The default problem

Microsoft 365 out of the box is configured for ease of deployment, not for security. Every setting defaults to the most permissive option. External users can be invited to SharePoint folders without approval. Legacy authentication protocols — POP3, IMAP, SMTP AUTH — are available and do not support MFA. The audit log may not be enabled. Mail flows without external sender warnings. Sharing links default to "Anyone with the link."

For a small business without an IT department, these defaults persist indefinitely. Nobody changes them because nobody knows they exist. They persist until an attacker exploits them — or until an article like this one prompts a Saturday afternoon spent in the admin centre.

This is not a criticism of Microsoft. Permissive defaults reduce support calls during deployment. The product needs to work out of the box for organisations of every size, including those with no security expertise. But deployment is a moment. The configuration that follows is permanent, and it is your responsibility. These are the controls that matter, in order of impact.

MFA for all accounts

The first thing to enable. Nothing else on this list matters if an attacker can sign in with a stolen password and face no second challenge.

Security Defaults is free and available on every M365 plan. Enable it in the Azure Active Directory portal under Properties → Manage Security Defaults → toggle to Enabled. It turns on MFA for every user via the Microsoft Authenticator app. It blocks legacy authentication protocols. It requires MFA for administrative actions. It requires all users to register for MFA within 14 days.

Security Defaults is the minimum viable security posture. It is a single toggle that addresses the most common attack path — password compromise followed by unobstructed login.

Conditional Access is available on Business Premium and above. It replaces Security Defaults with fine-grained policies — you cannot run both simultaneously. Conditional Access lets you define rules: require MFA from untrusted networks, block sign-ins from countries where you have no staff, require compliant devices for access to SharePoint and OneDrive, set session timeouts for web access. If you have Business Premium, use Conditional Access instead of Security Defaults. The additional control is worth the configuration effort.

The MFA tutorial covers multi-factor authentication across all your services — not just M365 but Google Workspace, banking, domain registrars, and everything else.

Disable legacy authentication

Legacy protocols — POP3, IMAP, SMTP AUTH, Exchange ActiveSync with basic authentication — predate modern authentication. They accept a username and password. They do not support MFA. They do not support Conditional Access policies. They are a clean bypass around every access control you have configured.

An attacker with a stolen password can authenticate via IMAP and download every email in the mailbox. No MFA prompt. No Conditional Access evaluation. No location check. The password is the only barrier, and the password was already stolen.

Security Defaults blocks legacy authentication by default. If you are using Conditional Access instead, you must create an explicit policy to block it. Navigate to Conditional Access → New Policy. Name it "Block legacy authentication." Under Conditions → Client apps, select Exchange ActiveSync clients and Other clients. Under Grant, select Block access. Apply to all users. Exclude your break-glass admin account — a dedicated emergency account with a strong password and hardware key MFA that bypasses Conditional Access, used only when all other admin accounts are locked out.

Most small businesses do not use legacy authentication protocols. Outlook desktop and Outlook mobile use modern authentication by default. The rare exceptions: old multifunction printers that scan-to-email via SMTP AUTH, or email clients that have not been updated in years. Check with your team before disabling. Give a two-week notice. Verify no essential function depends on these protocols. Then block them.

You can check for legacy authentication sign-ins in the Azure AD sign-in logs. Navigate to Azure Active Directory → Sign-in logs → filter Client App to show legacy clients. If the log shows active legacy sign-ins, identify the source before blocking.

Enable the unified audit log

The audit log records sign-ins, file access, mailbox activity, admin actions, SharePoint changes, and Teams activity. Without it, you have no record of what happened after a breach. No way to know which mailboxes were accessed. No way to know which files were downloaded. No way to trace the attacker's movements. No forensic trail at all.

On some M365 plans, unified audit logging is not enabled by default. Enable it in the Microsoft Purview compliance portal → Audit → Start recording user and admin activity. The toggle is easy to miss — it is a single button on a page that looks administrative rather than critical.

Retention depends on your licence. E5 and Business Premium retain audit logs for one year. E3 and lower plans retain for 90 days. Ninety days is often insufficient — the average time to discover a breach exceeds 200 days. If your plan only retains for 90 days, consider exporting logs regularly to a SIEM or to Azure Log Analytics for longer-term storage.

