The 10 Microsoft 365 security settings every small business should switch on today
Here's a truth that surprises most small business owners when we run an audit: their Microsoft 365 tenant is not secure out of the box. A fresh subscription arrives with dozens of security controls switched off by default, and if nobody has ever opened the admin centre, those controls stay off. The result is a business running on "Microsoft 365 security settings" that are barely more than the bare minimum.
The good news is that you don't need a huge budget or an IT team to fix this. There are ten high-impact toggles that block the vast majority of attacks aimed at small businesses, and every single one can be switched on in your admin centre today. This is that checklist: what each setting does, where to find it, and why it matters.
Why defaults are not a security strategy
Microsoft designs its service for compatibility first. Features that could break legacy workflows, or that require extra licensing, start out disabled. That means common gaps show up in almost every tenant we look at: no multi-factor authentication, external users can join without approval, mailboxes can be forwarded anywhere, and anyone with a link can open your shared files.
None of these are bugs. They are switches, waiting for someone to flip them. Here are the ten that give you the most protection for the least effort.
The 10 settings to switch on
1. Multi-factor authentication (MFA) for every user
Where: Microsoft Entra admin centre > Identity > Users > Per-user MFA.
A stolen password should not be enough to get into your email. MFA asks for a second check, like an authenticator app code or a phone push, so even leaked credentials are useless on their own. It is the single highest-value control on this list, and most cyber insurers now expect it as a minimum.
2. Block legacy authentication
Where: Microsoft Entra admin centre > Identity > Security > Authentication methods policies (and per-app settings).
Older sign-in protocols let some apps bypass MFA entirely. If you switch off legacy authentication, every app is forced to use modern, secure sign-in. This closes one of the most common back doors in small business tenants.
3. Require MFA for external guest users
Where: Microsoft Entra admin centre > Identity > External Identities > B2B collaboration.
Guest accounts are a quiet risk: partners, contractors and suppliers often have standing access to your mailboxes and files. Make sure any external user who signs in must pass MFA, and review the guest list every few months to remove people who no longer need access.
4. Turn off automatic external account creation
Where: Microsoft Entra admin centre > Identity > External Identities > B2B collaboration settings.
By default, some tenants let anyone on the internet create a guest account in your directory just by being invited. Switch this off so that only people you explicitly approve can get in as guests.
5. Safe Links and Safe Attachments (Microsoft Defender for Office 365)
Where: Microsoft 365 admin centre > Security & Compliance > Threat management.
Phishing is the number one way small businesses get breached. Safe Links scans every link at the moment it's clicked, and Safe Attachments opens files in a sandbox before they reach your staff's desktops. If you're on Business Premium, these are already licensed: they just need to be enabled.
6. Mailbox forwarding restrictions
Where: Exchange admin centre > Recipients > mail flow rules (transport rules).
One of the sneakiest tricks in a business email compromise attack is a hidden rule that quietly forwards every incoming email to an attacker's account. Create a transport rule that blocks or flags external mailbox forwarding, and you remove one of the favourite persistence tools criminals rely on.
7. DMARC for your domain
Where: Your DNS provider (add a TXT record); monitor via your Microsoft 365 tenant.
SPF, DKIM and DMARC are the three records that stop criminals from sending email that looks like it came from you. Most small businesses have at least SPF in place; DMARC is the piece that's usually missing. Start in "monitor" mode to see what's happening, then move to "reject" once legitimate mail flows cleanly.
8. SharePoint and OneDrive external sharing limits
Where: Microsoft 365 admin centre > Settings > Services and add-ins, or per-site via SharePoint admin.
"Anyone with the link" is a data breach waiting to happen. Set your default sharing setting to "Only people in your organisation", require re-authentication for guests, and audit which sites are currently shared externally. You'll often find files from years ago that nobody remembers publishing.
9. Audit logging enabled
Where: Microsoft Purview > Settings > Audit solutions.
If something goes wrong, you need to know what happened and when. Audit logging records sign-ins, mailbox access, sharing changes and admin actions. It's free in most plans, takes minutes to switch on, and it turns "we think someone did that" into a searchable record.
10. A named emergency access owner
Where: Microsoft Entra admin centre > Identity > Users (break-glass account).
When the person who knows your admin password is on holiday or has left the business, you need a documented way in. Create one break-glass admin account with MFA, store the credentials somewhere secure, and make sure at least two people know it exists. It's unglamorous, but it's the difference between a bad day and a disaster.
How Jordan Gall Cybersecurity helps
If that list feels like more than you'd like to manage yourself, that's exactly what we're here for. At Jordan Gall Cybersecurity, we give local businesses secure terminal access to comprehensive cybersecurity monitoring and management: enterprise-grade protection without the complexity of running it yourself.
For Microsoft 365 tenants specifically, our Secure365 service covers:
- A full audit of the ten settings above (and the dozens behind them)
- Hands-on configuration in your admin centre, documented as we go
- Ongoing monitoring so a setting that drifts back to "off" gets caught quickly
- Plain-English reporting you can show your insurer or your clients
Action steps for this week
- Check MFA first — open the per-user MFA page and confirm every active user is enrolled. That one step stops most account takeovers.
- Pick two more from the list above — DMARC monitoring and mailbox forwarding restrictions are fast wins.
- Book a 30-minute review — bring this checklist to your next conversation with your IT provider, or hand it straight to us.
The bottom line
You don't need to become a Microsoft expert to close these gaps. You need someone to walk you through the ten switches above, turn them on properly, and stay on top of them after. That's a realistic afternoon of work, not a year-long project.
If you'd like a clear picture of where your tenant stands against this checklist, contact Jordan Gall Cybersecurity and we'll run the audit with you.