The Microsoft 365 Security Settings Most Small Businesses Miss
Microsoft 365 ships with sensible defaults for a company that has an IT department and a security team. For everyone else, several of the settings that matter most are either off, optional, or buried three levels into a portal nobody opens.
None of what follows is exotic. These are the gaps we would expect to find in a tenant that was set up correctly, has been running fine for years, and has never been reviewed since the day it was configured.
Legacy authentication, and what is actually left of it
Basic authentication, a password sent with every request, cannot enforce MFA. For years this was the mechanism behind a large share of business email compromise in organizations that believed they were protected: MFA was on, but the attacker authenticated through a path where it never applied.
Microsoft has since permanently disabled Basic auth in Exchange Online for POP, IMAP, ActiveSync, EWS, Remote PowerShell, the Offline Address Book, Autodiscover and Outlook, and it cannot be re-enabled. Closing that door is one of the reasons attackers moved to stealing session tokens instead.
One exception remains: SMTP AUTH client submission, unchanged through December 2026, disabled by default for existing tenants at the end of that month, with admins still able to re-enable it temporarily, and unavailable by default for tenants created after that. That path is send-only. A stolen password used there can send mail as your user, but cannot read the mailbox or create an inbox rule.
Blocking legacy authentication in Conditional Access is still worth doing, because certificate-based ActiveSync and other legacy clients remain in scope. But in most tenants this is now a cleanup item rather than the open door it was in 2022. Before you block, check what still uses it: a multifunction printer that scans to email, a line-of-business app with hardcoded credentials. Finding them is the work; the block itself is a policy.
MFA is enabled but not enforced
There is a meaningful difference between “MFA is turned on” and “authentication is impossible without it.”
Common patterns worth checking:
- MFA registered for most users, with a handful of exclusions that were meant to be temporary
- Executives exempted because they found it disruptive, which are the accounts with the most authority and the most valuable mailbox
- Service accounts excluded because nobody wanted to break an integration
- Break-glass admin accounts that were never revisited
Pull the actual list of exclusions from your conditional access policies rather than trusting your memory of how it was configured. The exclusion list is where the risk lives, and it tends to grow quietly. It is also the exact thing a cyber insurance renewal is asking about when it wants to know whether MFA is enforced, which we cover in our cybersecurity FAQs.
Mailbox auditing is off, or nobody knows the retention
Microsoft enables mailbox auditing by default on modern tenants, but retention of those logs depends on your licensing, and default retention is shorter than most incident timelines.
This matters at exactly one moment: when you are trying to determine what an attacker accessed. Business email compromise is frequently discovered weeks after the initial access. Standard licensing keeps unified audit records for 180 days; E5 or a Purview Audit add-on gets you 365 days and the option to go further. Mailbox audit entries themselves default to 90 days. If your incident is discovered outside that window, you cannot answer the question your clients, your insurer, and possibly a regulator will ask.
Find out what your retention actually is. If it is shorter than you would want, that is either a licensing decision or a log-export decision, but it needs to be a decision rather than a discovery.
Mail forwarding rules can be created silently
One of the first things an attacker does after compromising a mailbox is create a rule that forwards mail externally, or moves messages matching “invoice” or “wire” or “payment” into an obscure folder so the real owner never sees the thread they are hijacking.
Two settings worth confirming:
- Automatic external forwarding is blocked or restricted rather than permitted by default
- You receive an alert when a new forwarding rule is created
The second one is the difference between discovering this in hours and discovering it when a client asks why they paid an invoice to an unfamiliar bank account.
Everyone can consent to third-party apps
By default in many tenants, any user can grant a third-party application access to their data: mailbox, files, calendar. It takes one convincing consent screen.
This is a genuinely underappreciated path, because it does not require stealing a password and it survives a password reset. The permission grant persists until someone revokes it.
Restrict user consent to an admin approval workflow, and review the applications that already hold permissions in your tenant. Most organizations doing this for the first time find at least one thing they do not recognize.
Sharing defaults are broader than intended
SharePoint and OneDrive sharing defaults often allow “Anyone with the link,” which creates a URL that works for anybody who has it, forever, with no authentication and no audit trail of who used it.