Verify logging is active by running this in Exchange Online PowerShell:

Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-1) -EndDate (Get-Date) -RecordType AzureActiveDirectory -ResultSize 1

If it returns a result, logging is active. If it returns nothing despite recent sign-in activity, it is not enabled. Enable it and check again the following day.

External sender flagging

The majority of phishing emails impersonate someone inside your organisation. The attacker uses the same display name as a colleague — "John Smith" — with an external email address. Without a visual indicator, the recipient sees a familiar name and responds without checking the address.

Create a mail flow rule in the Exchange admin centre that prepends [EXTERNAL] to the subject line of every email from outside your organisation. Navigate to Exchange admin centre → Mail flow → Rules → Create a new rule. Set the condition to "The sender is located outside the organisation." Set the action to "Prepend the subject of the message with [EXTERNAL]."

This is the simplest anti-impersonation control you can deploy. An email from "John Smith, Managing Director" that arrives with [EXTERNAL] in the subject immediately tells the recipient it did not come from their colleague. It requires no training beyond telling staff what the tag means.

For a more visible warning, enable the external email tag in the Exchange admin centre under Settings → Mail flow → External sender identification. This adds a yellow banner at the top of every external email in Outlook and Outlook on the web. The banner reads "You don't often get email from this sender" for first-time correspondents, or marks the email as from an external sender.

The mail flow rule and the external email tag complement each other. The subject-line tag is visible in the inbox list without opening the email. The banner is visible after opening. Deploy both.

Safe Links and Safe Attachments

Available on Business Premium and above — part of Microsoft Defender for Office 365.

Safe Links rewrites URLs in emails and Office documents. When a user clicks a link, the request is routed through Microsoft's scanning infrastructure, which checks the URL against known-malicious lists and analyses the destination page in real time. Critically, it checks at click time, not just at delivery time. An attacker who sends a clean link that redirects to a malicious payload an hour later — a technique called delayed detonation — is caught when the user clicks the link, not when the email was delivered.

Enable Safe Links in the Defender portal → Policies & Rules → Threat Policies → Safe Links. Create a policy that applies to all users. Enable URL rewriting and checking and real-time URL scanning. Enable Safe Links for Office applications to extend protection to links in Word, Excel, and PowerPoint documents. Enable Do not let users click through to the original URL to prevent users from bypassing the warning.

Safe Attachments opens email attachments in a sandbox — an isolated virtual environment — and analyses them for malicious behaviour before delivering them to the recipient. It detonates the attachment in a controlled environment, watches for suspicious activity (unexpected network connections, registry modifications, process injection), and blocks the attachment if it detects anything malicious.

Enable Safe Attachments in the same Threat Policies section. Set the action to Dynamic Delivery. Dynamic Delivery delivers the email immediately with a placeholder attachment while the real attachment is scanned in the sandbox. The recipient sees the email, reads the text, and the attachment appears within a few minutes. This avoids delivery delays while maintaining protection.

These controls catch threats that signature-based antivirus misses — zero-day malware, novel phishing kits, and delayed-detonation links. They are worth the Business Premium licence cost on their own.

Conditional Access policies beyond MFA

With Business Premium, Conditional Access enables several controls beyond the basic MFA requirement. Each of these narrows the attack surface.

Geographic restrictions — Conditional Access → Named Locations → create a named location listing the countries where your staff operate. Then create a policy: New Policy → Conditions → Locations → Include: Any location, Exclude: your named location → Grant → Block access. A UK small business with no overseas staff or travel should allow sign-ins from the United Kingdom only. This blocks credential-stuffing attacks originating from botnets in other countries, which account for the majority of such attacks.

Ensure you have a process for staff who travel. Either add the destination country temporarily, or issue the traveller a hardware key and create an exception policy that allows sign-in from any location with a hardware key.

Device compliance — require devices to be enrolled in Microsoft Intune and meet compliance policies before accessing SharePoint and OneDrive. Compliance policies can require disk encryption, a minimum OS version, a screen lock, and active antivirus. This prevents data access from unmanaged personal devices — an employee's personal laptop with no encryption and an outdated operating system.

