Small businesses are targeted by cybercriminals more than most owners realize. According to the Verizon Data Breach Investigations Report, small businesses account for a significant proportion of all reported breaches, and the reason is straightforward: they tend to have weaker defenses than large enterprises while still holding valuable data.
Microsoft 365 provides a strong security foundation out of the box, but the default configuration is not the same as a secure configuration. Many of the most effective protections are available to all Microsoft 365 subscribers and simply need to be switched on and configured correctly. Others require a higher-tier plan but represent excellent value when weighed against the cost of a breach.
This guide covers the most important steps small businesses should take to secure their Microsoft 365 environment, written in plain terms that do not require a security specialist to follow.
1. Enable Multi-Factor Authentication for Every User
Multi-factor authentication (MFA) is the single most effective thing you can do to protect your Microsoft 365 accounts. Microsoft’s own data suggests that MFA blocks more than 99% of account compromise attacks. Despite this, a significant number of small businesses still have it switched off or only partially enabled.
Without MFA, a stolen password is all an attacker needs. With it, a stolen password is useless without also having access to the user’s second factor, typically an authentication app on their phone. The attacker has the password but cannot get in.
Microsoft 365 includes MFA at no additional cost. The most secure and user-friendly method is the Microsoft Authenticator app, which supports number matching to prevent MFA fatigue attacks. SMS-based codes are better than nothing but are considered less secure due to SIM-swapping risks.
What to do: Enable Security Defaults in the Microsoft Entra admin center if you are on a Basic or Standard plan. For Business Premium and above, configure MFA through Conditional Access policies, which give you more granular control over when and how MFA is required.
Common mistake to avoid: Enabling MFA for most users but leaving a handful of accounts, often shared accounts or legacy service accounts, without it. Every account is a potential entry point. There are no acceptable exceptions.
2. Configure Conditional Access Policies
Conditional Access is available on Microsoft 365 Business Premium and above, and it is one of the most powerful security tools in the platform. Where MFA controls whether a second factor is required, Conditional Access controls the conditions under which access is granted at all.
Conditional Access policies evaluate signals at the point of sign-in and decide whether to allow access, require additional verification, or block the attempt entirely. The signals include the user’s identity, their location (based on IP address), the device they are using, the application they are trying to access, and the risk level assigned by Microsoft’s threat intelligence.
Practical policies that every small business should consider include:
- Require MFA for all users on all apps. This is the baseline. Every sign-in to any Microsoft 365 app should require MFA.
- Block access from high-risk locations. If your business operates in the US and UK, there is no reason a sign-in from a country you have no business presence in should succeed. Block access from unexpected geographic locations.
- Require compliant devices. With Microsoft Intune (included in Business Premium), you can require that devices meet minimum security standards before accessing company data. This prevents staff from accessing email on an unmanaged personal device that may be compromised.
- Block legacy authentication protocols. Older email clients and applications use authentication protocols like POP, IMAP, and SMTP AUTH that do not support MFA. These should be blocked unless there is a specific, documented need to keep them open.
What to do: Access Conditional Access policies via the Microsoft Entra admin center. Start with Microsoft’s pre-built policy templates, which cover the most common scenarios, and refine from there based on your specific requirements.
3. Protect Against Phishing and Email-Based Attacks
Email is the most common vector for cyberattacks. Phishing, business email compromise, and malware delivered via email attachment are responsible for the majority of breaches affecting small businesses. Microsoft 365 includes powerful email security tools that go well beyond basic spam filtering.
Microsoft Defender for Office 365
Higher-tier Microsoft 365 plans include Microsoft Defender for Office 365, which adds two critical protections: Safe Links and Safe Attachments.
Safe Links rewrites every URL in an incoming email and checks it against Microsoft’s threat intelligence at the moment the user clicks it, not when the email was received. This matters because attackers commonly use URLs that are benign at delivery time and turn malicious shortly after. Safe Links catches these in real time.
Safe Attachments opens every email attachment in a sandboxed environment before delivering it to the user’s inbox. If the attachment behaves maliciously in the sandbox, it is blocked. This catches zero-day malware that has not yet been added to signature-based detection databases.
