Microsoft 365 Security

The settings that keep a small business’s email, files and accounts safe in Microsoft 365, and what Business Premium adds over Business Standard.

Microsoft 365

Securing Microsoft 365 for a small business

Securing Microsoft 365 for a small business means getting a handful of settings right and keeping them right: multi-factor authentication (ideally passkeys) on every account, a few separate admin accounts, automatic forwarding to outside addresses blocked, file sharing controlled, email filtering tuned, devices managed and a backup of your data. Most of this works on any business plan. Business Premium adds conditional access, Intune device management and Microsoft’s Defender tools for email and devices.

Microsoft runs the service. How your organisation is set up, who can sign in and what they can do is down to you, and that’s where most problems start.

We’re a Microsoft Partner and we set Microsoft 365 up this way for the businesses we manage. We can supply your licences too.

Book a Call

Sign-in

MFA, passkeys and conditional access

Every Microsoft 365 business plan includes security defaults. They make everyone register for multi-factor authentication, make administrators use it every time they sign in, and block older sign-in methods that can’t use it. New organisations have them switched on. If yours was set up years ago, or someone switched them off to get an old scanner working, that’s the first thing to check.

Passkeys are stronger still. They work on every business plan, and a fake login page can’t capture them. Our guide to passkeys explains how they work.

Business Premium adds conditional access, which replaces security defaults with your own rules: MFA everywhere, sign-ins blocked from countries you never work in, company data only on managed devices, passkeys required for admins. You use one or the other, not both.

Admin accounts

Fewer admins, kept separate

The account that first set up Microsoft 365 is a Global Administrator, with control over everything. Microsoft’s advice for small businesses is to keep admin accounts few, use them only for admin work and give people the narrowest role that does the job, such as User Administrator for someone who only creates accounts.

In practice, nobody reads email or browses the web as an admin, admin accounts don’t advertise themselves in their names, and two emergency “break glass” accounts are kept safe for the day every other sign-in fails. Microsoft now requires multi-factor authentication to sign in to its admin portals, but the strongest method, a passkey, is the one to use.

Mailbox rules and forwarding

When a criminal gets into a mailbox, one of the first things they often do is quietly add a rule: forward everything to an outside address, or move replies from one client into a folder nobody opens. It lets them watch a deal or an invoice and step in at the right moment.

Microsoft 365 can block automatic forwarding to outside addresses. It’s off by default in newer organisations, but some older ones still allow it, so we set it explicitly and allow exceptions only where a business really needs them. Whenever an account might have been exposed, we check its mailbox rules too.

Every plan includes Microsoft’s built-in protection against malware, spam and spoofed senders. Business Premium adds Defender for Office 365 Plan 1: Safe Links checks web links when they’re clicked, Safe Attachments tests attachments before delivery, and impersonation protection looks for emails pretending to be your directors or regular contacts. Stopping criminals sending email as your own domain is a separate job for your DNS records: SPF, DKIM and DMARC.

Files

Sharing that doesn’t leak

SharePoint, OneDrive and Teams make sharing easy, sometimes too easy. A link that works for anyone who has it can be passed on without you ever knowing. We set sharing to suit how you work: links that only work for named people by default, guest access reviewed, and expiry dates on anything shared outside the business.

Secure Score

Microsoft Secure Score, in the Defender portal, shows how many of Microsoft’s recommended security actions you’ve taken. It’s a useful to-do list rather than a pass mark: Microsoft itself says it isn’t a measure of how likely you are to be breached. We use it to find gaps and track progress, and we’ll tell you which recommendations aren’t worth the disruption for a business your size.

Backup

Microsoft 365 needs a backup too

Microsoft keeps the service running, but that isn’t the same as a backup you control. Files deleted from SharePoint and OneDrive sit in the recycle bins for 93 days and are then removed for good. Email, OneDrive, SharePoint and Teams should be backed up separately, so you can go back to before a mistake, a ransomware attack or a departing employee’s clear-out.

Daily backups monitored by our team are part of our managed IT, and we’ll make sure your Microsoft 365 data is covered, not just the files on your computers. More on backup and disaster recovery.