Session controls — set session timeouts for web-based access. An employee who signs into M365 via a browser at a shared workstation or a library computer is signed out automatically after a defined period of inactivity. Set a reasonable timeout — 60 minutes is common. This prevents abandoned sessions from being exploited.

Sign-in risk policies — if you have Azure AD Identity Protection (included with some Business Premium and all E5 plans), enable risk-based policies. These detect anomalous sign-in behaviour — sign-ins from unfamiliar locations, impossible-travel scenarios (signing in from London and then from Lagos twenty minutes later), or sign-ins from known-malicious IP addresses — and require additional verification or block the attempt.

SharePoint and OneDrive sharing defaults

The default sharing level is often Anyone with the link — meaning a shared link works without authentication. Anyone who obtains the link, by any means — forwarded email, indexed by a search engine, found on a lost USB stick — can access the file. No identity check. No access log.

Change this in the SharePoint admin centre → Policies → Sharing. Set the organisation-level default to Only people in your organisation. Users can still share externally on a per-link basis when they need to — they override the default deliberately, rather than sharing externally by accident.

Set link expiry for external sharing links. Thirty days is reasonable. After that, the link stops working and must be re-shared intentionally. This prevents abandoned links from accumulating indefinitely, each one a potential access path that nobody monitors.

Disable Anyone links entirely if your business does not need anonymous external sharing. Most small businesses can share externally via Specific people links, which require the recipient to authenticate.

Review the external sharing report quarterly. Navigate to SharePoint admin centre → Reports → Sharing. Look for files shared with personal email addresses (Gmail, Hotmail — not business addresses), files with "Anyone" links still active, and files shared with external domains you do not recognise. Revoke what should not be there.

Separate admin accounts

No administrator should use their admin account for daily work. Not for reading email. Not for browsing the web. Not for opening attachments. Not for clicking links in Teams messages. Every one of those activities exposes the session to attack. A compromised admin session gives an attacker control of the entire M365 tenancy — every mailbox, every file, every user, every setting.

Create dedicated admin accounts with a naming convention — admin-john@yourdomain.com — separate from john@yourdomain.com. The admin account should not have a mailbox. It should not have an M365 licence assigned for email or Office apps. It exists solely for administrative tasks and should be used only when performing those tasks.

Enable MFA with a hardware key on every admin account. Hardware keys are justified here even if the rest of the organisation uses authenticator apps — the admin account is the highest-value target.

Limit global administrators to two or three. Global Administrator is the most powerful role in M365 — it can modify any setting, access any mailbox, delete any user. Most administrative tasks do not require it. Use role-specific admin roles instead: Exchange Administrator for email settings, SharePoint Administrator for file sharing, User Administrator for account management. The principle of least privilege applies to admin roles exactly as it does to file permissions.

Create one break-glass account — a Global Administrator account with a strong, randomly generated password stored in a physical safe, with MFA configured via a hardware key also stored in the safe. This account is used only when all other admin accounts are locked out. It should be excluded from Conditional Access policies (except MFA) to ensure it always works. Check the sign-in logs for this account monthly — any sign-in that was not a deliberate emergency is cause for investigation.

Mailbox audit logging

Mailbox audit logging records who accessed each mailbox, what they did, and when. It covers three categories of access: owner (the person whose mailbox it is), delegate (someone with delegated access, such as a personal assistant), and admin (an administrator who accessed the mailbox). It logs actions including reading messages, creating or deleting items, moving items to other folders, creating forwarding rules, and downloading attachments.

This is critical for investigating compromised mailboxes. It tells you whether the attacker read specific emails, created auto-forwarding rules to exfiltrate ongoing correspondence, accessed specific folders, or downloaded the mailbox contents.

