Microsoft secures its data centres. Securing your accounts, email and files is your job. That's the shared responsibility model, and it's why so many small-business breaches start in a Microsoft 365 mailbox. These six settings make the biggest difference.
1. Multi-factor authentication for everyone
Including the owner, the front desk and any shared mailboxes people sign in to. Use the authenticator app, not text messages.
2. Block legacy sign-in
Older email protocols ignore multi-factor authentication entirely. If nobody needs them, turn them off.
3. Separate admin accounts
Day-to-day email shouldn't happen from a Global Administrator account. Keep admin rights on separate accounts used only for administration.
4. Stop automatic forwarding to outside addresses
Attackers who get into a mailbox often set up quiet forwarding rules to copy every email. Block external auto-forwarding unless there's a documented reason.
5. Review external sharing
Check whether OneDrive and SharePoint allow "anyone" links, and how long they stay open.
6. Turn on the audit log and alerts
If something does happen, the audit log is how you find out what was accessed. Make sure it's on, and that someone gets alerts for risky sign-ins.
We review and harden Microsoft 365 tenants without disrupting staff. Learn more or book a review.