Devices

Intune device management

Every business plan includes Basic Mobility and Security, a limited part of Intune for protecting company email and files on enrolled phones and tablets. Business Premium includes Intune Plan 1, which properly manages Windows PCs, Macs, iPhones and Android devices: encryption, updates, approved apps and the ability to wipe company data from a lost or stolen device. On personal phones, app protection keeps company data inside work apps without taking over the whole phone.

Premium also includes Defender for Business, Microsoft’s device protection built for smaller organisations.

Licensing

Business Standard or Business Premium?

Both plans include the Office desktop apps, email, Teams and file storage, for organisations of up to 300 users. The difference is security and device management. This is the general picture from Microsoft; licence details change, so we confirm the current position before you buy.

Every business plan

Security defaults, with multi-factor authentication on by default
Passwordless sign-in with passkeys, Windows Hello for Business or the Authenticator app
Built-in protection for every mailbox against malware, spam and spoofing
Basic Mobility and Security for phones and tablets
Microsoft Secure Score

Business Premium adds

Conditional access (Microsoft Entra ID P1)
Defender for Office 365 Plan 1: Safe Links, Safe Attachments and impersonation protection
Intune Plan 1 for full device and app management, including Macs and personal devices
Defender for Business to protect laptops and desktops
Labelling and encryption for sensitive email and documents

Premium is usually worth it if you handle client money or sensitive personal data, have staff working on personal devices, or need conditional access to satisfy a client or insurer. You can mix plans in one organisation, but Premium features need to be licensed for each person they protect, so we’ll help you decide who needs what.

How we help

Set up properly, kept that way

For the businesses we manage, this is part of the job: multi-factor authentication and security best practice enforced, anti-spam on every mailbox, and settings checked so they don’t drift as people join and leave. Microsoft 365 licences are billed separately, and we can supply them. More on our Microsoft 365 support.

It also counts towards Cyber Essentials, which treats Microsoft 365 as a cloud service in scope and requires multi-factor authentication on it. We help businesses get Cyber Essentials, and Cyber Essentials Plus when a contract asks for it.

Not sure where you stand?

Get your set-up checked

If your Microsoft 365 was set up by someone who has since moved on, or nobody has looked at it in years, we’ll review it as part of our free assessment when you’re thinking of moving your IT to us. For a quick outside view, the free AlphaSec security snapshot checks your domain’s email protection from public records. Read more about our approach to cyber security.

Questions

Microsoft 365 security: FAQs

Is Microsoft 365 secure out of the box?

Reasonably, if it was set up recently: new organisations get security defaults, which switch on multi-factor authentication, and every mailbox gets Microsoft’s built-in filtering. But older set-ups often have gaps, defaults get switched off to fix a problem and never switched back on, and settings such as sharing and admin roles depend on how you work. It’s worth a review.

Do we need Business Premium?

Not always. Business Standard with security defaults, passkeys and a separate backup is a sound set-up for many small offices. Premium is worth it when you need conditional access, managed devices or stronger email protection, for example because staff use personal phones or you handle client money. We’ll tell you honestly which fits.

Does Microsoft back up our Microsoft 365 data?

Microsoft keeps the service resilient, but that isn’t a backup you control. Deleted files stay in the SharePoint and OneDrive recycle bins for 93 days and are then removed. Microsoft sells a separate Microsoft 365 Backup service, and other backup services exist; either way, you need a copy you can restore after a deletion, a ransomware attack or a departing employee’s clear-out.

Can we use passkeys with Microsoft 365?

Yes, on every business plan. Staff can keep a passkey in the Microsoft Authenticator app or on a security key, and sign in with their fingerprint, face or PIN. With Business Premium, conditional access can require passkeys for admin accounts or for everyone.

What is a good Microsoft Secure Score?

There isn’t a pass mark. Secure Score shows how many of Microsoft’s recommended actions you’ve taken, and not every recommendation suits every business. Use it to spot gaps and track progress rather than to chase 100%.

It’s very simple

How To Get Started With Us

We’ve made transferring to us effortless with our Easy Transfer Service. Book your free consultation now to get started!

Book a Call