The Microsoft 365 Security Settings Most SMBs Never Turn On

Think back to the day your Microsoft 365 tenant (your company’s Microsoft 365 account) was created. Somebody — a previous IT guy, a vendor, maybe you — spent an afternoon getting mail to flow and files to sync, and then moved on. Nobody has meaningfully revisited the security configuration since. Meanwhile, that tenant has become the front door to everything: email, contracts, financials, customer data.

Newer tenants start with Microsoft’s security defaults (MFA required, legacy sign-⁠ins blocked), but many older tenants never got them or switched them off, and the defaults stop well short of what an attacker tests: app consent, mail forwarding, audit retention and backup. Attackers know the defaults better than most administrators do, and they aim at them every day. The good news: the highest-⁠value fixes aren’t expensive add-⁠ons. They’re settings — most of them already in your subscription — that most small-⁠business tenants have simply never turned on. (Conditional Access, used in the first two settings below, needs Microsoft Entra ID P1, which comes with Microsoft 365 Business Premium, E3 and E5. On Business Basic or Standard, security defaults still cover those two.)

First, the shared-responsibility truth

Microsoft secures the platform: the datacenters, the service uptime, the infrastructure. Under the shared responsibility model, what happens inside your tenant — who can sign in and how, which apps get access, what’s logged, how data is protected and recovered — is your job, or your IT partner’s. “We’re in the cloud, so we’re covered” is where most tenant horror stories begin. With that settled, here are the six settings that matter most.

1. Enforce MFA with Conditional Access — not the honor system

Microsoft’s own research (published 2023) found that multi-⁠factor authentication reduces the risk of account compromise by 99.22%. There is no other control with that return. But “we have MFA” usually means “we asked people to enroll” — and there’s a canyon between offering MFA and enforcing it.

Enforcement is policy. At minimum, turn on security defaults (Microsoft’s free baseline settings). Better, use Conditional Access to require MFA for everyone, everywhere, and layer in rules that fit how you work: block sign-⁠ins from countries you’ll never operate in, require compliant devices (company computers that pass your security checks) for admins, and step up scrutiny on risky logins. Admin accounts come first — every one of them, no exceptions — and for those, prefer phishing-⁠resistant methods like passkeys over push prompts that a tired thumb can approve.

2. Block legacy authentication

Here’s the quiet loophole: older sign-⁠in methods (legacy, or “basic,” authentication) that accept just a username and password, with no MFA challenge at all. Microsoft switched basic sign-⁠in off for POP and IMAP in Exchange Online years ago, but SMTP AUTH (the setting scanners and old apps use to send mail) still accepts it until Microsoft disables it by default at the end of December 2026, and other legacy clients can still be let through. Attackers running password-⁠spray campaigns (trying one common password against many accounts) deliberately target them, because a tenant with “MFA enabled” but legacy auth alive is a locked front door next to an open window.

Check your sign-⁠in logs for what still uses legacy authentication (it’s usually an ancient scanner or a line-⁠of-⁠business relic), fix those, then block legacy authentication tenant-⁠wide with Conditional Access. This is one afternoon of work that removes a whole attack class.

3. Stop rubber-⁠stamping app consent

By default, users can grant third-⁠party apps standing access to their mailbox and files. Attackers exploit this with convincing consent screens — “This app would like to read your email” — and here’s the nasty part: the access rides on an authorization grant, not the password, so it survives password resets and even MFA.

Restrict user consent to low-⁠risk permissions from verified publishers (or turn it off entirely), enable the admin consent workflow so requests route to someone qualified to judge them, and audit the apps that already have access. Most tenants find at least one surprise.

4. Audit your mail rules — attackers love them

When criminals compromise a mailbox, their first moves are mail rules: auto-⁠forward copies of invoices and wire instructions to an outside address, and auto-⁠delete the replies so the owner never notices the conversation happening in their name. This is the machinery of business email compromise — a crime that drew $3.05 billion in losses reported to the FBI in 2025, per its IC3 report.

Disable external auto-⁠forwarding at the tenant level, alert on newly created inbox rules, and review existing rules and transport rules (the company-⁠wide mail-⁠flow rules) on a schedule. A forwarding rule nobody recognizes is a five-⁠alarm finding, not a curiosity.

5. Turn on auditing — and keep the logs longer

You cannot investigate what you never recorded. Audit logging answers the questions that matter after an incident: who signed in from where, what was read, what was forwarded, what was deleted. Yet plenty of small-⁠business tenants have never verified auditing is enabled for every user and workload.

Retention is the second half: by default, standard audit logs are kept for 180 days, per Microsoft’s Purview documentation. Quiet compromises — the kind where someone reads a controller’s mailbox for months before striking — can outlast that window. Export or stream logs to longer-⁠term storage so the evidence exists when you need it, and check that alerting is actually pointed at a human who will see it.

6. Stop calling Microsoft 365 a backup

This is the most expensive myth in the small-⁠business cloud. Retention policies, recycle bins, and version history protect against some mistakes for limited windows. They are not a backup: retention can be misconfigured or aged out, an admin (or attacker with admin rights) can purge data, a departed employee’s cleanup can take irreplaceable files with it, and ransomware-⁠encrypted documents will happily sync over your clean copies. Microsoft’s shared responsibility model says it plainly — the platform is theirs, the data is yours.

Real protection means an independent backup of mailboxes, calendars, contacts, and shared files — separate credentials, separate storage, recent copies locked against change, and restores that get tested instead of assumed.

How your IT partner should help

None of this requires an enterprise budget — it requires somebody actually owning it. If a provider manages your Microsoft 365, this is the standard they should be meeting:

• Harden the tenant to a written baseline — enforced MFA and Conditional Access, legacy auth blocked, consent restricted, forwarding disabled — and re-⁠verify it after every change
• Watch it 24/7: sign-⁠in logs, new inbox rules, app consents, and privilege changes monitored by a security operations center that can kill a hijacked session at 2 a.m., not read about it at 9
• Back up the tenant independently and test the restores
• Review posture with you on a set schedule — at least once a year, quarterly if your business changes fast — because settings drift, staff change, attackers adapt
• Work alongside internal IT where you have it, through a co-⁠managed arrangement that adds monitoring depth without turf wars

One honest test: ask whoever manages your tenant to show you your Conditional Access policies. The speed and clarity of the answer tells you nearly everything. Or start from the outside — a free 30-⁠minute assessment will surface the gaps in plain English.

Defaults get you started. They don’t finish the job.