Microsoft 365 comes with sensible security defaults, but they are not always switched on or set up for how your company actually works. These five settings are worth checking in your own tenant.
1. Multi-factor authentication for everyone — including the director
Mailboxes protected by a password alone are a common way small companies get compromised. Turn MFA on for every account, not just the technical ones. The usual objection is that it is inconvenient; the usual alternative is explaining to clients why invoices went out from your address with someone else's bank details.
2. Block or review forwarding rules
The classic attack: someone gets into a mailbox, creates a quiet rule that forwards everything to an outside address, and waits for an invoice to appear. Disable automatic external forwarding, and check existing rules — it takes minutes.
3. Check who can send as whom
Shared mailboxes such as info@ or accounts@ often accumulate permissions over the years. People leave; the access stays. Review the list twice a year.
4. Check auditing and how long events are kept
If an account is compromised, the first question is what was accessed and when. Check that auditing is on, which events it records and how long they are kept on your licence. Audit (Standard) is on by default for eligible subscriptions; longer retention and some events need higher licences.
5. Decide what happens on day one and on the last day
Have a written routine for a new starter and a leaver: accounts, licences, mailbox delegation, device access. Access left open after someone has gone is one of the easiest gaps to close.
What we do not do
We are not compliance consultants. We configure the platform, keep the accounts and devices in order and explain plainly what each setting does. What we are responsible for is set out in the agreement; decisions about your data and processes stay with you.