The M365 Security Settings Most Small Businesses Get Wrong

Managing Microsoft 365 tenants for businesses of all sizes, I see the same security gaps come up time and again. Most of them aren't difficult to fix — they're just settings that nobody told the business existed, or that got left at default during initial setup and were never revisited.

The consequences of getting these wrong range from annoying (email deliverability problems) to serious (account takeover, ransomware, data breach). Here are the ones I flag most consistently in tenant audits.

1. MFA Is Not Enforced for All Users

Microsoft's own research shows that enabling Multi-Factor Authentication blocks over 99.9% of account compromise attacks. Despite this, I still encounter tenants where MFA is optional, or where it's enforced for most users but not for specific accounts — often shared mailboxes, service accounts, or users who complained loudly enough that an IT admin quietly exempted them.

The right way to enforce MFA in a modern Microsoft 365 tenant is through Conditional Access policies, not the legacy per-user MFA settings. Conditional Access gives you much more control — you can require stronger authentication for admin accounts, require compliant devices for access to sensitive applications, and block access from high-risk locations. If you're still using the legacy per-user MFA toggle in the Microsoft 365 admin centre, it's worth moving to Conditional Access.

2. Legacy Authentication Protocols Are Still Enabled

Legacy authentication refers to older protocols like SMTP AUTH, POP3, IMAP, and basic authentication that don't support modern MFA. Even if you've enforced MFA for all users, accounts can still be compromised via legacy authentication because those protocols bypass MFA entirely — an attacker just needs a username and password.

Microsoft has been blocking basic authentication by default for new tenants since 2022, but many tenants created before that still have it enabled. The fix is a Conditional Access policy that blocks legacy authentication for all users. The only reason not to do this is if you have legacy line-of-business applications that still use basic auth — which is increasingly uncommon but does still exist in some industries.

3. Audit Logging Is Not Enabled

Microsoft 365 audit logging records user and admin activity across Exchange Online, SharePoint, OneDrive, Teams, and Azure AD. When a security incident happens — and eventually something will — audit logs are what tell you what actually occurred, when, and from where. Without them, you're investigating blind.

Audit logging is not enabled by default on older tenants. You enable it in the Microsoft Purview compliance portal. Once enabled, logs are retained for 90 days on standard licences and up to 10 years on E5 licences. It should be one of the first things configured in any new tenant.

4. External Email Forwarding Is Unrestricted

This is one that surprises people. By default in many Microsoft 365 tenants, users can configure their mailbox to automatically forward all incoming email to an external address. This is a significant data loss risk — a compromised account can silently forward every email to an attacker's address for months before anyone notices.

The fix is a mail flow rule (transport rule) in Exchange Online that blocks or limits external forwarding. Microsoft has introduced an anti-spam policy setting that controls this, but the default configuration in many tenants still allows it. Check your anti-spam outbound policy and set external forwarding to either blocked or supervised forwarding only.

5. Admin Accounts Are Used for Day-to-Day Work

Global Administrator accounts should be used only when administrator-level access is specifically needed — not as the daily driver account for checking email, browsing the web, or working in Teams. If an admin account is compromised while being used for everyday tasks, the attacker has immediate global admin access to the entire tenant.

The right approach is separate accounts: a standard user account for day-to-day work, and a dedicated admin account used only when administrative tasks need to be performed. The admin account shouldn't even have a mailbox — it exists purely for admin purposes. This is basic privileged access hygiene but it's still not universal.

6. Secure Score Is Being Ignored

Microsoft provides a free tool called Secure Score in the Microsoft Defender portal. It evaluates your tenant configuration against a set of security best practices and gives you a score, along with specific recommendations ordered by impact. Most tenants I see have a Secure Score well below 50% — which means there are straightforward improvements available that aren't being made.

Secure Score isn't perfect — some recommendations won't apply to every business — but it's a genuinely useful starting point for understanding your security posture without needing to know where to look.