Microsoft 365 Security Settings Every Small Business Should Turn On

The Microsoft 365 security settings with the biggest impact for a small business are: multi-factor authentication for every user, blocking legacy authentication, separate admin accounts, email authentication with SPF, DKIM and DMARC, stopping automatic forwarding to outside addresses, controlled external sharing in SharePoint and OneDrive, and audit logging. Most of these take little time to configure and close the gaps attackers use most often.

Microsoft 365 is the backbone of many small offices in Miami-Dade, from law firms in Brickell to medical practices in Coral Gables. Out of the box, it is a capable platform, but the default configuration is not always the most protective one for your business. Here is where to focus.

1. Require Multi-Factor Authentication for Everyone

Stolen passwords are one of the most common ways attackers get into business email. MFA adds a second step, such as an approval in the Microsoft Authenticator app, so a password alone is not enough.

• Turn on Security Defaults if you do not have Conditional Access, or create Conditional Access policies if your licenses include them
• Prefer the authenticator app over text messages where possible
• Include every account, especially executives and finance staff

2. Block Legacy Authentication

Older protocols such as POP, IMAP and basic SMTP authentication may not support MFA. Microsoft has been retiring basic authentication for Exchange Online, but it is worth confirming that nothing in your tenant still depends on it and that remaining legacy sign-ins are blocked. Check old scanners, copiers and line-of-business apps that send email, and move them to supported methods.

3. Separate and Protect Admin Accounts

Global administrator rights should not live on the account someone uses for everyday email.

• Create dedicated admin accounts used only for administration
• Keep the number of global admins small, while still having at least two so you are never locked out
• Use role-based admin roles (such as Exchange or User administrator) when full global rights are not needed
• Protect admin accounts with the strongest MFA available

4. Set Up SPF, DKIM and DMARC

These three DNS records help receiving mail servers verify that email claiming to come from your domain is legitimate.

• SPF lists the servers allowed to send mail for your domain
• DKIM adds a cryptographic signature to outgoing messages
• DMARC tells receivers what to do with messages that fail those checks and sends you reports

Start DMARC in monitoring mode, review the reports, then move gradually toward quarantine or reject. Our business email service handles this setup and the ongoing monitoring.

5. Stop Automatic Forwarding to External Addresses

A common tactic after an account is compromised is to create a hidden rule that forwards all mail to an outside address. Configure outbound policies to block automatic external forwarding, and allow exceptions only where there is a documented business reason.

6. Strengthen Email Filtering

Review your anti-phishing, anti-spam and anti-malware policies in the Microsoft Defender portal. Depending on your license, features such as Safe Links and Safe Attachments add protection against malicious links and files. Also consider:

• Tagging messages from external senders so staff notice them
• Impersonation protection for executives and your domain
• Training staff to report suspicious messages

7. Control External Sharing

SharePoint and OneDrive make it easy to share files, sometimes too easy.

• Limit "Anyone" links or set them to expire
• Prefer sharing with specific people
• Review external sharing settings for sites that hold sensitive data

8. Turn On Auditing and Review Alerts

Make sure unified audit logging is enabled so you can investigate if something goes wrong. Review sign-in logs and alert policies regularly, or have your IT provider do it.

Quick Reference

Setting	What it protects against	Effort to configure
MFA for all users	Stolen or guessed passwords	Low to moderate
Block legacy authentication	Sign-ins that bypass MFA	Low, after testing devices
Separate admin accounts	Full tenant takeover	Low
SPF, DKIM, DMARC	Domain spoofing and impersonation	Moderate
Block external auto-forwarding	Silent data leakage	Low
Email filtering policies	Phishing and malware	Moderate
External sharing limits	Accidental data exposure	Low to moderate
Audit logging	Blind spots during an incident	Low

Licensing Notes

Some features depend on your Microsoft 365 plan. Conditional Access and Defender for Office 365 Plan 1 are included in Microsoft 365 Business Premium, while other plans may need add-ons. Check your current licenses before planning changes, and avoid paying for features you will not configure.

FAQ

Is Security Defaults enough for a small business?

For many small offices, Security Defaults is a solid starting point because it enforces MFA and blocks legacy authentication. Businesses that need exceptions, location rules or device requirements usually move to Conditional Access.

Will turning on MFA disrupt my staff?

There is a short adjustment period. Plan the rollout, communicate in advance in the languages your staff use and help people register their devices. After setup, sign-ins are typically quick.

How often should these settings be reviewed?

Review them at least a few times a year and whenever Microsoft announces significant changes. New features and new threats appear regularly.

Get a Microsoft 365 Security Review

Core Florida IT reviews Microsoft 365 tenants for businesses across South Florida as part of our cybersecurity services. Our free IT assessment highlights the settings that need attention and explains them in plain English or Spanish. Request your free IT assessment.