Securing Microsoft 365: 7 settings most small businesses miss

Microsoft 365 does not arrive locked down. The subscription hands you strong security tools, and most of them sit switched off or half-configured until someone turns them on. The seven settings below close the gaps attackers use most, and almost all of them cost nothing beyond the license you already pay for. Work through them in order. The first two stop the majority of account break-ins on their own.

1. Turn on MFA for every user, not just admins

Microsoft now requires multi-factor authentication to reach the admin center, with full enforcement live as of February 9, 2026. No administrator signs in without it. That is only the floor. Attackers do not stop at administrators, and a single standard mailbox is enough to send invoice fraud under a name your customers trust. Turn MFA on for everyone. The fastest route for a small team is Security Defaults in the Microsoft Entra admin center, which switches on app-based MFA for all users in a few clicks. If you need exceptions or finer control, Conditional Access policies do the same job with more precision. Either way, give staff a couple of weeks to register the Microsoft Authenticator app before you enforce, and set aside two emergency admin accounts so nobody gets locked out.

2. Block legacy authentication

MFA only helps if attackers cannot walk around it. Old email protocols like POP3, IMAP, and SMTP AUTH predate modern sign-in and cannot prompt for a second factor. Someone with a stolen password can connect through one of them from anywhere in the world and never see an MFA screen. Security Defaults blocks legacy authentication for you. If you run Conditional Access instead, add a policy that blocks it and disable the unused protocols in Exchange Online. Check your sign-in logs first for anything still speaking the old protocols, usually a copier that scans to email or an aging line-of-business app, and update it before you flip the switch.

3. Cut down your Global Admin accounts

Every Global Administrator account is a master key to your tenant: users, licenses, security settings, and data. The more keys you hand out, the bigger your target. Keep the count small, a handful at most, and give each administrator a separate account for admin work. Do your daily email and browsing from a standard account, and save the admin login for admin tasks. If one of those everyday accounts gets phished, the attacker lands on a standard mailbox instead of the controls for your whole company.

4. Turn on Safe Links and Safe Attachments

Business Premium and the standalone Defender for Office 365 include two filters that many tenants never switch on. Safe Attachments opens incoming files in an isolated sandbox and checks them for malware before they reach a mailbox. Safe Links rewrites the URLs in email and Office documents so each link is scanned at the moment someone clicks, which catches sites that looked clean when the message first arrived. Both stop threats the standard spam filter waves through. If your plan includes them, open the Defender portal and turn them on.

5. Lock down external file sharing

Out of the box, SharePoint and OneDrive let people share files with anyone, sometimes through links that need no sign-in at all. That feels convenient, and it is how sensitive documents quietly end up public. Set sharing to require a sign-in, limit or turn off anonymous "anyone" links, and review who your team has already shared with. You can still work with outside partners. You just do it through links tied to a real identity you can revoke later.

6. Stop spoofing with SPF, DKIM, and DMARC

These three DNS records tell the rest of the internet which servers are allowed to send email using your domain. Without them, a scammer can forge messages that look like they came from your company, and receiving systems have no clean way to reject the fakes. SPF lists your legitimate senders, DKIM signs your outgoing mail, and DMARC tells other providers what to do with anything that fails the first two. Set all three, confirm your real mail still passes, then move DMARC to an enforcement policy. It protects your customers and your reputation as much as your own inbox.

7. Turn on audit logging and watch for sneaky inbox rules

When an account is compromised, one of the first moves is a hidden mailbox rule that forwards or deletes incoming mail so the real owner never sees the fraud in progress. Turn on audit logging so those actions get recorded, and set alerts for new forwarding rules and unusual sign-ins. Then actually read the alerts. Microsoft Secure Score, in the same admin area, grades your tenant against these controls and gives you a running checklist of what is still open, which makes a useful monthly review for whoever owns your IT.

None of this needs new software or a bigger plan. It needs someone to sit down, work through each setting, confirm it holds, and check it again as Microsoft keeps changing the defaults underneath you. That last part is the catch. The defaults move, and a setting that was safe last year can quietly reopen.

Frequently asked questions

Does Microsoft 365 come secure by default?

No. Microsoft 365 includes strong security tools, but most arrive switched off or half-configured. Until someone turns on MFA, blocks legacy authentication, and tightens sharing, the gaps attackers use most are left open. The protection is there; it just has to be enabled.

What is the single most important Microsoft 365 security setting?

Multi-factor authentication for every user, not just admins. Paired with blocking legacy authentication, so a stolen password cannot connect through old protocols that skip the MFA prompt, those two settings stop the majority of account break-ins on their own.

Do I need Business Premium, or will Business Standard do?

Most of these settings work on any Microsoft 365 business plan. Business Premium, or the standalone Defender for Office 365, adds Safe Links and Safe Attachments, which scan links and files for malware, so a couple of the seven require that higher tier.

Can I make these changes myself?

Several are a few clicks in the Microsoft 365 admin center, but the order matters and some changes can lock users out if rushed. Give staff time to register the Authenticator app, keep two emergency admin accounts, and check sign-in logs before blocking legacy protocols. Many small businesses prefer to have it done and documented.

How often should these settings be reviewed?

At least monthly. Microsoft changes default settings over time, so a control that was safe last year can quietly reopen. Microsoft Secure Score grades your tenant against these controls and gives a running checklist, which makes a good monthly review.