Most small businesses using Microsoft 365 set it up “as it came” and never touch it again. The problem: several important protections are not turned on by default. This is the minimum list we review for every new client.

1. Two-factor authentication (MFA) for everyone

It is the measure with the best effort-to-benefit ratio there is. If a password leaks through a fake email, the attacker still can’t get in. Today it is turned on through conditional access policies or Entra ID security defaults, and it takes less than an hour for the whole company.

2. Block legacy authentication

Old protocols such as IMAP, POP and basic SMTP don’t understand MFA and are the favorite back door for password-spraying attacks. If nobody uses old email clients, they should be turned off.

3. Unusual sign-in alerts

Microsoft detects odd patterns —sessions from countries where nobody works, impossible hours— and can notify the administrator. The alerts exist; you have to turn them on and, more importantly, assign someone to review them.

4. Phishing protection in Exchange Online

Anti-phishing policies let you tag external emails, protect against spoofing of your own domain and warn when someone writes “from the manager’s email” without actually being the manager. Setting up the “external email” banner alone greatly reduces human error.

5. Retention and backup are not the same thing

Microsoft guarantees the availability of the service, not the recovery of a mailbox deleted three months ago. Define retention policies and consider an external backup if your information is critical.

6. Review who is a global administrator

In many small businesses, half the company has administrator permissions “because it was needed once”. The rule: at least two administrators (in case one loses access), no more than strictly necessary, and all with MFA.

Where to start

If you can only do one thing this week: turn on MFA. If you can do two, block legacy authentication. With that you have already eliminated most of the attack vectors we see in practice.

Would you like us to review your tenant? At SYSCOM we carry out Microsoft 365 configuration audits and document every change. Contact us.