1. Enforce multi-factor authentication for everyone
Not 'enable' — enforce. Via Security Defaults at minimum, or Conditional Access policies for proper control. Every user, every time, no exceptions. This alone stops the overwhelming majority of account compromises.
2. Separate admin accounts
Nobody should be checking email from an account with Global Admin rights. Admin accounts should be separate, have no mailbox, no licence, and be used only for admin tasks. Limit Global Admins to two or three, and give everyone else the least privilege they need.
3. Block legacy authentication
Older protocols (POP, IMAP, SMTP AUTH, older Outlook versions) bypass MFA entirely. Attackers know this. Block legacy authentication via Conditional Access, and fix the one old scanner or app that breaks as a result.
4. Turn on unified audit logging
It's off by default in many tenants. Without it, you can't see who did what — and after an incident, that's the first thing you'll want to know. Turn it on. It's free.
5. Restrict mailbox forwarding
The classic sign of a compromised account is a hidden rule forwarding every email to an external address. Block automatic forwarding to external domains at the tenant level, and alert on new inbox rules.
6. Control external sharing in SharePoint and OneDrive
By default, users can share files with anyone on the internet via a link. Restrict this to specific domains or authenticated users, and set links to expire.
7. Configure anti-phishing and Safe Links
Defender for Office 365 (included in Business Premium) provides impersonation protection, Safe Links (URLs checked at click-time) and Safe Attachments (files detonated in a sandbox). Configure them; the defaults are conservative.
8. Set up Conditional Access for location and device
Block sign-ins from countries you don't operate in. Require managed, compliant devices for sensitive access. These policies close a huge range of attack paths and are almost never configured in small business tenants.
9. Enable self-service password reset with MFA
Lets staff reset their own passwords securely — reducing helpdesk load and the temptation to write passwords on sticky notes — while requiring a second factor to do it.
10. Back up Microsoft 365 independently
Not a setting, but a requirement. Microsoft doesn't back up your data in a way that protects against deletion, ransomware or retention gaps. A third-party backup of Exchange, SharePoint, OneDrive and Teams is essential, and it should be tested.
How to check yours
Microsoft Secure Score in the admin centre gives you a percentage and a list of recommendations. Most small business tenants score under 40%. If you'd like someone to walk through it with you, a free IT health check covers all ten of these.
TechFix Pro Managed
Find out where your business actually stands.
Free 15-minute IT health check for Sydney businesses. One workstation, your Microsoft 365 tenant, a plain-English report. No obligation.
Frequently asked questions
Do I need Microsoft 365 Business Premium for these settings?
Numbers 1, 2, 4, 5, 6 and 9 work on any Business plan. Numbers 3 and 8 need Conditional Access (Entra ID P1, included in Business Premium). Number 7 needs Defender for Office 365 (Business Premium). Number 10 is a separate product regardless of plan.
Will enforcing MFA disrupt our staff?
Briefly. Each user sets up the Authenticator app once (about two minutes). After that, they're prompted occasionally, not constantly. The disruption of an account takeover is considerably worse.
What is Microsoft Secure Score?
A built-in measurement in the Microsoft 365 admin centre that scores your tenant's security configuration and lists improvements. It's a useful benchmark — but it's a score, not a guarantee.
Related articles