Most of the small businesses we audit have Microsoft 365 doing roughly what they expect it to. Email arrives. Teams works. SharePoint sort of works, if nobody’s touched it. The surprises are almost never in the day-to-day stuff. They’re hiding in the settings nobody looked at after setup, often the ones left on their defaults from the day the tenant was created.
Out of the box, Microsoft 365 is wide open on purpose. Microsoft wants new tenants to work for everyone, so the safer options are off by default. The business owner has to turn them on.
Here are twelve worth checking today. Most take five to ten minutes each, cost nothing, and don’t need an engineer.
1. Legacy sign-in protocols
Older authentication methods (POP, IMAP, basic SMTP auth) are still switched on in a lot of tenants we see. They bypass multi-factor authentication entirely, which is exactly why attackers love them. You can roll out MFA across the whole business, feel good about it, and still have an open side door that a stolen password walks through.
Where to look: Microsoft 365 admin centre, Settings, Org settings, Modern authentication. Untick the legacy options unless you know something still needs them (a decade-old scanner, usually).
2. Automatic forwarding to external addresses
When attackers get into a mailbox, one of the first things they often do is set a quiet rule that forwards every incoming email to a Gmail or Outlook.com address they control. You change the password, you reset MFA, you think you’ve locked them out. Meanwhile they’re still reading everything for weeks.
Where to look: Exchange admin centre, Mail flow, Remote domains, Default. Set Automatic forwarding to Off. Add specific exceptions only where a shared inbox genuinely needs to feed a ticketing system.
3. Who has Global Admin?
Open the admin centre and count the Global Admins. Microsoft’s own recommendation is two to four for most organisations. We regularly find small businesses with eight or ten, including the IT guy who left in 2022, the accountant who needed access that one time, and a shared admin account three people still know the password for.
Every Global Admin is a potential full-tenant breach. They should be rare, named, used only when needed, and reviewed every quarter.
Where to look: Microsoft 365 admin centre, Users, Active users, filter by role. Remove roles that shouldn’t be there. For people who only need admin occasionally, use Privileged Identity Management to give them access for an hour at a time, not permanently.
4. MFA coverage, not just MFA policy
“We’ve got MFA on” is the sentence we hear most, and it’s almost always only partly true. We regularly find a handful of accounts (service accounts, old admins, break-glass accounts, that one director who complained) that are quietly exempt.
Exempt accounts are the ones attackers find first. There are open-source tools that specifically look for them.
Where to look: Entra admin centre, Users, Per-user MFA, or run a Conditional Access coverage report. Any account without MFA should either have it switched on today, or have a documented reason it can’t (and a compensating control around it, like IP restrictions).
5. External sharing on SharePoint and OneDrive
The default on a lot of tenants is “anyone with the link”. A file one of your team shared with a supplier three years ago is probably still sitting on the open web, indexable by whoever finds the URL. We’ve found old customer lists, pricing documents, and in one memorable case, a full copy of a board pack this way.
You don’t have to lock it all down. You just need to know what you’ve got open, and set a default that makes sense for your business.
Where to look: SharePoint admin centre, Policies, Sharing. “Only people in your organisation” or “New and existing guests” are usually sensible defaults, with specific sites allowed to share more openly if they need to.
6. Anonymous link expiry
Even if you keep anonymous links allowed for the sites that need them, there’s no reason those links should live forever. Set a maximum expiry so a share from six months ago can’t still be used.
Where to look: SharePoint admin centre, Policies, Sharing, “Anyone” links expire in. 30 days is a sensible starting point. Set a default permission of View, not Edit.
7. SPF, DKIM and DMARC
These are three DNS records that stop other people spoofing emails from your domain. Nearly every small business we audit has SPF set up, maybe half have DKIM, and almost none have DMARC. Without DMARC, a scammer can send an email that looks exactly like it came from you, to your customers, from anywhere in the world. It’s one of the main ways small businesses end up as the launchpad for invoice fraud against their own clients.
Where to look: Your DNS host (your domain registrar or Cloudflare). Microsoft has clear step-by-step instructions for each record. Start DMARC on p=none so you can see what’s happening, then move to p=quarantine and p=reject once you’re confident nothing legitimate is being blocked.
8. Audit log retention
After an incident, the first thing we try to do is reconstruct what happened: who signed in, from where, what they touched. Microsoft 365’s default audit log retention is 180 days on most licences, and historically it was 90 days. If an attacker’s been quietly in the mailbox since February and you only notice in August, you may already have lost the forensic trail.
Where to look: Microsoft Purview, Audit, make sure auditing is turned on (it’s on by default now, but confirm). If you’re on E5 or add-on licensing that supports extended retention, apply a retention policy to push it to a year or more. If you’re not, write it in your incident response plan that you have 180 days.
9. Admin alert policies
The tenant can tell you when something looks off, but only if you ask it to. By default most of the useful alerts (new admin role assignments, forwarding rules created, unusual sign-in locations, mass file downloads from SharePoint) are either off or going to a mailbox nobody reads.
Where to look: Microsoft Purview, Policies, Alerts. Review what’s enabled, turn on the ones that matter for your business, and set them to notify an inbox that an actual human reads daily.
10. Break-glass accounts
You need two emergency accounts, with very long passwords, excluded from Conditional Access (so they can get in even if the policies break something), stored on paper in a locked drawer. If your Global Admins all get locked out at once (and we’ve seen it happen when a Conditional Access policy is rolled out badly), these are what get you back in.
No break-glass account means one bad policy change could lock you out of your own tenant for days.
Where to look: Create two cloud-only accounts, give them Global Admin, exclude them from all CA policies, set 24+ character randomly generated passwords. Store the credentials somewhere physical and secure. Review them once a year.
11. Inactive user accounts and licence hygiene
Every ex-employee whose account is still enabled is a free door for an attacker, and every enabled licence they’re not using is money going out of your bank account every month. We often find both: six leavers from the last two years still enabled, each on a Business Standard licence.
Where to look: Microsoft 365 admin centre, Users, Active users, sort by Last sign-in. Anyone who hasn’t signed in for 90+ days without a reason should be disabled and their licence reclaimed. Set a monthly reminder to repeat the sweep.
12. Mobile device baseline
If your team reads work email on personal phones and nothing’s enforcing a PIN, a lost phone is a data breach. Microsoft 365 can require a device PIN, encrypt the data, and remote-wipe the work mailbox from a lost phone, without touching anyone’s personal photos. On most licences you don’t need full Intune for this, just a basic App Protection policy.
Where to look: Microsoft Intune admin centre, Apps, App protection policies. Create one for iOS and one for Android, apply to the Office apps, require a PIN, block copy-paste to personal apps, enable selective wipe.
None of this is cutting-edge. That’s the point.
Nobody breaks into a small business with a zero-day exploit. They log in with a stolen password, through a side door nobody closed, and look around until they find something worth stealing. The hygiene above closes most of those doors.
If you’d rather someone went through the full list for you (and the 30 or so other settings we check that aren’t in this post), our Microsoft 365 Audit covers 40+ settings against the current CIS and Microsoft baselines. We write it up in plain English, prioritise what to fix first, and hand you a report you can act on, give to your IT provider, or ask us to put right.
Check your own domain in 30 seconds
Our free domain security checker runs the same tests on your domain, live. No email required.
Or if you’d rather just have a natter about where your tenant stands, Book a 30-minute IT review.