Five Microsoft 365 security settings every small business should check

Microsoft 365 is the front door to most small businesses: email, files, Teams and the accounts that tie them together. It's also where most attacks start. The good news is that a handful of settings stop the majority of them. Here are the five we check first in every tenant.

1. Require multifactor authentication for everyone

Stolen passwords are the most common way into a business. Multifactor authentication (MFA) stops the vast majority of those attacks cold.

• No Entra ID P1 licenses? Turn on security defaults in the Microsoft Entra admin center. It's free and requires MFA registration for every user.
• Have Microsoft 365 Business Premium or Entra ID P1? Use Conditional Access policies instead. They give you finer control, such as requiring MFA everywhere but trusting compliant company devices.

Prefer the Microsoft Authenticator app or passkeys over text messages wherever you can.

2. Make sure legacy authentication is blocked

Older sign-in protocols can't do MFA, so attackers love them. Security defaults block legacy authentication automatically; if you use Conditional Access, create a policy that blocks it explicitly. Then check your sign-in logs for anything that still depends on it—old copiers and line-of-business apps are the usual suspects.

3. Protect your domain with SPF, DKIM and DMARC

These three DNS records tell the world which servers may send mail as your domain and what to do with messages that fail the check. Without them, anyone can send convincing email that appears to come from you.

1. SPF lists the services allowed to send as your domain.
2. DKIM signs your outgoing mail; enable it for your domain in the Microsoft Defender portal and publish the two CNAME records it gives you.
3. DMARC tells receivers what to do with failures. Start with p=none and a reporting address, review the reports, then move to quarantine and eventually reject.

4. Keep admin accounts few and separate

Every global administrator is a skeleton key. Aim for at least two but fewer than five, use separate admin accounts that aren't used for day-to-day email, and give people the narrowest role that does the job—User Administrator or Exchange Administrator instead of Global Administrator. Keep one emergency "break-glass" account with a long, securely stored password, excluded from policies that could lock everyone out.

5. Stop users from granting access to unknown apps

By default, users may be able to let third-party apps read their mail and files with a single click—a favorite trick of phishing campaigns. In Entra ID, restrict user consent to verified publishers (or turn it off) and set up the admin consent workflow so people can request apps you then review.

Where to go from here

None of these changes requires new software, and together they close the gaps behind most small-business breaches. If you'd like a second pair of eyes, we're happy to review your tenant and give you a prioritized list—get in touch.