Most small-business Microsoft 365 tenants we review are missing at least a few basic protections. None of these settings needs extra software, and together they block the most common attacks we see — stolen passwords, phishing and fake invoices sent from a hacked mailbox.
1. Multi-factor authentication for every user
A stolen password alone should not be enough to get in. Turn on MFA for everyone, not just the owner or admins. On most small tenants, Microsoft’s security defaults do this in one switch; with Business Premium you can use Conditional Access for more control.
2. Block legacy sign-in methods
Older email protocols can bypass MFA completely. Security defaults and Conditional Access can block them. Check that no old printer, scanner or app still depends on them before you switch them off.
3. Separate admin accounts
The account you read email with every day should not be a global administrator. Use a separate admin account, protected with MFA, and keep the number of global admins to two or three.
4. Stop automatic forwarding to outside addresses
Attackers who get into a mailbox often set up a rule that quietly forwards your email to them. Blocking external auto-forwarding closes that door. Allow exceptions only where there is a real business need.
5. Set up SPF, DKIM and DMARC for your domain
These DNS records help stop criminals sending email that pretends to come from your domain, and they help your real email reach customers’ inboxes instead of spam.
6. Remove old accounts and review guest access
Former employees, test accounts and guests from old projects are easy ways in. Review users, guests and shared mailboxes every quarter, and follow a proper offboarding checklist when someone leaves.
7. Manage the devices that access company data
If company email is on unmanaged phones and laptops, a lost device is a data breach. With Microsoft Intune (included in Business Premium) you can require encryption and a screen lock, and wipe company data remotely.
Check where you stand
Microsoft Secure Score, in the Microsoft Defender portal, gives your tenant a score and a list of recommended improvements. It is a good starting point — but the recommendations need context, because not every item matters equally for a small business.
If you would rather have someone check it for you, our Microsoft 365 security audit reviews all of the above and gives you a plain-English, prioritized fix list. Meet Software Solutions is based in Greater Sudbury and works with businesses across Northern Ontario and Canada.