Microsoft 365 arrives working. Mail flows, files sync, Teams connects, and nobody has to think about it again. That is the point of the product, and it is also the reason so many small businesses are running a platform that is configured for convenience rather than for defense.
The gap is rarely a missing license. In most of the tenants we look at, the controls that would have stopped the incident were already paid for and simply never switched on. Below are the settings that matter most, what each one actually prevents, and where to find it.
A note before you start: some of these controls depend on your license tier, and the differences are not intuitive. Microsoft 365 Business Basic and Business Standard do not include Conditional Access. Business Premium does. Check what you own before you plan the work.
Why default settings are not a security posture
Microsoft operates on a shared responsibility model, and it is explicit about where the line sits. Microsoft is responsible for the availability and integrity of the service. You are responsible for your data, your configurations and settings, and your identities and users. In Microsoft’s own documentation, those three categories never transfer to the provider, regardless of which plan you buy.
That means a correctly functioning Microsoft 365 tenant can be a completely exposed one, and nothing in the admin center will flag it as a fault.
The scale of what is being defended is worth stating plainly. The FBI’s Internet Crime Complaint Center recorded 24768 business email compromise complaints in 2025, with reported losses of just over 3 billion dollars. Business email compromise is not a Fortune 500 problem. It is the most common way a small business loses money to a cyber incident, and it usually runs through a mailbox.
1. Multifactor authentication, and the trap between security defaults and Conditional Access
Microsoft has published the figure repeatedly: more than 99.9% of compromised accounts do not have multifactor authentication enabled. Microsoft’s current guidance states that MFA can block more than 99.2% of account compromise attacks.
Tenants created on or after October 22, 2019 have security defaults enabled automatically. Security defaults enforce MFA registration for all users, require MFA for administrator roles, and block legacy authentication protocols. For a very small business with no complicated requirements, security defaults are a reasonable place to be.
The trap appears when a business outgrows them. Security defaults are all or nothing. To create exceptions, or to require MFA only from unmanaged locations, or to apply phishing-resistant methods to administrators, you need Conditional Access, which requires Microsoft Entra ID P1. That is included in Business Premium and Microsoft 365 E3. It is not included in Business Basic or Business Standard.
Turning Conditional Access on requires turning security defaults off. We have walked into tenants where somebody started that migration, built two policies, got distracted, and left the organization with neither control fully in place for months.
What to do: confirm which of the two you are running, and confirm it is complete. If you are on Business Premium, use Conditional Access and start from the Microsoft-managed policies, which now include blocking legacy authentication, blocking device code flow, requiring MFA for all users, and requiring phishing-resistant authentication for administrators.
2. Automatic external email forwarding
This is the single most under-checked setting in Microsoft 365, and it is free with every mailbox.
When an attacker takes over a mailbox, the password is not the prize. Persistence is. The standard move is to create an inbox rule that quietly copies every message containing words like “invoice,” “wire,” or “payment” to an outside address, and often to move the real vendor’s replies into an archive folder so the legitimate user never sees the fraud conversation happening in their name. The rule survives a password reset if nobody removes it.
Barracuda’s 2026 Email Threats Report, based on analysis of 3.1 billion emails, found that 25% of account takeover incidents involved suspicious changes to inbox rules, and that 34 % of companies experience at least one account takeover incident per month.
The control lives in the outbound spam filter policy, at Microsoft Defender portal, Email and collaboration, Policies and rules, Threat policies, Anti-spam, Anti-spam outbound policy. The current system-controlled default blocks automatic external forwarding, which is good news, but tenants provisioned earlier or modified by a previous IT provider frequently sit on “On.” Mail flow rules and remote domain settings can also override the policy, so “the default is fine” is not a safe assumption without checking.
CISA made disabling automatic external forwarding a mandatory requirement for federal agencies under Binding Operational Directive 25-01. It is free. There is no reason for a small business to be on the permissive side of it.
3. Impersonation protection that nobody configured
If you hold Microsoft 365 Business Premium, Microsoft 365 E3 or E5, you have Microsoft Defender for Office 365, and with it two of the most useful anti-phishing controls available: user impersonation protection and domain impersonation protection.
Here is the part that surprises owners. Neither is configured in the default anti-phishing policy. Out of the box, on every tier, the list of protected users and protected domains is empty. The feature exists, you are paying for it, and it is protecting nobody until someone types in the names.
This is the control that catches the lookalike email. Not a spoof of your exact domain, which other protections handle, but the message from a display name reading “Alphonso Jackson” arriving from a domain that is one character different from yours, asking finance to release a payment.
What to do: enable the Standard preset security policy for all recipients, then add your executives, your finance staff and your own domain by name to the impersonation protection lists. Note that the Standard and Strict presets are switched off by default. Only Built-in protection, which provides basic Safe Links and Safe Attachments, is on.
4. Email authentication that stops at monitoring
Nearly every business has an SPF record. Many now have DKIM. Far fewer have DMARC set to a policy that actually does anything.
DMARC tells receiving mail servers what to do with a message that fails authentication checks while claiming to come from your domain. A policy of `p=none` tells them to do nothing at all. It is a monitoring setting. A domain published at `p=none` can be spoofed exactly as if it had no DMARC record, and the business gets a false sense of security because a record technically exists.
EasyDMARC’s 2026 adoption report found that 52.1% of the top 1.8 million domains have a DMARC record, but only around 412,000 of them are set to quarantine or reject. The split by company size is the interesting part: Fortune 500 adoption sits above 80 % at enforcement, while more than half of Inc. 5000 companies with a DMARC record are still at `p=none`.
