If your business runs on Microsoft 365, your mailbox is probably the single most valuable thing an attacker can get into. It holds client conversations, invoices, banking details and password-reset emails for almost every other system you use. And because Microsoft 365 is so widely used, criminals have had plenty of practice breaking into it.
The good news: most successful attacks on small businesses' Microsoft 365 accounts exploit settings that are free to fix. This checklist covers ten that make the biggest difference. You don't need to be technical to understand them, but you may want your IT provider to switch them on with you.
Microsoft regularly renames and moves settings in its admin portals. If a menu path below doesn't match what you see, search the admin centre for the setting name, or ask your IT provider.
1. Turn on multi-factor authentication for everyone
This is the most important setting on the list. With multi-factor authentication (MFA), a stolen password alone isn't enough to get in; the attacker also needs the code or app approval on the user's phone.
- If you're on Business Basic or Business Standard: switch on security defaults in the Microsoft Entra admin centre. They're free, require MFA for all users and block older sign-in methods that can't do MFA.
- If you're on Business Premium: use Conditional Access policies instead, which give you finer control. For example, you can require MFA everywhere but allow fewer prompts on company devices.
Encourage staff to use the Microsoft Authenticator app rather than SMS codes where possible.
2. Keep admin accounts separate and few
The Global Administrator role can do anything in your tenant, including reading every mailbox and deleting everything. Treat it like the keys to the building.
- Give admin rights to as few people as possible. Microsoft recommends fewer than five Global Admins, and at least two so you aren't locked out if one person is unavailable.
- Use a separate admin account for admin work, not the account you use for daily email and browsing.
- Make sure every admin account has MFA. No exceptions.
- Remove admin rights from former staff and from IT providers you no longer use.
3. Block automatic forwarding to outside addresses
One of the first things attackers do after breaking into a mailbox is set up a rule that quietly forwards copies of all email to an outside address. They keep reading your mail long after you've changed the password.
In the Microsoft Defender portal, check your outbound spam filter policy and make sure automatic forwarding to external addresses is turned off. If someone genuinely needs forwarding, allow it for that mailbox only.
4. Switch on the preset email protection policies
Microsoft 365 includes built-in protection against spam, phishing and malicious attachments, but the defaults aren't the strongest available. In the Defender portal, look for preset security policies and apply the Standard (or Strict) protection profile to all users.
If you have Business Premium, this also switches on Defender for Office 365 features such as Safe Links and Safe Attachments, which check links and attachments before your staff open them.
5. Tag emails from outside the business
A simple "External" tag on emails from outside your organisation makes it much easier for staff to spot an email pretending to come from the boss or a colleague. It's a small change with a big effect on CEO-fraud and fake-invoice scams. Your IT provider can switch it on for Outlook in a few minutes.
6. Make sure audit logging is on
When something goes wrong, the audit log is how you find out what happened: who signed in from where, which mailbox rules were created, which files were downloaded. It's on by default for most organisations, but check that it's enabled in the Microsoft Purview portal. If you ever have to report a breach under POPIA, this record is invaluable.
7. Get alerts to someone who reads them
Microsoft 365 has built-in alert policies for suspicious activity, such as new forwarding rules, unusual file deletions and elevated admin activity. They're only useful if the alerts go to a mailbox that someone actually reads. Check where they're sent, and make sure it isn't an old admin account nobody checks.
8. Tighten file sharing in OneDrive and SharePoint
By default, staff may be able to create "Anyone with the link" sharing links, which work for anyone who gets hold of the URL, no sign-in required.
- Change the default link type to "People in your organisation" or "Specific people".
- If you allow "Anyone" links, set them to expire automatically, for example after 30 days.
- Periodically review what's been shared externally, especially folders containing client or employee information.
9. Sort out passwords, and old accounts
- With MFA on, long passphrases are better than frequent forced changes. Microsoft no longer recommends regular password expiry.
- Switch on self-service password reset (with MFA) so staff aren't tempted to share or write down passwords.
- When someone leaves, block their sign-in on their last day, then convert the mailbox to a shared mailbox if you need to keep it. Don't leave old accounts active "just in case".
10. Remember Microsoft isn't your backup
Microsoft keeps your service running, but it's not a full backup of your data. Deleted items and recycle bins only go back so far, and ransomware or a malicious insider can delete or encrypt files that then sync everywhere.
Consider a Microsoft 365 backup service, either Microsoft's own or a third party's, that keeps independent copies of email, OneDrive and SharePoint, and test a restore at least once.
A 30-minute starting point
If you only do three things this week, do these:
- MFA for everyone, via security defaults if you have nothing else.
- Block external auto-forwarding.
- Review who has admin rights and remove anyone who shouldn't.
Together they close the doors most commonly used to break into small businesses' Microsoft 365 accounts.
Don't forget the devices that sign in
Microsoft 365 settings protect the account. But attackers increasingly go after the computer first, with malware that steals saved passwords and browser sessions and lets them sign in as your user, sometimes even past MFA.
That's where EZ Cyber Guard fits in. It monitors the laptops and desktops your team uses to sign in to Microsoft 365, alerts you in plain language when it sees suspicious behaviour such as password-stealing malware, and flags missing updates before attackers find them. Check where your business stands with the free POPIA Security Readiness Check, or start a 7-day free trial.