NexusSec.For many businesses, Microsoft 365 is where the important things live: email, files, Teams chats and the passwords to everything else, through password-reset emails. It also ships with defaults that suit the widest range of customers rather than yours. A few settings make most of the difference.
1. Enforce MFA for every account
Microsoft Entra ID offers two ways to do this. Security defaults is a free, single switch that requires MFA registration for everyone, requires MFA for administrators and blocks legacy authentication. Conditional Access, included with Microsoft 365 Business Premium and Entra ID P1, does the same with finer control: different rules for administrators, trusted devices and locations, and exclusions you can document. Use one of them. A tenant with neither depends on every user choosing to turn MFA on, which in practice means many will not. Our guide on where to switch on MFA first covers methods and rollout order.
2. Block legacy sign-in
Older protocols that use basic authentication cannot do MFA, so they let a stolen password straight in. Microsoft has been retiring basic authentication in Exchange Online. Check what in your office still depends on it, typically a scanner that emails documents or an old application that sends mail, and move it to a supported method before blocking the rest.
3. Keep administrator accounts few and separate
- Give administrators a separate admin account that is not used for email or browsing, protected with the strongest MFA you have.
- Keep the number of Global Administrators small, as Microsoft recommends, and give everyone else the narrower role they need, such as Exchange or User Administrator.
- Keep two emergency access accounts that do not depend on one person's phone, store their details securely offline, and alert when they are used.
- Remove admin roles from people who no longer need them, including former IT suppliers.
4. Block automatic forwarding to outside addresses
A favourite step after an attacker takes over a mailbox is a rule that quietly forwards mail, or particular mail such as invoices, to an outside address. Check that automatic forwarding to external recipients is blocked in the outbound spam policy, allow exceptions only where a business need is written down, and review existing inbox rules for forwarding. This one setting cuts off a common route for invoice fraud.
5. Make sure you can investigate
Confirm that audit logging is on, and know how long your licence keeps the logs. If something goes wrong, the questions will be who signed in, from where, and what they did. Sign-in logs, mailbox audit logs and admin activity answer them, but only if they exist when you need them. For longer retention, export them to storage you control.
6. Publish SPF, DKIM and DMARC for your domain
These three DNS records tell other mail servers which systems may send email as your domain, and what to do with mail that fails the check. Turn on DKIM signing in Microsoft 365, publish SPF, then start DMARC in monitoring mode and move it to quarantine or reject once legitimate senders, such as your billing system, are covered. See what is DMARC and our email security service.
7. Then use Secure Score
Microsoft Secure Score lists recommended improvements for your tenant and shows what each one involves. Treat it as a to-do list, not a target: some recommendations need licences you may not have, and some do not fit every business. Work through the ones that apply, in order of impact.
What these settings do not cover
Microsoft keeps the service running; protecting your data within it is your job. Retention and recycle bins are not a backup you control, as covered in backups that survive ransomware, and devices that sign in need their own protection and updates.