On E5 and Business Premium plans, mailbox audit logging has been enabled by default since January 2019. On older plans or tenancies created before that date, it may not be. Verify it:

Get-Mailbox -ResultSize Unlimited | FL Name, AuditEnabled

Every mailbox should show AuditEnabled: True. If any show False, enable them:

Set-Mailbox -Identity "user@yourdomain.com" -AuditEnabled $true

To enable it for all mailboxes in a single command:

Get-Mailbox -ResultSize Unlimited -Filter {AuditEnabled -eq $false} | Set-Mailbox -AuditEnabled $true

Auto-forwarding rules

Attackers who compromise a mailbox frequently create an auto-forwarding rule that silently copies every incoming email to an external address. The user sees nothing unusual. Their mailbox works normally. Meanwhile, every email they receive — including password resets, invoices, contracts, and confidential correspondence — is also delivered to the attacker.

Block external auto-forwarding at the transport level. Navigate to Exchange admin centre → Mail flow → Rules → Create a new rule. Set the condition to "The message type is auto-forward." Set a second condition: "The sender is located inside the organisation." Set a third condition: "The recipient is located outside the organisation." Set the action to "Block the message."

Alternatively, use the anti-spam outbound policy in the Defender portal. Navigate to Policies & Rules → Threat Policies → Anti-spam → Anti-spam outbound policy. Set Automatic forwarding rules to Off — Forwarding is disabled. This blocks all external auto-forwarding for the entire tenancy.

Then audit existing forwarding rules. Run this in Exchange Online PowerShell:

Get-Mailbox -ResultSize Unlimited | Get-InboxRule | Where-Object {$_.ForwardTo -or $_.ForwardAsAttachmentTo -or $_.RedirectTo} | FL MailboxOwnerId, Name, ForwardTo, ForwardAsAttachmentTo, RedirectTo

Any rule forwarding to an external address that the mailbox owner did not create is evidence of compromise. Investigate immediately.

Sensitivity labels

Even a simple classification scheme helps people make better decisions about handling documents. It makes the handling expectation visible. A document labelled Confidential signals to every person who touches it that it should not be forwarded externally, saved to a personal device, or discussed in a public place.

Create three labels in the Purview compliance portal → Information protection → Labels:

Set Internal as the default label for new Word, Excel, and PowerPoint documents. This means every new document starts with a classification. Staff only need to change it when creating something public or something confidential — the common case is handled automatically.

Train staff to apply Confidential to anything containing customer personal data, financial data, employee data, or intellectual property. The training takes ten minutes. The habit takes a week to form.

Password policies

M365 defaults to a 90-day password expiry. Microsoft's own guidance, aligned with NIST SP 800-63B, now recommends against mandatory periodic password changes — they lead to predictable patterns (Summer2026!, Autumn2026!) and encourage weaker passwords. Disable password expiry in Azure Active Directory → Password Protection → set Password expiry policy to Passwords never expire.

This sounds counterintuitive. The reasoning is sound. With MFA enabled, a stolen password alone is insufficient. Forcing regular changes degrades password quality without improving security. Instead, enforce a minimum password length of 14 characters, ban common passwords using Azure AD Password Protection (enabled by default), and rely on MFA as the primary defence against credential theft.

If a password is known or suspected to be compromised, reset it immediately. Do not wait for the next scheduled expiry. Compromised credentials require immediate action, not calendar-based action.

Implementation order

Deploy these controls in this sequence. Each step reduces the most risk for the least effort, and each step builds on the one before it.

The first three items take less than an hour combined. The entire list is achievable in an afternoon. None of it requires third-party tools. All of it is included in the M365 licence you already pay for.

The email hardening tutorial covers the self-hosted side of the same problem for organisations running their own mail infrastructure.

The operational picture

M365 defaults are permissive by design. Override them deliberately. Enable MFA and block legacy authentication first — these two controls close the most common attack path against cloud email. Turn on the unified audit log so you have evidence when you need it. Flag external senders so impersonation is visible. Enable Safe Links and Safe Attachments to catch threats that static scanning misses. Lock down sharing defaults to prevent accidental exposure. Separate your admin accounts to limit the damage a single compromised session can cause. The entire list requires no additional spend beyond your existing licence, moves your M365 tenancy from a default-permissive state to a defended one, and sits alongside the five controls that matter as part of a layered small-business security posture.