The Microsoft 365 Security Settings Small Businesses Never Turn On

Here is an uncomfortable truth about Microsoft 365: the day you signed up, Microsoft handed you a powerful security toolbox and then quietly left most of the tools in the drawer. Not because Microsoft is careless, but because a brand-new tenant has to work for everybody, from the one-person accounting shop to the sales team still using a 2011 email app. So the defaults are tuned to "everyone can log in and get their mail," not "nobody can break in."

Attackers know this better than you do. They are not sitting in a dark room writing custom code to defeat your firewall. They are logging in with a password they bought for a few dollars, through a door you never bothered to lock. And email is the door, the number one attack surface for small businesses, because your inbox is where the money conversations happen.

Let me walk you through the specific settings that separate a hardened Microsoft 365 tenant from a sitting duck. These are things a small business owner, or the IT person who helps you, can turn on. Most are free. Most take minutes. And most of them are off right now.

Why identity is the whole ballgame

Before we get into knobs and switches, understand what you are actually defending. You are not really defending "email." You are defending identity: the username and password that proves you are you. Once an attacker has your identity, your email, your files, your shared calendars, and your ability to send messages that look legitimate all belong to them.

Here is why that matters. According to Verizon's 2024 Data Breach Investigations Report, stolen credentials were involved in a large share of breaches, and the human element (someone getting phished, reusing a password, clicking the wrong link) shows up in the majority of incidents. Attackers do not need to be geniuses. They need one working login.

And they very often have one, because passwords leak constantly. This is the mechanism behind credential stuffing, where attackers take username-and-password pairs stolen from some unrelated breach and try them against your Microsoft 365 login, betting that your employee reused the same password. That bet pays off far too often.

So the single most important thing you can do is make a stolen password not enough. That is what most of the settings below accomplish.

Setting 1: Multi-factor authentication for every single user

Multi-factor authentication (MFA) means requiring a second proof of identity in addition to the password, usually a tap on an approval in an app on your phone or a one-time code. The idea is simple: even if a criminal has your password, they do not have your phone.

How effective is it? Microsoft has said publicly that enabling MFA blocks more than 99.9 percent of account compromise attacks. Read that again. One setting stops the overwhelming majority of account takeovers. In that same research, Microsoft noted it was fending off hundreds of millions of fraudulent sign-in attempts every single day. MFA is the closest thing to a silver bullet that exists in this business.

There are two ways to turn MFA on in Microsoft 365, and the difference matters.

Security Defaults is a single on-off switch Microsoft provides for smaller organizations. Flip it on and Microsoft enforces a sensible baseline: MFA required for all users, MFA always required for administrators, and old insecure sign-in methods blocked. It is free, fast, and for a small business with no full-time IT staff, often the right answer. Microsoft explains Security Defaults here.

Conditional Access is the grown-up version: a rules engine that says "if this condition is true, then require that." For example, "if someone signs in from outside our country, require MFA and block legacy apps," or "if the sign-in looks risky, force a password reset." It gives you far more control, but it requires a higher-tier license (typically Microsoft Entra ID P1, often included in Microsoft 365 Business Premium) and someone who knows how to configure it.

The rule of thumb: if you are tiny and want protection today, turn on Security Defaults. If you have Business Premium and an IT partner, use Conditional Access so you can add smarter rules. Either way, the non-negotiable is that MFA is on for everyone, especially the owner and anyone who touches money.

Setting 2: Block legacy authentication

This one is invisible and it is exactly what attackers pray you overlook.

Legacy authentication (or "legacy auth") refers to old sign-in methods used by older email protocols like IMAP, POP, and SMTP AUTH, the plumbing that lets a mail app connect to a server. The problem is that these old protocols were built before MFA existed, and they cannot present that second factor. So when a login comes in over legacy auth, it checks the password and that is it. No MFA prompt. No second door.

Think about what that means. You can turn MFA on for your whole company, feel protected, and an attacker can stroll right past it through an ancient protocol that never asks for the second factor. It is a bypass hiding in plain sight.

How much do attackers rely on this? According to Microsoft's official guidance on blocking legacy authentication, more than 97 percent of credential stuffing attacks and more than 99 percent of password spray attacks use legacy authentication protocols. Those attacks essentially stop working once legacy auth is blocked. Turning on Security Defaults blocks it automatically; with Conditional Access you create a specific policy to block it.

Setting 3: Disable automatic external email forwarding

Now we get to a favorite trick of the people running business email compromise (BEC), the scam where a criminal uses a compromised or spoofed email account to trick a company into sending money or sensitive data to the wrong place. BEC is not a small problem. The FBI's Internet Crime Complaint Center reported roughly $2.77 billion in BEC losses in 2024 alone, and the cumulative reported exposure has climbed to more than $55 billion over the past decade. This is the most expensive email crime there is. (We go deeper on how it works in our piece on business email compromise.)

Here is the specific move. When an attacker gets into a mailbox, one of the first things they do is set up a hidden rule that automatically forwards incoming mail to an outside address they control. Now they can read your invoices, contracts, and payment threads quietly, from the outside, even if you change the password later. They watch, they wait for a real invoice, and they pounce.

By default, Microsoft 365 often permits automatic forwarding to external addresses. You can and should turn that off with an outbound spam policy so users cannot silently ship copies of your mail to strangers. If a specific person genuinely needs external forwarding, you allow it as a deliberate exception, not as a default that applies to everyone.

Setting 4: Turn on Microsoft Defender for Office 365 protections

If your plan includes Microsoft Defender for Office 365 (Business Premium does), two features are worth enabling deliberately.

