Most Microsoft 365 break-ins at small companies are not clever. Someone reuses a password, clicks a fake login page, or an old setting lets an attacker sign in without being challenged. The good news is that a handful of built-in settings close most of these gaps, and many of them cost nothing extra.
Here are the six we check first in every Microsoft 365 tenant we take over.
1. Require multi-factor authentication for everyone
Multi-factor authentication (MFA) is the single most effective control against stolen passwords. If your plan does not include Entra ID conditional access, turn on Security defaults in the Entra admin centre. If you have Microsoft 365 Business Premium, use conditional access policies instead, so you can require MFA for all users and stronger checks for administrators.
Use the Microsoft Authenticator app with number matching rather than text messages wherever possible.
2. Block legacy authentication
Older email protocols such as POP, IMAP and basic SMTP authentication cannot do MFA. Attackers know this and try them first. Block legacy authentication with a conditional access policy, and disable the protocols per mailbox for users who do not need them.
3. Stop automatic forwarding to outside addresses
A favourite trick after a mailbox is compromised is to set up a silent rule that forwards every email to an outside address. In the Microsoft Defender portal, set the outbound spam policy so automatic forwarding to external domains is off, then allow it only for the few mailboxes that genuinely need it.
4. Keep admin accounts separate and few
Day-to-day accounts should not be Global Administrators. Create separate admin accounts, give them only the roles they need, and keep the number of Global Administrators to two to four. Protect them with the strongest MFA you have.
5. Turn on Safe Links and Safe Attachments
If you have Microsoft 365 Business Premium or Defender for Office 365, the Safe Links and Safe Attachments policies check links and files at the moment someone clicks or opens them. Apply the built-in Standard or Strict preset security policy to all users, so nothing is missed.
6. Review alerts and sign-in logs every week
Security settings only help if someone notices when they fire. Review the alert queue in the Defender portal and the risky sign-ins report in Entra ID at least weekly. Unusual sign-in locations and new inbox rules are early warnings worth acting on.
Where to start
If you only do one thing this week, make sure every account has MFA. Then work down this list over the next month. If you would like a second pair of eyes, we can review your tenant and send a short, prioritised list of changes.