CMMC
Six Microsoft 365 Security Settings to Check First
Six Microsoft 365 security settings decide how hard it is to break into your email. Most are already in the plan you pay for, and you can check them this week.
Capital Cyber. Sources are listed at the end of the article.
Which Microsoft 365 Security Settings Should I Check First?
Microsoft released its latest quarterly email threat report on November 5. Trends shift from quarter to quarter. The basic defenses a small business needs do not.
Start with multi-factor authentication, or MFA. It means a stolen password alone is not enough to get in.
The simplest way to turn it on is a switch called security defaults. You find it in the Microsoft Entra admin center. It asks every user to set up MFA and makes admins use it too.
If your plan includes Conditional Access, you can use that instead. It gives you more control. You use one approach or the other, not both.
An authenticator app is stronger than a text message code. Ask your staff to use the app when they can.
How Do I Know Old Sign-in Methods Are Blocked?
Older email programs used a basic sign-in that cannot ask for an MFA code. Attackers like these doors because they skip the second check.
Microsoft has shut off most of these methods in Exchange Online. Still, confirm that nothing in your tenant depends on them. Security defaults blocks them for you.
If you use Conditional Access, create a policy that blocks legacy sign-ins. Then check your sign-in logs for any old apps still trying to connect.
Who Should Have Admin Rights in Microsoft 365?
Very few people. An admin account can change every setting, read any mailbox and add new users. If one is stolen, the attacker owns your tenant.
Microsoft advises keeping the number of global admins small. Each admin should have a separate account just for admin work. That account should never be used to read email or browse the web.
Many small firms give the owner global admin on their everyday account. That is a common risk. Fixing it takes a few minutes.
Can Someone Secretly Forward My Company's Email?
Yes, and it is one of the first things an intruder does. They set a rule that copies your mail to an outside address. Often they add a rule that hides replies, so you never see the warning signs.
Check the outbound spam policy in Microsoft Defender. Set automatic forwarding to outside addresses to off. Allow it only for people with a real business need.
Then review inbox rules on key mailboxes, like the owner's and the bookkeeper's. Look for rules that move or delete messages about invoices or payments.
Can Criminals Send Email That Looks Like It Came from Us?
They can if your domain is not protected. Three records fix most of this: SPF, DKIM and DMARC. They tell other mail servers which messages truly came from you.
SPF and DKIM prove a message is genuine. DMARC tells receivers what to do with fakes. Start DMARC in monitor mode, then tighten it once your real mail passes.
These records do not stop lookalike domains, such as one letter swapped. For that, make one rule firm. Any change to payment details gets confirmed by phone, using a number you already have on file.
Will I Know If Something Goes Wrong?
Only if logging is on and alerts reach a person. The audit log records sign-ins, rule changes and mailbox access. It is how you learn what happened after a break-in.
Confirm the audit log is turned on. Then look at the alert policies in Microsoft Defender. Some, like alerts for suspicious forwarding, come built in.
Send those alerts to someone who reads them every day. An alert that lands in an unwatched inbox does not protect you.
Frequently Asked Questions
4 QUESTIONSWhat does this mean for my business?
It means your biggest email risks can often be reduced with settings you already own. Turn on MFA, block old sign-ins, limit admins, stop outside forwarding, protect your domain and watch your alerts. Each step closes a common path that criminals use to steal payments or data.
Is security defaults enough for a small business?
Security defaults is a strong starting point for many small businesses. It turns on MFA and blocks legacy sign-ins at no extra cost. Firms that need more control, such as different rules for different users or devices, usually move to Conditional Access as they grow.
Do I need to buy extra Microsoft licenses?
Not to start. Every plan includes basic email filtering and security defaults. Microsoft 365 Business Premium adds Defender for Office 365 Plan 1 and Conditional Access. Whatever you have, apply Microsoft's Standard preset security policy, which sets recommended filtering for you in one step.
How often should I review these settings?
Review them at least once a quarter, and after any staff change. Settings drift as people come and go. For a deeper check, CISA publishes free secure configuration baselines for Microsoft 365, along with a tool that compares your tenant against them.
Sources
READ 2026-11-07- CISA, Secure Cloud Business Applications (SCuBA) Project
- Microsoft Security Blog, Email threat landscape: Q3 2026 trends and insights
- Microsoft Learn, Security defaults in Microsoft Entra ID
- Microsoft Learn, Preset security policies in EOP and Microsoft Defender for Office 365
This article explains the regulations and is not legal advice.
Talk it through in 30 minutes.
A call is a conversation, not a pitch. Tell us how your business runs and we will tell you what we would manage.
Looking for CMMC? Our Compliance Division, Capital Cyber Compliance, delivers it.
Under 25 people? Apply for an in-kind cybersecurity grant from Cyber Grants Alliance, a nonprofit. No cost to you.