we check first in almost every Microsoft 365 review we do. Together they stop the most common attacks we see: stolen passwords, hijacked mailboxes and fake invoice e-mails. Each one takes minutes, not days. (Microsoft renames its menus from time to time, so if a path below has moved, search for the setting’s name in the admin centre.)
1. Multi-factor authentication for everyone
A password on its own is no longer enough: they are phished, guessed and reused. Turn on multi-factor authentication (MFA) for every account, including the boss and the shared accounts nobody thinks about. If you don’t have Conditional Access, turn on Security defaults in the Microsoft Entra admin centre (Identity › Overview › Properties); it is free on every plan. With Microsoft 365 Business Premium, use Conditional Access policies instead, which give you more control. Prefer the Microsoft Authenticator app or passkeys over text messages.
2. Block old sign-in methods
Older e-mail protocols (“legacy authentication”) can’t do MFA, so attackers use them to get around it. Security defaults blocks legacy authentication; with Conditional Access, add a policy that blocks it. Also turn off SMTP AUTH for every mailbox except the few that genuinely need it, such as a scanner or an application that sends e-mail.
3. Stop automatic forwarding to outside addresses
When attackers get into a mailbox, one of the first things they do is set up a rule that quietly forwards e-mail to an outside address. In the Microsoft Defender portal, open the outbound anti-spam policy and set Automatic forwarding rules to Off. If a few people genuinely need forwarding, allow it for them only.
4. Separate, limited admin accounts
Admins should not read e-mail and browse the web with the same account they use to manage the company. Give each admin a separate admin account with strong MFA, keep the number of Global Administrators to between two and four, and use narrower roles (such as User Administrator or Exchange Administrator) for day-to-day tasks.
5. Stop users giving apps access to company data
A popular attack is a fake “app” that asks a user to “allow access to your mailbox and files”. One click, and the attacker has access without ever needing a password. In the Entra admin centre, under Enterprise applications › Consent and permissions, stop users from consenting to apps (or allow only verified publishers with low-risk permissions), and set up the admin consent workflow so people can request the apps they need.
6. Tighten file sharing
“Anyone with the link” links are convenient, and they spread. In the SharePoint admin centre, set external sharing to New and existing guests rather than Anyone, make Specific people the default link type, and set an expiry date on any “Anyone” links you do allow. Do the same for OneDrive.
7. Turn on the preset e-mail protection policies
In the Defender portal under Email & collaboration › Policies & rules › Threat policies › Preset security policies, turn on the Standard (or Strict) protection. It applies Microsoft’s recommended anti-spam, anti-malware and anti-phishing settings in one step. With Defender for Office 365 (included in Business Premium) it also adds impersonation protection for your senior people and domains, plus Safe Links and Safe Attachments.
8. Publish SPF, DKIM and DMARC
These three DNS records tell the world which servers may send e-mail for your domain, and what to do with e-mail that fails the check. Without them, anyone can send convincing e-mail that appears to come from you, to your customers and your own staff. Enable DKIM signing in the Defender portal, add the SPF and DKIM records at your DNS provider, then publish a DMARC record: start with p=none to watch the reports, then move to quarantine and finally reject. Big mailbox providers increasingly expect DMARC, so this also helps your genuine e-mail get delivered.
9. Make sure auditing is on, and set alerts
If something goes wrong, the audit log tells you what happened. Check that auditing is turned on in Microsoft Purview (it is for most new tenants, but older ones vary). Standard audit records are kept for 180 days. Then turn on alerts for the events that matter: new inbox forwarding rules, unusual mass downloads, and changes to admin roles. Make sure the alerts go to someone who reads them.
10. Lock down shared mailboxes and leavers’ accounts
Every shared mailbox (info@, accounts@, support@) has a user account behind it. Block sign-in on those accounts, so people reach the mailbox through their own login, with MFA. When someone leaves, block their sign-in on their last day, sign them out of all sessions, and reset their password, before you think about licences and data. Forgotten accounts are a common way in.
Bonus: use Secure Score as your to-do list
Microsoft Secure Score, in the Defender portal, rates your set-up and lists recommended actions in order of impact. It is a good way to keep improving after these ten, and to show management that security is moving in the right direction. If you are on Business Basic or Standard, also look at Business Premium: it adds Conditional Access, Defender for Business on laptops and Intune device management, which together close many of the remaining gaps.
How CATEYE can help
We review Microsoft 365 set-ups for businesses in India and the US, and fix what we find. Our IT security audit covers these ten settings and more, and comes with a clear, prioritised fix list. These settings also make fake invoice e-mails much harder to pull off. Talk to us about a review.
