Microsoft 365 security: the settings that actually reduce risk

Start with identity, because that is where the attacks are

Microsoft 365 compromises in small businesses almost never begin with a technical exploit of Microsoft's platform. They begin with a credential — phished, reused from another breach, or guessed — and they succeed or fail based on what stands behind that credential.

Enforce multi-factor authentication on every account without exception, including service accounts and the director who insists it is inconvenient. Partial MFA coverage is the pattern attackers rely on: they enumerate accounts and find the one that was excluded. If you are on Business Premium, implement this with Conditional Access so you can control the conditions. If you are on a plan without Entra ID P1, enable Security Defaults, which gives you baseline MFA free.

Then disable legacy authentication. Older protocols — POP3, IMAP, SMTP AUTH and pre-modern Outlook clients — were designed before MFA existed and cannot present a second factor. A tenant with MFA enforced but legacy authentication enabled has a documented bypass sitting open. Microsoft has retired basic authentication for most Exchange Online protocols, but SMTP AUTH commonly survives because a scanner, a copier or a line-of-business application uses it. Find those devices, move them to a modern method, and turn it off.

Separate administrative privilege from daily work

The most damaging configuration in a small Microsoft 365 tenant is the one nearly all of them start with: the owner's everyday account is also a Global Administrator. That account reads email, clicks links, opens attachments and signs in on a phone — and it can also delete every mailbox in the organisation.

Split it. Create a dedicated administrative account, used only for administration, with its own strong credentials and phishing-resistant MFA. Remove Global Administrator from the everyday account. Keep the number of Global Administrators very small; Microsoft's guidance is fewer than five, and most small businesses need two — one working account and one emergency access account.

Create at least one break-glass account: a Global Administrator excluded from Conditional Access, with a long unique password stored offline, used only when normal access fails. Without it, a misconfigured Conditional Access policy can lock every administrator out of the tenant simultaneously. Monitor sign-ins to that account — it should never be used.

Close the persistence routes attackers actually use

Once an attacker is inside a mailbox, they need to stay useful after the password is changed. Two mechanisms dominate: inbox rules and OAuth application consent.

Inbox rules are the classic business email compromise move — a rule that forwards anything containing 'invoice' or 'payment' to an external address, and deletes it from the inbox so the real user never sees the thread. Block automatic external forwarding at the tenant level and alert on new forwarding rules. This is one of the highest-value alerts a small business can configure.

OAuth consent is the quieter one. A user is tricked into granting a malicious application permission to read their mail; the application keeps that access even after a password reset and MFA re-registration, because it holds its own token. Restrict user consent so that only administrators can approve applications requesting sensitive permissions, and review consented applications periodically.

• Block automatic external forwarding in the outbound anti-spam policy
• Alert on the creation of new inbox forwarding rules
• Restrict user consent to applications; require admin approval for sensitive scopes
• Review enterprise applications and their granted permissions quarterly
• Enable unified audit logging and know how to search it before you need to

Turn on the protections your licence already includes

If you hold Business Premium, you are paying for Defender for Office 365 Plan 1 and Defender for Business. A surprising proportion of tenants have never configured either.

Enable Safe Links so URLs in email and Teams are checked at click time rather than delivery time — this matters because attackers commonly weaponise a link after the message has passed inspection. Enable Safe Attachments so attachments are detonated in isolation before delivery. Apply the anti-phishing policy with impersonation protection for your key people: the finance manager and the director are the two accounts most often spoofed.

Microsoft provides preset security policies (Standard and Strict) that configure most of this in a few clicks. For a small business with no dedicated security staff, applying the Standard preset to all users is a substantially better outcome than a hand-built policy nobody maintains.

Know what good looks like, and check it monthly

Microsoft Secure Score gives you a numeric baseline and a prioritised list of improvements specific to your tenant. It is imperfect — it rewards some changes that matter little and cannot see your business context — but as a monthly ten-minute review it is far better than nothing, and it makes progress visible to non-technical directors.

Pair it with a short manual check that Secure Score will not do for you: are there accounts that should have been removed, are there Global Administrators nobody can account for, and has anyone enabled external forwarding since last month.