Anti-phishing policies
Microsoft 365 includes anti-phishing policies that can be configured to protect against impersonation attacks. These policies flag or block emails that attempt to impersonate your company’s executives, your domain, or other trusted senders. For small businesses where a fake email from the “CEO” requesting a wire transfer is a real and common threat, impersonation protection is essential.
DMARC, DKIM, and SPF
These three DNS-based email authentication standards work together to verify that emails claiming to be from your domain actually originated from your servers. Without them, attackers can send emails that appear to come from your domain, targeting your customers, partners, or staff.
- SPF specifies which mail servers are authorized to send email on behalf of your domain.
- DKIM adds a cryptographic signature to outgoing emails that receiving servers can verify.
- DMARC tells receiving servers what to do with emails that fail SPF or DKIM checks, and provides reporting so you can see who is sending email on your behalf.
All three should be configured for every domain you use to send email. Microsoft 365 makes DKIM straightforward to enable from the Defender portal, and DMARC and SPF are configured at your DNS provider.
4. Secure Your Administrator Accounts
Global administrator accounts have unrestricted access to your entire Microsoft 365 environment. A compromised global admin account is a catastrophic event: an attacker can access all data, create new accounts, disable security features, and lock legitimate administrators out of the tenant.
Small businesses often have too many people with global admin rights, use the same account for both admin tasks and day-to-day work, and have not properly secured admin accounts with MFA.
Best practices for admin accounts:
- Minimize the number of global admins. Ideally you should have two global admin accounts: one for active use and one as a break-glass emergency account. Most users who need to perform administrative tasks do not need global admin, they need a more limited role such as Exchange Admin, User Admin, or Billing Admin.
- Use dedicated admin accounts. Global admins should have a separate account used only for administrative tasks, not for reading email or browsing the web. This limits exposure if their primary account is compromised.
- Require phishing-resistant MFA for admins. Standard MFA is good. For admin accounts, go further and require FIDO2 hardware keys or certificate-based authentication, which cannot be bypassed by MFA fatigue attacks.
- Enable Privileged Identity Management (PIM). Available on higher-tier plans, PIM requires admins to explicitly activate their elevated role for a limited time window when they need it, rather than having it on permanently. This dramatically reduces the window of exposure if an admin account is compromised.
5. Manage Devices That Access Company Data
Securing your Microsoft 365 accounts is only half the picture. The devices your staff use to access those accounts are equally important. An unmanaged personal laptop with out-of-date software and no disk encryption is a significant risk, regardless of how well you have configured your Microsoft 365 tenant.
Microsoft Intune, included in Microsoft 365 Business Premium, provides mobile device management (MDM) and mobile application management (MAM) capabilities that let you set and enforce minimum security standards on devices accessing company data.
Key Intune capabilities for small businesses:
- Require device encryption. Enforce BitLocker on Windows devices and FileVault on Macs, ensuring that a lost or stolen laptop cannot be read without the decryption key.
- Enforce screen lock and PIN policies. Require that devices lock after a short period of inactivity and cannot be accessed without a PIN or biometric.
- Remote wipe. If a device is lost or stolen, or if an employee leaves the company, you can remotely wipe company data from the device.
- Block non-compliant devices. Combined with Conditional Access, you can prevent devices that do not meet your security baseline from accessing company email and files at all.
6. Back Up Your Microsoft 365 Data
This is the most commonly overlooked area of Microsoft 365 security, and the one that catches businesses out most painfully. Microsoft is responsible for the availability of the Microsoft 365 platform. They are not responsible for recovering your data if it is accidentally deleted, corrupted, or maliciously destroyed.
Microsoft 365 includes limited data retention features. Deleted emails can be recovered from the Deleted Items folder for a configurable period, and the Recoverable Items folder provides a second safety net. But these are not a backup. They do not protect against a ransomware attack that encrypts your data, a disgruntled employee who deliberately deletes files, or an admin error that wipes a mailbox.
