Most of the Microsoft 365 tenants I take over for Connecticut small businesses were set up by whoever bought the licenses, usually the owner or the previous IT person, and never touched again. The accounts work, the email flows, and six or eight security settings that would have stopped the last three incidents I cleaned up are sitting at their defaults or turned off.
This post is the list I work through on every tenant. For each setting: what it stops, what it looks like when it is wrong, and where it is in the admin center. Microsoft moves these around and renames them regularly, so each item links to the current Microsoft Learn page. Verified against those pages in November 2026.
1. Multi-factor authentication for everyone, enforced
This is the one that matters most. Nearly every email takeover I have cleaned up started with a password that was guessed, phished, or reused from a site that got breached, and MFA would have stopped it.
Microsoft's own number is that MFA plus blocking legacy authentication stops more than 99.9% of common identity attacks, which they state on the security defaults page.
How to turn it on. For tenants without Entra ID P1 (Business Basic and Business Standard), use security defaults. One switch, found under Entra admin center, Entra ID, Overview, Properties, "Manage security defaults." It requires every user to register for MFA, requires it for admins every time, prompts users when the sign-in looks risky, and blocks legacy authentication. Microsoft's small business security overview notes that security defaults are on by default for new tenants, but older tenants, and tenants where someone turned it off to fix a scanner, often have it disabled.
For Business Premium, which includes Entra ID P1, use Conditional Access instead. Microsoft provides managed policies that replicate what security defaults do: require MFA for all users, require MFA for admins, block legacy authentication. Turn on all three, then add more as needed. Security defaults and Conditional Access cannot both be on, so pick one and finish the job.
What "wrong" looks like. The owner has MFA because they set it up on their phone. Nobody else does, because nobody made them. Or security defaults were turned off in 2023 because the copier could not scan to email, and never turned back on.
2. Block legacy authentication
Legacy authentication is the old way of signing in: IMAP, POP, SMTP basic auth, and old Office clients that send a username and password with no way to do MFA. Microsoft's block legacy authentication page says more than 97% of credential stuffing attacks and more than 99% of password spray attacks use these protocols. They are how an attacker gets around MFA even when you have it.
Security defaults block legacy auth automatically. On Conditional Access, it is one of the managed policies above. Either way, confirm it is actually blocking and not in "report only" mode.
The thing that usually breaks is a copier or an old application sending email through SMTP with a plain password. Microsoft's page on setting up a multifunction device to send email covers the alternatives. Do not turn off the protection for the whole company because of a scanner.
3. Separate admin accounts that are not used for email
The account that created the tenant is a Global Administrator. In most small businesses that is also the owner's everyday email account, which means the most powerful login in the company is the one receiving phishing all day.
Microsoft's guidance on admin account security is specific: use ordinary user accounts for daily work, use the admin account only when needed, keep the number of admin accounts small, and give people the least role that does the job (User Administrator instead of Global Administrator, for example). Admin-only accounts do not need a license.
They also recommend at least two emergency access accounts, sometimes called break-glass accounts, that are not tied to a person, are excluded from MFA policies so a misconfiguration cannot lock everyone out, and have long passwords stored somewhere secure. Most small tenants have zero. If the one Global Admin leaves the company or loses their phone, that is how you end up on hold with Microsoft support for days.
4. Confirm mailbox auditing is on
Mailbox auditing records what happens in each mailbox: who read what, what was deleted, what rules were created, what was sent on someone's behalf. When an account is compromised, the audit log is how you find out what the attacker did, which forwarding rule they set up, and which clients got the fake invoice.
Microsoft turns this on by default for all organizations now, per the mailbox auditing page, but it can be turned off at the organization level, and older tenants sometimes had it off. Verify with Exchange Online PowerShell:
Get-OrganizationConfig | Format-List AuditDisabled
The answer you want is False. While you are there, make sure the unified audit log is enabled in the Purview portal so you can search it when you need to.
5. Tag external email
Exchange Online can mark every message from outside the company with an "External" label in Outlook. It is a small thing that stops a surprising number of fake-CEO and fake-vendor emails, because "Hi, this is Dave, can you buy some gift cards" looks different with an External tag on it.
