Most small businesses run on Microsoft 365 — email, files, Teams and more. It's also one of the most common targets for attackers, because getting into one mailbox can open the door to everything else. The good news is that many of the protections you need are already included in your licences. They just need setting up properly.
Here are 12 things to check. If you're on Microsoft 365 Business Premium, almost all of them are already included in what you pay for.
Identity and access
1. Turn on multi-factor authentication (MFA) for everyone
MFA is the single most effective protection against stolen passwords. Make sure it covers every user — including directors, shared mailboxes that people sign into, and admin accounts. Use an authenticator app rather than text messages where you can.
2. Block legacy authentication
Older sign-in methods used by some outdated email apps can't do MFA, so attackers use them to get around it. Microsoft's security defaults or a Conditional Access policy can block them.
3. Keep admin accounts separate — and few
Admins should use a separate account for admin tasks, not their everyday mailbox. Keep the number of Global Administrators low (Microsoft recommends fewer than five), and keep an emergency access account securely stored in case you're ever locked out.
4. Use Conditional Access
Business Premium includes Conditional Access, which lets you set rules such as "only allow sign-ins from managed devices" or "require MFA from outside the UK". It's the foundation of a Zero Trust approach.
Devices
5. Switch on Microsoft Defender for Business
Business Premium includes Defender for Business — endpoint protection with detection and response. Make sure every laptop and desktop is onboarded and reporting in.
6. Manage devices with Intune and encrypt them
Enrol company devices in Intune so you can apply security settings, push updates and wipe a lost laptop remotely. Turn on BitLocker (Windows) or FileVault (Mac) so a stolen device doesn't mean stolen data.
7. Set up SPF, DKIM and DMARC
These three DNS records help stop criminals sending emails that pretend to come from your domain, and improve the chance of your genuine emails being delivered. Start DMARC in monitoring mode, then tighten it once you're confident.
8. Tighten anti-phishing protection
Business Premium includes Defender for Office 365, with Safe Links, Safe Attachments and impersonation protection. Check they're enabled and that they cover your directors and finance team — the people attackers most often impersonate.
Data and sharing
9. Control external sharing
Review who can share files outside the business in SharePoint and OneDrive, and how guests are added to Teams. "Anyone with the link" sharing is convenient, but it's easy to lose track of what's been shared.
10. Make sure audit logging is on — and someone is watching
Audit logs record who did what. Check they're enabled and that alerts for suspicious activity (such as new mailbox forwarding rules or impossible-travel sign-ins) go to someone who will act on them.
11. Back up Microsoft 365 independently
Microsoft keeps the service running, but protecting your data from deletion, ransomware or a compromised account is your responsibility. An independent backup of mail, OneDrive, SharePoint and Teams means you can always get it back.
People and process
12. Have a proper leaver process
When someone leaves, block their sign-in, revoke active sessions, remove their devices, convert or hand over their mailbox, and remove them from shared resources — on the day they go, not weeks later.
Where to start
If you only do three things this week, make them: MFA for everyone, separate admin accounts and independent backup. Then work through the rest.
All of these are configured as standard in our managed packages, and we report on them every month — so you can see your protection, not just hope it's there.
Want us to check your Microsoft 365 for you?
Book a free review. We'll go through your tenant, prioritise the risks and show you exactly what to fix.
Get a free Microsoft 365 review