Microsoft 365 security. Ten settings to check this week.

The short answer

Microsoft 365 is where most UK businesses keep their email, files and calendars, which makes it the first thing an attacker goes for. Out of the box, it's reasonably safe. But many tenants were set up years ago, before today's defaults existed, and never revisited. Turn on MFA for everyone, cut down your admins, block forwarding to outside addresses, and stop staff approving apps they don't recognise. Those four alone close the doors behind most email takeovers.

You'll need a Global Administrator account to make these changes. If an IT provider manages your Microsoft 365, send them this list and ask which ones are already done. It's a fair question, and a good provider will be glad you asked.

Before you start: which licence do you have?

Some settings are on every plan. Others need a higher licence. You can see yours in the Microsoft 365 admin centre under Billing > Your products.

Plan	What it adds for security
Business Basic and Standard	Security defaults, email filtering, audit logs, sharing controls. Enough for every step below except step 6.
Business Premium	Conditional Access, Defender for Office 365 (safer links and attachments) and device management. Worth it if you handle sensitive data or have more than a handful of staff.

The 10 settings

1. MFA for every account

This is the big one. A stolen password on its own shouldn't be enough to get in. On Basic or Standard, turn on security defaults in the Microsoft Entra admin centre (Overview, then Properties, then Manage security defaults). It switches on MFA for everyone and blocks the old sign-in methods that skip it. On Business Premium, use Conditional Access policies instead. Here's my step-by-step guide to rolling out MFA without a revolt.

2. Fewer Global Administrators

A Global Administrator can do anything, including deleting every mailbox. Microsoft recommends fewer than five. For most businesses, two is right: one for day-to-day admin and one emergency account kept somewhere safe. Admins should use a separate admin account, not the one they read email on. Check under Roles > Role assignments in the admin centre. You'll often find a former employee or an old IT supplier still on the list.

3. Block forwarding to outside addresses

One of the first things an attacker does in a mailbox is set up a rule that quietly copies every email to an address they control. In the Microsoft Defender portal, go to Email & collaboration > Policies & rules > Threat policies > Anti-spam, open the outbound policy, and set automatic forwarding to Off. If someone genuinely needs forwarding, allow it for them alone.

4. Stop staff approving unknown apps

Some phishing emails don't steal a password at all. They ask the user to "allow" an app, which then gets ongoing access to their mailbox, even after a password change. In the Entra admin centre, go to Enterprise applications > Consent and permissions and either turn user consent off or limit it to verified publishers. Staff can still request apps, and an admin approves them.

5. Turn on the preset email protection

In the Defender portal, under Threat policies > Preset security policies, apply the Standard protection preset to everyone. It switches on Microsoft's recommended anti-phishing, anti-spam and anti-malware settings in one go, and keeps them updated. It's much easier than tuning each policy by hand.

6. Safe Links and Safe Attachments (Business Premium)

If you have Defender for Office 365, which comes with Business Premium, the same presets also check links when they're clicked and open attachments in a safe space first. That catches the phishing link that looked fine when the email arrived and turned bad an hour later.

7. Tighten file sharing

"Anyone with the link" sharing is convenient, and it's also how client files end up readable by whoever finds the link. In the SharePoint admin centre, under Policies > Sharing, set external sharing to New and existing guests rather than Anyone, and make the default link type Specific people. Staff can still share with clients. It just has to be with named people.

8. Check the audit log is on

If something does go wrong, the audit log is how you find out what the attacker did and which emails they read. That matters for deciding whether to report it to the ICO. It's on by default for most tenants, but check: in Microsoft Purview, open Audit. If you see a banner offering to start recording activity, click it.

9. Look for odd inbox rules

Attackers love rules that move replies to a folder nobody looks at, so a fake invoice conversation carries on unseen. Ask each person to look under Settings > Mail > Rules in Outlook, or ask your IT provider to run a report across every mailbox. Anything that deletes, forwards or hides emails from finance contacts deserves a closer look. If you find one you didn't create, treat it as a cyber incident. Here's what to do first.

10. Protect your domain with DMARC

This one sits outside Microsoft 365, in your domain's DNS, but it matters. SPF, DKIM and DMARC stop criminals sending email that looks like it came from you. Use the free email security checker to see where you stand, then follow the DMARC guide.

Keep an eye on Secure Score

Microsoft Secure Score, in the Defender portal, rates your setup and lists improvements in order of impact. Don't chase 100%. Some suggestions won't suit you, and that's fine. But it's a handy monthly check that nothing has slipped, and it gives you something to show a customer who asks.

How this links to Cyber Essentials

Microsoft 365 is a cloud service, so it's in scope for Cyber Essentials. The scheme expects MFA on cloud services, controlled admin accounts and sensible user access, which are steps 1, 2 and 4 above. Get these right and you've done a good chunk of the work already. They also answer several of the questions on a typical customer security questionnaire.

FAQ

Will these changes stop people working?

Not if you tell them first. MFA is the only one staff will notice day to day. The rest happens in the background. Pick a quiet day, send a short heads-up, and change one thing at a time so you know what caused any problem.

My IT provider says it's all done. How can I check?

Ask them for a screenshot of each setting, or for your Secure Score with a short note on anything they've chosen to leave. You're entitled to know how your own systems are set up.

Do I need Business Premium?

Not to get started. Everything in steps 1 to 5 and 7 to 10 works on Business Basic or Standard. Premium is worth it once you want Conditional Access, safer links and attachments, and control over the laptops and phones that connect.

What if we've already had a suspicious sign-in?

Don't wait to finish the checklist. Reset the password, sign the account out everywhere, check its inbox rules and forwarding, and get help. It's a same-day emergency line with a fixed £795 first response, on 03333 401 999.