Microsoft 365 security for business: the settings that make the difference

Microsoft 365 security depends mainly on how an organisation configures its own environment: Microsoft protects the infrastructure, but accounts, settings and data are the responsibility of those who use them. The measures that make the difference are few and clear: multi-factor authentication for everyone, conditional access, separate admin accounts, email protection, sharing rules and an independent backup of your data.

Microsoft 365 has become the place where many companies keep almost everything: email, documents, calendars, chat and meetings. For the same reason it is one of the favourite targets for anyone trying to break into a business. Here are the settings to check, in order of priority.

Why isn't Microsoft 365 security automatic?

Microsoft 365 security is not automatic because the platform follows a shared responsibility model: Microsoft looks after data centres, networks and service availability, while tenant configuration, account management and data protection are down to the organisation. Many protection tools already exist, but not all of them are switched on, or configured properly, out of the box.

The consequences of a compromised account are very real: access to correspondence with customers and suppliers, to shared files and to the ability to send convincing emails in the company's name, which underpins much payment fraud.

The good news is that the most effective measures do not require major investment: most are already included in the licences the company pays for and simply need switching on and configuring properly. The real work lies in doing so in a way that fits how people actually work, without blocking legitimate activity.

How do you enable multi-factor authentication in Microsoft 365?

Multi-factor authentication should be enabled for every user, either through security defaults or, for finer control, through conditional access. It is the measure with the best return on effort: a password that has been stolen, guessed or reused from another service is no longer enough to get in.

Which method to choose

Not all second factors are equally strong. In increasing order of robustness:

1. Text messages and voice calls: better than nothing, but exposed to interception and SIM swapping.
2. Authenticator app with number matching: the user types the number shown on screen into the app, which cuts down on approvals given by mistake.
3. Passkeys and physical security keys: phishing-resistant, because they are bound to the genuine site and cannot be replayed on a fake page.

Block legacy authentication

Older email sign-in protocols do not support a second factor and remain a side door that attackers still use. Block them, after checking that no device or application in use, such as a printer that emails scans, still depends on them.

What is conditional access and when do you need it?

Conditional access is a set of rules that decide who can reach company data, from where and on which devices. It is available with licences that include Microsoft Entra ID P1, such as Microsoft 365 Business Premium, and becomes necessary when security defaults are no longer enough. Typical policies include:

• requiring a second factor for every sign-in, or at least for those from outside the company network;
• blocking sign-ins from countries where the business does not operate;
• allowing access to company data only from managed devices that meet your security rules;
• requiring stronger verification for administrative tasks and sign-ins flagged as risky.

These are powerful rules, which is exactly why they need careful design, testing in report-only mode and a gradual roll-out, so that the wrong people are not locked out or, worse, let in.

How should admin accounts and passwords be protected?

Admin accounts are protected by keeping them few, separate and secured with the strongest authentication available. Global administrators should use dedicated accounts, distinct from the ones they use for daily email, and hold only the privileges they genuinely need. An emergency access account, carefully safeguarded, is also worth having so you can regain control if an access policy ever locks everyone out.

For user passwords, alongside the second factor, the key habit is never reusing them across services. A business password manager gives everyone unique, complex credentials without having to remember them, and allows team passwords to be shared in a controlled way.

Which settings protect email, files and devices?

Email, sharing and devices are protected by a handful of targeted settings that reduce both the risk of compromise and the damage if something goes wrong.

Email

• Automatic forwarding to external addresses blocked: it is one of the first things an attacker sets up on a compromised mailbox, so they can keep reading mail even after the password is changed.
• SPF, DKIM and DMARC configured for your domain, making it harder for others to send emails that appear to come from your company.
• Anti-phishing policies and link and attachment scanning, using Microsoft Defender for Office 365 where your licence includes it.
• A visible tag on external messages, which helps people spot impersonation.

Sharing and devices

SharePoint and OneDrive make sharing files very easy, sometimes too easy. It is worth restricting links that anyone can open, setting expiry dates on external sharing and reviewing access regularly. On devices, central management lets you enforce encryption, updates and screen locks, and wipe company data from a lost laptop or phone.

People

Technical settings work better when the people using email can recognise a phishing attempt and know whom to report it to. Short, practical cybersecurity training with realistic examples completes the protection.

Do you need a Microsoft 365 backup?

Yes, you need an independent Microsoft 365 backup, because recycle bins and retention features are limited in time and scope and are not designed for every recovery scenario. This is the most common misconception: the data is in Microsoft's cloud, so it must be safe. Some cases where only a backup lets you recover:

• a deletion discovered weeks later;
• the mailbox of someone who left the company, removed along with their licence;
• files encrypted by ransomware on a computer and synced to OneDrive or SharePoint;
• a configuration error or malicious action by a compromised account.

A backup of Exchange, OneDrive, SharePoint and Teams, with retention periods set by you and tested restores, belongs in a complete backup and disaster recovery plan.

Ongoing checks

Security settings are not configured once and for all: users, licences and features change, and so do the risks. Some checks to include in a regular review:

• make sure the audit log is active and that alerts on suspicious sign-ins reach someone who actually reads them;
• review the list of administrators and unused accounts, disabling those belonging to people who have left;
• check the third-party applications allowed to access tenant data;
• look at the external shares still active in SharePoint and OneDrive;
• consult Microsoft's security score to find recommendations that are still open.

A tenant configured thoughtfully from the start and looked after consistently takes far less work over the years than one that has to be put back in order after an incident.

For an in-depth security review of your cloud environment, you can also rely on Cybernix, VAY's cybersecurity division.

If you would like to know how your company's Microsoft 365 is set up today and which settings to tackle first, get in touch and we can review it together.

Frequently asked questions

Does Microsoft 365 back up my data?

Microsoft guarantees the service is available and provides recycle bins and retention features, but these are limited in time and scope. To recover data deleted long ago, removed accounts or files encrypted by ransomware, you need an independent backup run on rules you set.

What are Microsoft 365 security defaults?

They are a set of baseline protections Microsoft provides at no extra cost: they require multi-factor authentication, block legacy sign-in protocols and protect administrative actions. They are a good starting point for smaller organisations, but they do not allow custom rules.

Which licence do I need for conditional access?

Conditional access requires Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium and in the Enterprise E3 and E5 plans, among others. With these licences you can set rules based on user, location, device and application.

Why block automatic email forwarding to external addresses?

Attackers who compromise a mailbox often set up a rule forwarding mail to an outside address, so they can keep reading it even after the password is changed. Blocking automatic forwarding, apart from authorised exceptions, closes that route.

Is a text message a secure second factor?

It is better than no second factor, but it is the weakest option because it is exposed to interception and SIM swapping. An authenticator app with number matching, passkeys or physical security keys are preferable.