That link gets pasted into an email, forwarded, and lives in someone’s inbox indefinitely.
For most small businesses the sensible default is sharing limited to people inside the organization, with external sharing available deliberately rather than automatically, and expiring links where external sharing is genuinely needed.
Retention is the related question people ask only after something is gone. How far back Microsoft can actually go, and what that depends on, is covered in our cloud IT FAQs.
Nobody is watching the alerts
Microsoft 365 generates useful security alerts. In many small tenants they are routed to an unmonitored mailbox, or to an admin address that receives so much automated mail that real alerts are invisible.
Two questions worth answering honestly:
- Where do security alerts go?
- Who looked at one last?
An alert nobody reads is not a control. It is a record that will be reviewed after an incident to establish that you were told.
Guest accounts accumulate
Every external collaborator added to a Teams channel or shared document becomes a guest in your directory. They rarely get removed when the project ends.
Review the guest list periodically. You are looking for people who left their company, vendors you no longer use, and accounts nobody can identify.
If your company runs on cloud and SaaS with no directory every device joins, this is one part of a larger access problem, which is being able to answer who could reach customer data, and when. That is the subject of our page for fintech, healthtech and insurtech companies.
How to work through this
Most of these are configuration decisions in a platform you already pay for. One exception worth knowing before you start: Conditional Access, which is how you enforce MFA properly and how you read your own exclusion list, needs Microsoft Entra ID P1. That is included in Microsoft 365 Business Premium, E3 and E5, but not in Business Basic or Business Standard. On those plans you get Security Defaults instead, which is better than nothing and much blunter.
A reasonable order, roughly by impact:
- Find and block legacy authentication (after inventorying what depends on it)
- Pull your MFA exclusion list and shrink it to genuinely necessary entries
- Restrict external mail forwarding and alert on new rules
- Require admin approval for third-party app consent
- Tighten sharing defaults
- Confirm audit log retention meets your needs
- Route security alerts somewhere a person actually looks
- Clean up guest accounts
These are worth doing and they are cheap. They are not the whole picture. The technique behind most Microsoft 365 account takeovers now is adversary-in-the-middle phishing that captures the session token after a legitimate MFA prompt. The user does everything right and the attacker still gets in. Defending against that means phishing-resistant methods such as passkeys or certificate-based authentication, device compliance conditions, and watching for sign-ins and token use that do not fit the user. Treat this list as the floor, not the ceiling.
One caution: blocking legacy authentication without inventorying dependencies will break something, usually a printer or a scanner, usually on a Monday. Do the inventory first.
If you would rather have someone outside your team walk this list with you, tell us what you are running. We will tell you honestly what we see.
Questions this post answers
Is MFA enough to stop Microsoft 365 account takeovers?
Not on its own. Most Microsoft 365 account takeovers now use adversary-in-the-middle phishing, which captures the session token after a legitimate MFA prompt. The user does everything right and the attacker still gets in. Defending against that technique takes phishing-resistant methods such as passkeys or certificate-based authentication. It also takes device compliance conditions and watching for sign-ins and token use that do not fit the user. Also pull the actual MFA exclusion list from your Conditional Access policies, since that list tends to grow quietly.
How can we stop a hacker from quietly forwarding our Microsoft 365 email?
One of the first things an attacker does after breaking into a mailbox is create a rule. The rule forwards mail outside the company. Or it moves messages with words like “invoice” or “wire” into an obscure folder, so the real owner never sees the thread being hijacked. Block or restrict automatic external forwarding, and set an alert for new forwarding rules. That alert can mean catching the problem in hours instead of when a client asks why they paid an invoice to an unfamiliar bank account.
Do we need Microsoft 365 Business Premium to enforce MFA?
To enforce MFA properly, you need Conditional Access, and Conditional Access needs Microsoft Entra ID P1. Entra ID P1 is included in Microsoft 365 Business Premium, E3 and E5. It is not included in Business Basic or Business Standard. On those two plans you get Security Defaults instead, which is better than nothing and much blunter. Conditional Access is also how you read your own list of MFA exclusions.