Microsoft secures the platform, but how your tenant is configured is your responsibility. Many security features are switched off, left at permissive defaults, or only available on certain licences. The steps below are listed roughly in order of impact. Start at the top.
Key points
- Multi-factor authentication (MFA) for every account is the single most effective step.
- Legacy sign-in methods bypass MFA. Microsoft will disable Basic authentication for SMTP AUTH by default in existing tenants at the end of December 2026, so check printers, scanners and apps that send email.
- Microsoft 365 Business Premium adds Conditional Access, Intune device management and Defender for Office 365 Plan 1, which many SMEs find worth the upgrade.
- Retention and recycle bins are not a full backup. Plan how you would recover from deletion or ransomware.
1. Turn on MFA for everyone
Stolen passwords are behind a large share of account compromises. MFA stops most of these attacks, because a password alone is no longer enough. Every Microsoft 365 tenant can use security defaults, a free setting that requires users to register for MFA and protects administrator sign-ins. If you have Microsoft Entra ID P1 (included in Microsoft 365 Business Premium), Conditional Access lets you set more precise policies.
Prefer the Microsoft Authenticator app or passkeys over text messages, which are the weakest option. MFA on cloud services such as Microsoft 365 is also mandatory for Cyber Essentials.
2. Block legacy authentication
Older sign-in protocols (Basic authentication) send a username and password with no MFA, so attackers use them to get around it. Security defaults and Conditional Access can block legacy authentication for most services.
One exception catches many small offices: devices and applications that send email using SMTP AUTH, such as multifunction printers, scan-to-email and older line-of-business software. Microsoft has announced that Basic authentication for SMTP AUTH will be disabled by default for existing tenants at the end of December 2026. List these devices now and move them to a supported method before then.
3. Protect your administrator accounts
- Use separate admin accounts for administration only, never for email or browsing.
- Keep the number of Global Administrators small (Microsoft recommends fewer than five), and give other admins only the roles they need.
- Keep two emergency access ("break glass") accounts, stored securely, in case normal sign-in fails.
- Require strong MFA for every admin account. Microsoft has been rolling out mandatory MFA for its admin portals, including the Microsoft 365 admin centre.
4. Strengthen email protection
Email is still the main route for phishing and malware. Exchange Online Protection is included with every Microsoft 365 business plan. Microsoft Defender for Office 365 Plan 1, included in Business Premium, adds Safe Links (checking links when they are clicked) and Safe Attachments (opening attachments in a sandbox first).
Protect your domain too. Publish SPF, turn on DKIM signing for your own domain, and add a DMARC record so receiving mail servers can reject messages that impersonate you. Start DMARC in monitoring mode, then tighten it once legitimate mail is passing.
5. Keep automatic forwarding to external addresses blocked
A common trick after an account is compromised is to set up a rule that quietly forwards every email to an outside address. Exchange Online blocks automatic external forwarding by default. Keep it that way, allow exceptions only where there is a genuine business need, and check mailboxes for suspicious inbox rules.
6. Control sharing in SharePoint, OneDrive and Teams
Links that work for "anyone" are convenient, but they can be forwarded indefinitely. Set the default sharing link to people in your organisation or specific people, require expiry dates for any anonymous links you allow, and review guest access periodically.
7. Manage and secure your devices
An account is only as secure as the device it is used on. With Microsoft Intune (included in Business Premium) you can enforce encryption, screen locks and updates, and with Conditional Access you can allow access to company data only from devices that meet your requirements. For personal phones, app protection policies can protect company data in Outlook and Teams without managing the whole device.
8. Turn on logging, and look at it
Check that audit logging is on (it is by default for most organisations), and review risky sign-ins and alerts in the Microsoft Defender and Entra admin centres. Microsoft Secure Score lists recommended improvements for your tenant and is a useful checklist, although not every recommendation will suit every business.
If something does go wrong, logs are how you find out what happened. Under UK GDPR, a personal data breach that is likely to put people at risk must be reported to the ICO within 72 hours of becoming aware of it. That is much easier when the evidence exists. Our guide to SIEM, SOAR and managed security monitoring explains how continuous monitoring helps.
9. Back up Microsoft 365 data
Microsoft keeps the service running, but recycle bins and retention settings are not designed as a complete backup. Deleted items expire, ransomware can encrypt synced files, and a compromised admin account can delete data at scale. A separate backup of mailboxes, OneDrive, SharePoint and Teams gives you an independent copy you can restore from. Check how far back you can restore and how long a full restore would take.
10. Train your team
Technology stops most attacks, but people still receive the ones that get through. Short, regular training and realistic phishing simulations help staff spot suspicious emails and, just as importantly, report them quickly. Make reporting easy and never punish people for raising a concern.
Which licence do you need?
Microsoft 365 Business Basic and Business Standard include core protections such as security defaults and Exchange Online Protection. Microsoft 365 Business Premium adds Microsoft Entra ID P1 (for Conditional Access), Microsoft Intune, Microsoft Defender for Business and Defender for Office 365 Plan 1, which covers most of the steps above in one licence. Which is right depends on your risk, your devices and how your team works.
How Pulsar IT can help
Every Pulsar IT support plan includes our Microsoft 365 management and security baseline. We configure MFA, Conditional Access (where your licences support it), anti-phishing and secure sharing policies across your tenant, and review them regularly. Microsoft 365 backup and email filtering are available as additional services. Book a free security review to see how your tenant measures up, or build a quote.
How secure is your Microsoft 365?
We will review your tenant and give you a clear, prioritised list of improvements.