Microsoft 365 Security: 10 Settings Most Businesses Miss

Friday afternoon. The owner of a small accounting firm in Sofia gets a call from a client: "Why did you send me an invoice with a new bank account?" Nobody in the office sent that email. It turns out one employee's password leaked weeks ago, their mailbox had no two-factor protection, and the attacker quietly created a rule forwarding all their mail to an outside address. All of this inside a Microsoft 365 subscription the company pays for every month. The platform isn't the problem. The problem is that Microsoft 365 security doesn't come fully configured out of the box — which is exactly why every business needs a Microsoft 365 security checklist.

Many of Microsoft's protections have to be switched on or tightened by an administrator. Below are the 10 settings we most often find missing in small business tenants, with notes on which depend on your license.

What each license includes

Before you start, check which plan you're on — some settings are only available in the higher tier.

• Business Basic and Business Standard — include Security Defaults (baseline MFA and legacy protocol blocking), Exchange Online Protection (anti-spam and anti-malware filtering for email), audit logging, and Microsoft Secure Score.
• Business Premium — adds Microsoft Entra ID P1 (Conditional Access policies), Microsoft Defender for Office 365 Plan 1 (Safe Links and Safe Attachments), Microsoft Intune Plan 1 for device management, and Defender for Business for endpoint protection.

Even on Basic or Standard, the following steps get you a solid level of protection.

1. MFA for everyone — via Security Defaults or Conditional Access

According to Microsoft, multifactor authentication and blocking legacy protocols stop more than 99.9% of the most common identity attacks. This is setting number one.

• Without Business Premium: turn on Security Defaults in the Microsoft Entra admin center (Entra ID → Overview → Properties → Manage security defaults). They require every user to register for MFA with Microsoft Authenticator.
• With Business Premium: turn off Security Defaults and replace them with Conditional Access policies — MFA for everyone, stricter requirements for admins, blocking sign-ins from risky locations. The two can't run at the same time.

Then check that everyone has actually registered — former employees' accounts are a common gap.

2. Block legacy authentication

Older protocols such as POP3, IMAP, and SMTP with basic authentication don't support MFA. An attacker with a stolen password can use them to bypass two-factor protection entirely.

Security Defaults block them automatically; with Business Premium you use a Conditional Access policy. Before you do, check whether a scanner, multifunction printer, or old line-of-business app sends email this way — Microsoft publishes guidance on reconfiguring such devices.

3. Separate admin accounts and an emergency "break-glass" account

The most common mistake in small businesses: the owner reads email with an account that is also a Global Administrator. If that account is compromised, the attacker controls the entire tenant.

• Create a separate admin account with no mailbox, used only for administration
• Keep the number of Global Administrators small — Secure Score recommends more than one but fewer than five
• Assign narrower roles (Exchange Administrator, User Administrator) when full rights aren't needed
• Create two cloud-only emergency access accounts, as Microsoft recommends — protected with a strong method (such as a FIDO2 key), stored physically in a safe place, and used only if every other admin is locked out

4. Stop automatic forwarding to external addresses

External forwarding is a favorite tool of fraudsters — it quietly siphons off your correspondence. In the Microsoft Defender portal, open the outbound spam policy and check the automatic forwarding setting.

The default is "Automatic – System-controlled," which today means forwarding is off. Make sure nobody has switched it to "On"; if one employee genuinely needs forwarding, create a separate policy just for them. Also review mailbox inbox rules periodically — attackers often create rules that hide or redirect messages.

5. Email protection: preset policies, Safe Links, and Safe Attachments

Most attacks start with an email. Rather than tuning dozens of options by hand, use the preset security policies in the Defender portal — Standard or Strict. They apply Microsoft's recommended anti-spam, anti-phishing, and anti-malware settings and update automatically.

With Business Premium (Defender for Office 365 Plan 1) they also cover Safe Links, which checks links at the moment of the click, and Safe Attachments, which opens attachments in an isolated environment before they reach the employee. Technology helps, but training remains key — see our 10 ways to spot a phishing email.

6. DKIM and DMARC for your domain

Microsoft 365 automatically signs with DKIM only for the built-in .onmicrosoft.com domain. For your own domain (for example, yourcompany.com) you have to publish two CNAME records in DNS and enable signing in the Defender portal yourself.

Then add a DMARC record — start in monitoring mode (p=none), review the reports, and gradually move to quarantine or reject. This makes it much harder for fraudsters to send email that looks like yours, and your legitimate mail lands in clients' spam folders less often.

7. Audit log, alert policies, and mailbox auditing

When something happens, the first question is "who did what, and when?" The answer lives in the audit log — but only if it was turned on beforehand.

