Microsoft 365 Business Premium includes strong security tooling, but almost none of it is on by default. These seven settings close the gaps we see exploited most often. Each takes under an hour, and most take ten minutes.
1. Multi-factor authentication for everyone
No exceptions, including executives and shared mailboxes. Use the Microsoft Authenticator app with number matching rather than SMS codes. This one setting stops the majority of account takeovers.
2. Conditional access instead of legacy defaults
Turn on Security Defaults at minimum. Better, create conditional access policies that require MFA, block legacy authentication protocols, and require compliant or managed devices for access to email and files.
3. Block legacy authentication
Old protocols such as IMAP, POP and SMTP basic auth bypass MFA entirely. Attackers know this. Block them and fix the two devices that still needed them.
4. Safe Links and Safe Attachments
Defender for Office 365 rewrites links so they are checked at click time and detonates attachments in a sandbox before delivery. Turn both on for all users, including for links inside Teams.
5. Anti-phishing impersonation protection
Add your executives and finance team to the impersonation protection list so emails pretending to be from them are flagged or quarantined. Enable mailbox intelligence so Defender learns who normally emails whom.
6. Disable auto-forwarding to external addresses
A common post-breach move is a hidden rule forwarding every email to an attacker. Block external auto-forwarding at the tenant level and alert on new inbox rules.
7. Turn on audit logging and alerts
Make sure unified audit logging is enabled and set alerts for risky sign-ins, new admin role assignments and mass file downloads. You cannot investigate what you did not record.
The licence you already pay for contains most of the protection you need. The gap is configuration, not budget.
If you would rather have someone do this for you and keep it maintained, our Microsoft 365 administration and cybersecurity services cover all of the above and the monitoring that goes with it.