Microsoft 365 ships with sensible defaults, but a lot of small business tenants were set up years ago, by someone who has since moved on, before some of those defaults existed. These six settings cost nothing extra on the common business plans and close the gaps I see most often.
1. Multi-factor sign-in for everyone
A stolen password is the most common way into a mailbox. A second step, usually a prompt on the phone, stops most of those attempts.
If your plan does not include Conditional Access, turn on security defaults in the Microsoft Entra admin centre. It asks every user to set up the Authenticator app and blocks older sign-in methods that skip the second step. If you have Business Premium, use Conditional Access policies instead, which give you finer control.
2. Separate admin accounts
The account you read email with should not be a global administrator. Give each admin a separate account used only for admin work, so a phishing email to the everyday account cannot change the whole tenant. Keep one emergency admin account with a long password stored offline, in case the others are locked out.
3. Automatic forwarding to outside addresses: off
After someone breaks into a mailbox, the first thing they often do is add a rule that quietly forwards mail to an outside address. Newer tenants block automatic external forwarding by default. Older ones may not. Check the outbound spam policy in the Microsoft Defender portal, and make an exception only for the mailbox that genuinely needs one.
4. DKIM signing and a DMARC record for your domain
These let other mail servers check that mail claiming to be from your domain really is. Turn on DKIM signing for your domain in the Defender portal, then publish a DMARC record in your DNS. Start DMARC at p=none, read the reports for a few weeks, and move to p=quarantine or p=reject once you know every service that sends as you.
5. The “External” tag in Outlook
A visible tag on mail from outside the company makes a fake “message from the owner” much easier to spot. It is one command for an administrator in Exchange Online PowerShell:
Set-ExternalInOutlook -Enabled $true6. The audit log
If something goes wrong, the audit log is how you find out what happened: who signed in, from where, and which rules changed. It is on by default in most tenants, but check it in the Microsoft Purview portal. A log that was never switched on cannot be switched on after the fact.
Before you change anything
- Tell staff a day ahead that they will be asked to set up the Authenticator app.
- Make the changes on a quiet morning, not on a Friday afternoon.
- Write down what you changed and when, so the next person knows.
The free IT check-up includes a read-only look at these settings, and the written plan says which ones to change first.