It is turned on with one PowerShell command, documented on the Set-ExternalInOutlook page:
Set-ExternalInOutlook -Enabled $true
If you already have a mail flow rule prepending "[EXTERNAL]" to subject lines, turn that off first so you do not get both.
6. Turn on Defender for Office 365 protections
Every Microsoft 365 mailbox has basic anti-spam and anti-malware. Business Premium also includes Defender for Office 365 Plan 1, per the Defender for Office 365 overview, which adds Safe Links (rewrites and checks URLs when they are clicked), Safe Attachments (opens attachments in a sandbox before delivery), and better anti-phishing with impersonation protection. Microsoft lists Plan 1 as included in Office 365 E3 and Microsoft 365 E3 as of July 1, 2026 as well.
The fastest way to configure it correctly is the preset security policies in the Defender portal, under Email and collaboration, Policies and rules, Threat policies. Apply the Standard preset to all users. It sets anti-phishing, Safe Links, and Safe Attachments to Microsoft's recommended values without you touching 40 individual options.
On Business Basic or Standard, Defender for Office 365 is an add-on. If the business handles money or client data by email, which is most of them, it is worth the few dollars per user. Paired with SPF, DKIM and DMARC on your own domain, this covers both directions: what comes in and who can pretend to be you.
7. Review forwarding and sharing
Two settings that are not features so much as cleanup:
Automatic forwarding to external addresses. The first thing an attacker does inside a mailbox is create a rule that quietly forwards copies of everything to an outside address. Outbound spam policies in the Defender portal can block automatic external forwarding tenant-wide. Turn that on, then check existing mailboxes for forwarding rules that are already there.
Anonymous sharing links. In SharePoint and OneDrive, "anyone with the link" sharing means a file can be reached by anyone who gets the link, forever, with no sign-in. For most small businesses the right setting is to limit external sharing to specific people or to require sign-in, and to set links to expire.
8. Offboard properly
Not a setting, but it belongs on this list. When someone leaves, that day: block sign-in, reset the password, revoke sessions, remove MFA devices, convert the mailbox to a shared mailbox if someone needs the history, and remove them from groups. Accounts for people who left years ago are in nearly every tenant I audit, and each one is a door with no one watching it. The security checklist covers offboarding and the rest of the basics.
9. If you have Business Premium, use the rest of it
Business Premium includes Intune for managing devices, Defender for Business for endpoint protection with EDR, and Entra ID P1 for Conditional Access. A lot of small businesses pay for Premium and use it as Standard with a bigger bill. If you are already paying, at least set a Conditional Access policy requiring MFA from any location, and consider requiring devices to be managed before they can open company email.
Whether to use Defender for Business or a third-party EDR is a judgment call. We run Bitdefender GravityZone on client machines because it gives us one console across every client regardless of license, but Defender for Business is a legitimate product and far better than nothing.
After a Connecticut business had its bank account compromised this fall, the sweep of their computers found nothing. The problem was upstream: finance and email passwords saved in a personal Gmail browser profile, no MFA, and vendor "new bank account" emails in the inbox that were never phone-verified. The recovery was the list above, in order: rotate everything, turn on MFA, audit every mailbox for rules, forwarding and app consents, and make a phone call before any bank detail changes.
The bottom line
The settings that stop most Microsoft 365 incidents in a small business are not expensive or exotic. MFA enforced for everyone, legacy authentication blocked, admin accounts separated from daily email, auditing confirmed on, external email tagged, Defender for Office 365 presets applied, external forwarding blocked, and offboarding the day someone leaves. Most of this is included in licenses you already pay for and takes an afternoon to set up properly.
If you are not sure which of these are actually on in your tenant, get your company's free IT health report. It is an on-site look and a written summary of where you stand, no software installed and no obligation. Managed IT keeps the tenant configured and monitored month to month with no retainer, and you can contact me if you just have a question about one of these settings.
Related: what cyber insurers ask about MFA and email filtering and what to collect when you switch IT providers, since the Microsoft 365 admin login is the first thing on that list.
Settings and names verified against Microsoft Learn in November 2026. Microsoft changes these regularly; the linked pages are the current reference.