Seven Microsoft 365 security settings every business should turn on

Microsoft 365 is one of the most secure platforms a small business can run on, but a fair amount of that protection is switched off out of the box. Here are seven settings that make a real difference, roughly in order of impact.

1. Multi-factor authentication for everyone

The single highest-value change you can make. Require a second factor on every account, with no exceptions for the owner or the busy manager. Microsoft's security defaults turn this on for the whole tenant in a few clicks if you have not customised anything yet.

2. Block legacy authentication

Old mail protocols that cannot do MFA are a favourite way in for attackers. Blocking legacy authentication closes that door. Check first that nothing important still relies on it, then turn it off.

3. Conditional access rules

Conditional access lets you say things like: block sign-ins from countries you never operate in, or require MFA when someone signs in from an unmanaged device. It is one of the most powerful tools in Microsoft 365 and it is available on Business Premium.

4. Turn on Microsoft Defender for Office 365

Defender scans links and attachments in email at the moment someone clicks, not just when the message arrives. That catches phishing pages that were harmless when the email was delivered and turned malicious an hour later.

5. Set up a proper anti-phishing policy

Configure impersonation protection so that emails pretending to be from your director or your accounts team get flagged. This is where a lot of invoice fraud starts.

6. Review who has admin rights

Global administrator is the keys to the kingdom. Most people who think they need it do not. Keep the number of admins small, put MFA on every one of them, and use separate accounts for admin work.

7. Enable and test backups

Microsoft keeps your data available, but it is not a backup against ransomware or a deleted-everything accident. A dedicated Microsoft 365 backup, restore-tested on a schedule, closes that gap.

If you would like these checked and configured properly for your business, we do this every day. Book a free IT review and we will audit your Microsoft 365 security posture and hand you a prioritised list.