Most Microsoft 365 breaches don't start with a sophisticated attack — they start with a weak default setting nobody got around to changing. If you're running a small business on Microsoft 365, here's a practical, no-jargon walkthrough of the settings that actually matter, in the order we'd tackle them for a new client.
1. Turn on multi-factor authentication for everyone
This is the single highest-impact change you can make. A password alone is not enough — credential leaks happen constantly, often from breaches that have nothing to do with you. MFA means a leaked password alone isn't enough to get into an account.
Don't stop at admin accounts. Every user should have MFA enabled, because attackers don't only target administrators — a compromised regular mailbox is still a foothold into your business.
2. Set up Conditional Access, not just MFA
MFA alone still prompts users constantly and can train people to click "Approve" without thinking. Conditional Access policies let you be smarter about it — for example, requiring MFA only when someone signs in from an unfamiliar location or device, while trusted company devices on a known network sign in more smoothly.
This needs Azure AD Premium (included in Microsoft 365 Business Premium), which is one reason we usually recommend Business Premium over Business Standard for anyone serious about security.
3. Review who actually has admin access
Admin roles tend to accumulate over time — someone was made an admin to fix one issue two years ago and never lost the access. Every admin account is a bigger target, so the goal is least privilege: only the access someone actually needs, only for as long as they need it.
- List everyone with Global Administrator access — there should usually be 2–3 people, not 10
- Use role-specific admin roles (like Exchange Admin or User Admin) instead of Global Admin where possible
- Remove admin access for anyone who's changed roles or left the company
4. Lock down mail forwarding rules
A common, quiet attack: someone's mailbox gets compromised, and the attacker sets up a rule to silently forward all incoming mail (including password resets) to an external address. Most business owners never think to check for this.
5. Set a sensible password policy — and then rely on MFA more than the password
Modern guidance (including Microsoft's own) has shifted away from forcing frequent password changes, which tends to make people choose weaker, more predictable passwords. A long passphrase that doesn't expire every 30 days, combined with MFA, is more secure in practice than a short complex password that rotates monthly.
6. Turn on Microsoft Defender for Office 365 (or at least Safe Links & Safe Attachments)
Phishing emails are still the most common way small businesses get breached. If you're on Business Premium, Defender for Office 365 is included and scans links and attachments in real time — make sure it's actually turned on, not just licensed.
7. Back up your Microsoft 365 data separately
This surprises a lot of business owners: Microsoft is responsible for the uptime of the service, not for backing up your data against accidental deletion, ransomware, or a disgruntled employee wiping a SharePoint site. A separate backup of Exchange, SharePoint, and OneDrive data is a genuinely different thing from Microsoft's built-in retention, and it's worth having.
The short version
If you only do three things this week: turn on MFA for every user, review your admin account list, and check for suspicious mail forwarding rules. Those three alone close the majority of the gaps we find during a first audit.