3 Microsoft 365 Settings Every SME Should Switch On
Most Microsoft 365 break-ins we hear about would have been stopped by settings you already pay for. Here are the three to check first.
· Microsoft 365 · 4 min read
You do not need a bigger budget to make Microsoft 365 much harder to break into. These three settings are already available to you. Each one takes under an hour, and together they deal with the most common ways small companies get caught out.
1. Multi-factor Authentication for Every Account
A stolen password is the usual way in. With multi-factor authentication (a second check on your phone at sign-in), that password alone is no longer enough.
On most Business plans the simplest route is to turn on security defaults in the Microsoft Entra admin centre. If you have Business Premium, use Conditional Access policies instead, which let you handle exceptions properly. Tell staff the day before, because they will each need to register the authenticator app.
2. The Standard Preset Security Policy
Microsoft ships ready-made policies for spam, phishing and malware. In the Microsoft Defender portal, go to Email and collaboration, then Policies and rules, then Threat policies, and open Preset security policies. Applying the Standard preset to all users is a sensible starting point for most companies.
3. Block Automatic Forwarding to Outside Addresses
After breaking into a mailbox, attackers often add a quiet rule that copies every email to themselves, then wait for an invoice to change. Check the outbound spam policy in Defender and make sure automatic external forwarding is switched off. If a real business reason exists, allow that one mailbox rather than everyone.
What to Do Next
Check these three this week. If you would rather have someone look at it for you, our free IT health check covers all of them and gives you a short written list of anything else worth fixing.