A good Microsoft 365 security setup comes down to a handful of decisions made when the account is created: everyone signs in with a password and their phone, the accounts that control the whole company are kept apart from everyday email, old sign-in methods are switched off, and two emergency accounts are kept in reserve. The settings themselves are your IT provider’s job. Your part is knowing they exist and asking the person who sets up your account to show you each one.
For most small companies, Microsoft 365 quickly becomes the center of everything: email, files, calendars, video calls and often the sign-in to other business tools. That is exactly why the way it is set up on the first day matters so much, and why it is worth checking even if your account was opened years ago.
Why the First Day Is the Cheapest Moment to Get It Right
On the day a Microsoft 365 account is opened, nobody depends on it yet. There are no shared folders to break, no habits to change and no employee who will be locked out halfway through a busy week. Your provider can switch on every protection in an afternoon.
Six months later, the same changes take planning. People have saved passwords on their phones, other software connects to the account, and every new rule risks stopping someone from working. As a result, the changes get postponed, and the account runs for years on whatever was set up in a hurry.
That is the real cost of delaying your Microsoft 365 security setup. The protections themselves are mostly included in what you already pay for, but the effort to switch them on grows every month.
Two-Step Sign-In for Everyone, Starting With You
The single most important part of a Microsoft 365 security setup is two-step sign-in. When someone signs in, they enter their password and then confirm on their phone, with a code, an approval in an app or a fingerprint. A criminal who steals the password still cannot get in without the phone.
This should apply to every person in the company, the owner included. In practice, owners and senior managers are often the ones who ask to be exempted because it feels inconvenient. Yet they are also the accounts criminals most want, because they can approve payments and their emails carry authority.
For the accounts that can change company-wide settings, Microsoft recommends going one step further, with a sign-in method that a fake website cannot trick: a small physical security key, or the fingerprint or face recognition built into the computer. Your provider may call this phishing-resistant sign-in.
Microsoft’s Free Starting Point, and Its Limits
Microsoft switches on a basic package of protections, called security defaults, for new accounts. It asks every user to register for two-step sign-in and blocks some of the riskiest sign-in methods. In 2022, Microsoft’s director of identity security said that organizations using security defaults experienced 80% fewer compromises than the overall population of accounts.
That is a strong starting point, and for a very small company it may be enough. However, security defaults are all or nothing. You cannot make exceptions, adjust rules for a particular device, or treat a sign-in from another country differently from one at the office.
Growing companies usually move to custom rules, which Microsoft calls Conditional Access. These rules look at who is signing in, from which device and from where, and decide whether to allow it, ask for extra proof or block it. They require a Microsoft 365 plan that includes them, such as Business Premium, so ask your provider which plan you have and whether it covers this.
Keep the Master Keys Separate From Everyday Email
Some accounts can change settings for the entire company: create users, reset passwords, read any mailbox. Think of them as master keys.
Master keys should never be used to read email or browse the web, because those are the two activities where people get tricked. Instead, the person who manages your account should have one ordinary account for daily work and a separate one that is only used to change settings.
Keep the number of master keys small, too. Microsoft advises keeping the highest level of administrator access to a short list of people. If five people in your company hold it, ask why.
Close the Old Doors That Skip the Phone Check
Older email programs and some connected devices still use sign-in methods designed before two-step sign-in existed. Those methods cannot ask for the phone at all, so a criminal with a stolen password can use them to walk straight past your protection.
Microsoft recommends blocking these older methods. Most modern devices and apps no longer need them, so the change is usually quiet. Still, a printer that sends scanned documents by email or an old accounting add-on might rely on them, which is why your provider should check before switching them off.
Plan for the Day Something Goes Wrong
Security settings can lock people out by mistake. A rule written too strictly, an expired license or a lost phone can, in the worst case, stop everyone from signing in, including the administrators who could fix it.
To prevent that, Microsoft recommends keeping at least two emergency accounts. They are not assigned to any one employee, they are kept out of the everyday rules so a bad setting cannot block them, and they are watched closely so any use raises an alert.
Microsoft’s guidance on these accounts has changed. Two-step sign-in is now required to reach Microsoft’s administration pages, emergency accounts included, so they should be protected by a physical security key stored somewhere safe. If your provider set up emergency accounts a few years ago with only a long password, ask them to update them.
Questions to Ask the Person Who Sets Up Your Account
These six questions cover a complete Microsoft 365 security setup, and none of them requires you to open a settings page.
- Does every person, including me, sign in with a password and a phone? A good answer is yes, with no exceptions for senior staff.
- Who holds administrator access, and do they use a separate account for it? Expect a short list of names, each with a separate account that never reads email.
- Have the older sign-in methods been blocked? If not, ask what still depends on them and when they can be switched off.
- Are we using security defaults or custom rules, and why? Either can be right. What matters is that your provider made the choice on purpose.
- Where are our emergency accounts, and how are they protected? You want to hear “two of them, protected by physical keys, and we get an alert if anyone uses them.”
- Can you test new rules before turning them on? Microsoft lets providers run a rule in a watch-only mode first, so they can see who it would affect without blocking anyone.
If Your Account Was Opened Years Ago
Most small companies are in this situation, and an older Microsoft 365 security setup is fixable. The order simply matters more. A careful provider starts by checking how everyone currently signs in, then rolls changes out in stages, often one group of employees at a time, so nobody is locked out on a Monday morning.
Ask for a short written summary when it is done: which protections are on, who holds administrator access, where the emergency accounts are kept. That page becomes your reference the next time you change providers or an insurer asks how your accounts are protected.
A Short Checklist Beats a Long Recovery
A strong Microsoft 365 security setup is mostly a matter of a few deliberate choices, made early and written down. Two-step sign-in for everyone, separate master keys, old doors closed, emergency accounts ready: none of it is expensive, and all of it is easier on the first day than after the first incident.