Microsoft’s own documentation explicitly states that customers should use third-party backup solutions to protect their Microsoft 365 data. Well-regarded options include Veeam Backup for Microsoft 365, Acronis, and Backupify. These tools take regular snapshots of your Exchange Online mailboxes, SharePoint sites, OneDrive files, and Teams data, and store them in a separate location that is not connected to your Microsoft 365 tenant.
What a good backup solution should provide:
- Daily automated backups of all mailboxes, SharePoint, OneDrive, and Teams data
- Point-in-time restore to any previous backup, not just the most recent
- Storage in a separate location from your Microsoft 365 tenant
- Granular restore capability, so you can recover a single email or file without restoring an entire mailbox
7. Monitor Your Environment and Act on Alerts
Security tools only protect you if someone is paying attention to the alerts they generate. Microsoft 365 includes Microsoft Secure Score, a real-time dashboard that measures your security configuration against Microsoft’s recommended baseline and suggests specific improvements. It is the clearest starting point for understanding where your gaps are.
Beyond Secure Score, the Microsoft Defender portal provides a unified view of security alerts, incidents, and threat intelligence across your Microsoft 365 environment. Key things to monitor include:
- Impossible travel alerts. A sign-in from New York followed minutes later by a sign-in from a different country indicates that an account has been compromised. These alerts should be acted on immediately.
- Risky sign-in reports. Microsoft’s threat intelligence flags sign-ins that match known attacker patterns. Review these regularly and investigate anything unexpected.
- Mailbox forwarding rules. Attackers who gain access to a mailbox commonly set up automatic forwarding rules to send a copy of all incoming email to an external address. Monitor for newly created forwarding rules and treat any unexpected ones as a potential compromise indicator.
- Admin activity logs. Review the unified audit log for any unexpected changes to admin settings, new accounts being created, or permissions being changed.
For small businesses without a dedicated security team, Microsoft 365 Business Premium includes Microsoft Defender for Business, which provides simplified threat detection and response capabilities designed to be manageable without specialist security knowledge.
8. Train Your Staff
Technology controls can only go so far. The majority of successful cyberattacks begin with a human action: clicking a malicious link, entering credentials on a phishing site, or responding to a social engineering request. Staff awareness training is not optional, it is a core part of your security posture.
Microsoft 365 Business Premium and higher include Attack Simulation Training, a tool that lets you run simulated phishing campaigns against your own staff. Users who click the simulated phishing link are automatically enrolled in targeted training. This is more effective than generic annual security training because it catches real behavior patterns and addresses them in context.
At a minimum, every member of staff should be able to:
- Recognize the hallmarks of a phishing email, including urgency, unexpected sender addresses, and requests for credentials or financial action
- Report suspicious emails using the Microsoft Report Message add-in in Outlook
- Understand that they should never share their password or MFA codes, even with IT support
- Know who to contact immediately if they suspect their account has been compromised
A Note on Getting the Configuration Right
The steps above represent best practice, but the details matter. Misconfigured Conditional Access policies can lock users out of their accounts. Overly aggressive email filtering can cause legitimate mail to be quarantined. Intune policies that are too restrictive can create friction that leads staff to work around them in ways that create new risks.
Getting Microsoft 365 security configuration right requires understanding both the platform and your specific business requirements. If your business has recently migrated to Microsoft 365 from Exchange Server, or is planning to, the security configuration is part of what a well-managed migration should deliver. A properly configured Microsoft 365 tenant is more secure than your Exchange Server on day one, and continues to improve as Microsoft adds new capabilities to the platform.
The Bottom Line
Microsoft 365 gives small businesses access to enterprise-grade security tools at a fraction of what it would cost to build the same capabilities on-premise. MFA, Conditional Access, Defender for Office 365, Intune, and the unified audit log are all available within the platform, and most of them require configuration rather than additional spend.
The businesses that get breached are not usually the ones that lacked the tools. They are the ones that had the tools and did not configure them. Taking the steps in this guide will put your Microsoft 365 environment in a significantly stronger position than the default configuration and dramatically reduce your exposure to the most common threats facing small businesses today.
Carden IT Services configures and secures Microsoft 365 environments as part of every Exchange migration we deliver. If you are moving from Exchange Server to Microsoft 365, security configuration is included from day one. Book a free 20-minute assessment call to get started.