Important: according to Microsoft's documentation, auditing is not enabled by default for SMB licenses — Business Basic, Standard, and Premium. Turn it on in the Microsoft Purview portal (Audit → "Start recording user and admin activity"). Standard audit records are retained for 180 days.

• Make sure mailbox auditing hasn't been disabled for the organization
• Set up alert policies — notifications when a forwarding rule is created, files are mass-deleted, or a new admin is added
• Decide who receives these alerts and who responds

8. Restrict external sharing in SharePoint and OneDrive

By default SharePoint allows "Anyone" links, which open without signing in — convenient, but risky for contracts and payroll.

• In the SharePoint admin center, lower the level to "New and existing guests" or stricter
• Set "Specific people" as the default link type
• If you keep "Anyone" links, give them an expiration date
• Periodically review which guests have access to company sites

9. Control third-party app consent

Some phishing attacks skip the password and ask the user to "grant access" to a harmless-looking app that then reads their mail and files. In 2025 Microsoft tightened its default consent policy so that users can no longer approve external apps' access to files, sites, mail, and Teams on their own.

Check in Entra (Enterprise applications → Consent and permissions) which policy is active. For a small business it's often wisest to turn user consent off and route requests to an administrator through the admin consent workflow.

10. Device basics with Intune

A secure account on an insecure laptop is only half the protection. With Business Premium you get Microsoft Intune Plan 1, which lets you:

• Require disk encryption (BitLocker), an active firewall, and antivirus
• Enforce automatic Windows updates
• Require a PIN on phones that open company email
• Remotely wipe company data from a lost device or a departing employee's phone

Combined with Conditional Access, you can allow access only from devices that meet these requirements.

Bonus: Secure Score and the backup Microsoft doesn't do for you

Microsoft Secure Score in the Defender portal rates your configuration and gives specific recommendations. Don't chase 100% — use it as a tracker: check it once a month and note what you've improved.

And one thing that surprises many owners: Microsoft operates on a shared responsibility model. It keeps the platform running, but it doesn't provide full point-in-time backup of your data by default. Deleted email stays recoverable for 14 days by default (up to 30 if configured), and SharePoint and OneDrive recycle bins keep files for 93 days. After that — or after ransomware has synced encrypted files — the data may be gone. That's why you need a separate backup: the paid Microsoft 365 Backup service or a third-party solution. You'll find more on strategy in our complete guide to data backup.

Microsoft 365 security checklist: a 30-minute review

• MFA is on for all users (Security Defaults or Conditional Access)
• Legacy authentication is blocked
• Admins use separate accounts; fewer than five Global Admins
• Two emergency (break-glass) accounts exist, with credentials stored offline
• Automatic external forwarding is off
• Standard or Strict preset policies are applied
• DKIM is enabled for your own domain and a DMARC record exists
• The audit log is on and alerts are configured
• External sharing is restricted and "Anyone" links expire
• User consent to apps is restricted
• Devices are encrypted and managed (Intune)
• Secure Score is reviewed monthly
• There's an independent backup of email, OneDrive, and SharePoint

These settings are part of a broader strategy — see also our 10 essential cybersecurity measures for small business.

Frequently Asked Questions

Do I need Business Premium for good Microsoft 365 security?

It's not mandatory, but it provides the most important tools: Conditional Access, Safe Links, Safe Attachments, and Intune. With Basic or Standard you can still turn on Security Defaults, preset policies, DKIM/DMARC, and auditing. If you handle sensitive personal data, Premium is usually worth it.

Does Microsoft back up my Microsoft 365 data?

Microsoft keeps the platform running and offers limited windows for recovering deleted content, but not full point-in-time backup by default. Under the shared responsibility model, protecting your data is your job, so we recommend a separate backup.

What are Security Defaults, and should I turn them on?

Security Defaults are a free bundle of baseline protections in Microsoft Entra — mandatory MFA registration, MFA for admins, and blocking of legacy protocols. If you don't have Business Premium, they should almost always be on. With Premium you replace them with more flexible Conditional Access policies.

How often should security settings be reviewed?

We recommend a monthly look at Secure Score and alerts, and a deeper audit at least once a year or whenever your team changes. Microsoft frequently adds and renames features, so settings from two years ago may no longer be enough.

Want someone to check your Microsoft 365?

Most of these settings take minutes if you know where to look — and hours if you don't. At SNM Support we run a Microsoft 365 security review: we check your current configuration, switch on the missing protections without disrupting your team, and keep them up to date as part of our subscription IT support.

Contact us for a free initial consultation through our contact page or call +359 88 273 6921 — we'll tell you which of the 10 settings are missing from your tenant.