Microsoft’s recommended end state is `p=reject` with reporting addresses configured, reached by moving through `none`, then `quarantine`, then `reject` while you watch the reports for legitimate senders you forgot about, such as your invoicing platform or your marketing tool.
One honest limitation: DMARC stops spoofing of your exact domain. It does not stop lookalike domains, free webmail impersonation, or a genuine email sent from a mailbox an attacker has already compromised. That is why it belongs alongside impersonation protection and payment verification, not instead of them.
5. Third-party app consent
This is the control that survives an MFA rollout, and the one most small businesses have never heard of.
In an illicit consent grant attack, the attacker registers an application in Microsoft Entra ID and phishes a user into approving it. The user is not giving away a password. They are granting an app permission to read their mail and files, and that permission produces a token that keeps working after a password reset and after MFA is enforced. Microsoft’s own guidance notes that traditional remediation is ineffective, because the application lives outside your organization.
Since mid-2025, Microsoft has been moving tenants that never customized the setting to “Do not allow user consent,” which is the right posture. Verify it in your tenant rather than assuming, at Entra admin center, Identity, Applications, Enterprise applications, Consent and permissions.
Then turn on the admin consent workflow, which is not enabled by default. It gives users a legitimate way to request an app instead of finding a workaround, and it gives you a record of who asked for what.
6. Sharing links that never expire
SharePoint and OneDrive external sharing is on by default across the environment. The setting that matters is the default link type. In many tenants, sharing a file produces an “Anyone with the link” URL, with edit permission, and no expiration date.
That link is an unauthenticated, permanent channel into your data. It works for anyone who receives it, it survives the departure of the employee who created it, and because no one authenticates, your audit trail records no individual.
CISA’s mandatory baseline for federal agencies sets the target clearly: default sharing scope of “Specific people,” default permission of view only, and Anyone-link expiration of 30 days or less. Those settings are available on every Microsoft 365 plan.
7. Audit logging, before you need it
Mailbox auditing and the unified audit log are both on by default, and since the expanded logging changes that followed the 2023 Storm-0558 intrusion, valuable actions such as MailItemsAccessed, Send, SearchQueryInitiated and UpdateInboxRules are included for all customers rather than E5 only.
What is not unlimited is retention. Purview Audit Standard, which is what most small businesses have, retains 180 days. Audit Premium, an E5 feature, extends to a year, with longer periods available as an add-on.
Business email compromise is usually discovered weeks or months after the initial access, when a payment goes to the wrong account. Within 180 days, a responder can reconstruct which messages the attacker opened, what they searched for, which rules they created and what they sent. Beyond that window, the answer to “what did they take” becomes “we cannot say,” which is the answer that drives up legal exposure, notification cost and insurance disputes.
What to do: confirm auditing is enabled with a quick PowerShell check, and if your business handles regulated data or defense contracts, treat audit retention as a purchasing decision, not an afterthought.
8. Administrator hygiene
Microsoft’s guidance is direct: assign the Global Administrator role to fewer than five people, and maintain two cloud-only emergency access accounts, held in reserve and excluded from normal Conditional Access, for the day everyone else is locked out.
The typical 25-seat tenant we assess has the owner, the bookkeeper, a departed IT contractor and a previous provider’s shared login all holding Global Administrator, none of them using phishing-resistant authentication, and no break-glass account documented anywhere.
9. Backup, and what Microsoft does not promise
Microsoft keeps your service running. It does not keep a point-in-time copy of your data for you.
The default clocks are shorter than most owners assume. Deleted items in Exchange Online sit in the Recoverable Items folder for 14 days by default, extendable to 30. A deleted mailbox is retained 30 days. A departed employee’s OneDrive is retained 30 days, then moves to a site collection recycle bin for 93, for a total window of 123 days.
Retention policies and litigation holds preserve data. They do not restore your environment to how it looked last Tuesday before ransomware ran. Microsoft 365 Backup exists as a first-party product, billed per gigabyte per month with one-year retention, and there is a healthy third-party market. Either way, it is a decision to make deliberately.
Where to start: Microsoft Secure Score
Microsoft Secure Score, in the Defender portal, measures your posture across identities, apps and devices and gives you a prioritized list of improvement actions worth ten points or fewer each.
Use it as a triage queue, not a target. Filter for the highest-value actions with the lowest user impact, complete those, then re-baseline monthly. Be aware that the score is relative to the licenses you hold, so a well-configured Business Standard tenant can score lower than a sloppy E5 tenant. Track your own improvement rather than chasing a number.
A practical order of work
If you do nothing else this quarter, do these six things in this order:
- Confirm MFA is enforced for every account, with no legacy exceptions.
- Verify that automatic external forwarding is blocked, and check for existing inbox rules that forward outside the company.
- Enable the Standard preset security policy and populate impersonation protection with the names of your executives, your finance team and your domain.
- Move DMARC from `p=none` to `p=quarantine`, then to `p=reject`.
- Set default sharing to “Specific people,” view only, with link expiration.
- Cut Global Administrators to fewer than five and create two break-glass accounts.
Every one of those is included in a Business Premium subscription, and most are included in far less. Every one of them is a control CISA made mandatory for federal agencies, not because it is expensive, but because it works.
Getting a second set of eyes on it
Reading a checklist is straightforward. Confirming that all of it is actually true in a live tenant, without breaking the scan-to-email on the copier or the invoicing platform that still relies on an old protocol, is the part that takes experience.
Alchanis Technical Services is a veteran-owned managed security provider. We assess Microsoft 365 environments for small and mid-size businesses, tell you plainly what is exposed and what it would cost to close, and we do the work if you want it done. You can reach us at alchanistech.com.