Safe Links rewrites the web links inside incoming emails so that when someone clicks, Microsoft checks the destination in real time, at the moment of the click, and blocks it if it has turned malicious. This matters because attackers often send a clean link first and weaponize it later, after the email has already sailed past your filters.

Safe Attachments opens suspicious attachments in an isolated sandbox, a safe throwaway environment, to watch what they do before they ever reach your inbox. If the file tries something nasty, it never gets delivered.

Together they cover the two things people actually click: links and attachments. These policies are not always configured aggressively out of the box, so set them to block rather than merely monitor.

Setting 5: Anti-phishing and impersonation protection

Microsoft 365 includes anti-phishing policies that do something clever: they watch for impersonation. Attackers love to send email that looks like it came from the boss ("Hey, can you grab some gift cards for a client, I'm in a meeting") or from a trusted vendor. Impersonation protection lets you tell Microsoft, "these are our important people and our real domains," so it can flag messages that mimic them but come from somewhere else.

You configure it by adding the names and addresses of your most-impersonated users (the owner, the finance lead) and your own domain to the protected list. It is one of the few defenses aimed squarely at the human trickery that makes BEC work.

Setting 6: Turn on audit logging so you can investigate later

Here is the part most articles skip. Prevention fails sometimes. When it does, the difference between "we contained it in an hour" and "we have no idea what happened" comes down to logs.

The Unified Audit Log records activity across Microsoft 365: who signed in, who changed a mailbox rule, who accessed which files. Mailbox auditing records actions inside individual mailboxes. Microsoft's own guidance for responding to a compromised email account leans heavily on these logs to figure out what an attacker did, including hunting down those hidden forwarding rules.

The catch is that auditing needs to be on before the incident, not after. You cannot go back in time and log something that already happened. Confirm auditing is enabled today, so that it is there on the worst day.

Setting 7: Use Microsoft Secure Score as your roadmap

You do not have to guess whether you have done enough, because Microsoft grades you. Microsoft Secure Score is a built-in scorecard, found in the Microsoft Defender portal, that measures your security posture as a percentage and lists specific improvement actions ranked by impact. Microsoft describes it as a measurement of your security posture, where a higher number means you have taken more of the recommended actions.

Think of it as a to-do list written by the people who built the product. It tells you exactly which settings to change and how many points each is worth, so you can knock out the high-impact items first. It is the single best place to start, because it turns "am I secure?" into a concrete, prioritized checklist.

Setting 8: Least-privilege admin and separate admin accounts

Administrator accounts are the master keys, and they should be treated that way. Three habits matter here.

First, least privilege: give each person only the access they actually need, not blanket admin rights "just in case." Second, keep the number of Global Admins small; Microsoft recommends limiting these all-powerful accounts to a handful of people. Fewer master keys means fewer keys to steal. Third, admins should use a separate account for admin work, distinct from the everyday account they use to read email and browse the web. That way, if their daily account gets phished, the attacker lands on a low-privilege account, not one that can rewrite your entire tenant.

Setting 9: Self-service password reset and banned-password lists

Two smaller settings round this out. Self-service password reset lets users securely reset their own passwords after verifying their identity. That sounds like a convenience feature, but it is also a security one: resets do not have to route through a help desk that a social engineer can fool. And banned-password lists let Microsoft reject weak or common passwords (and variations of your company name) before they are ever set, so "Company2026!" never becomes someone's login.

A real scenario: the invoice that quietly changed

Let me make this concrete. Picture a small design studio. Their office manager, Dana, reuses her email password on a few other sites. One of those sites gets breached. Months later, an attacker tries Dana's leaked password against the studio's Microsoft 365 login, over an old protocol, and it works, because MFA was never enforced and legacy auth was never blocked.

The attacker does not send a single flashy email. Instead, they create a hidden inbox rule that forwards all of Dana's incoming mail to an outside address. For two weeks they read everything. When a real invoice arrives from a genuine vendor, they wait for the reply thread, then jump in with a near-identical email: "We've updated our banking details, please send payment to the new account." The client pays. The money is gone before anyone notices, and because auditing was off, reconstructing what happened is a nightmare.

Every single step of that attack is stopped by settings in this article. MFA blocks the initial login. Blocking legacy auth closes the bypass. Disabling external forwarding kills the silent surveillance. Impersonation protection flags the fake reply. Audit logging lets you see it all. None of it required a bigger budget.

Your prioritized action plan

If you do nothing else this month, do these, in this order:

1. Turn on MFA for every user. For most small businesses, enabling Security Defaults does this and blocks legacy auth in one move. This is the single highest-value step, full stop.
2. Block legacy authentication if it is not already handled by Security Defaults. It closes the door that bypasses MFA entirely.
3. Disable automatic external email forwarding with an outbound spam policy, allowing exceptions only where genuinely needed.
4. Open Microsoft Secure Score in the Defender portal and work the top recommendations. It is your customized roadmap.
5. Confirm audit logging and mailbox auditing are on, today, so you can investigate if something ever goes wrong.
6. Tune Defender for Office 365: enable Safe Links, Safe Attachments, and anti-phishing impersonation protection to block rather than just monitor.
7. Clean up admin accounts: limit Global Admins, apply least privilege, and give admins separate accounts for privileged work.
8. Enable self-service password reset and banned-password protection so weak and reused passwords stop being an option.

You do not have to do all of this alone. If you would rather have someone handle the hardening and keep an eye on it, that is exactly the kind of thing our small business cybersecurity team does, and it is worth reviewing these settings whether you run Microsoft 365 or another platform.

The takeaway is simple: Microsoft 365 gave you a strong lock the day you signed up. You just have to turn the key. Almost everything above is free, and together it defeats the exact attacks that cost small businesses billions every year.