Microsoft 365 runs the day for most small businesses: email, Teams, file sharing, and calendars. That also makes it one of the first places attackers look. The good news is that most Microsoft 365 break-ins are preventable with a handful of settings and habits, and none of them require you to become an IT expert.
Here are the basics every small business should have in place, explained in plain English.
Quick checklist
- Multi-factor authentication (MFA) is on for every user
- Admin access is limited to a few separate admin accounts
- Older, less secure sign-in methods are blocked
- Email has protection against phishing and harmful links
- File sharing outside the company is controlled
- Your Microsoft 365 data is backed up separately
- Employees know how to spot and report suspicious email
- Devices that access company data are managed
- Departing employees are removed the same day they leave
1. Turn on multi-factor authentication for everyone
If you only do one thing on this list, make it this one. Multi-factor authentication (MFA) means a password alone is not enough to sign in. Users also confirm the sign-in with something they have, usually the Microsoft Authenticator app on their phone.
Most account takeovers start with a stolen or guessed password. With MFA in place, a stolen password on its own usually is not enough to get in.
- Cover every account, including the owner, the office manager, and shared logins.
- Use the Authenticator app instead of text messages when you can. It is harder to intercept.
- Teach people to deny prompts they did not start. An unexpected approval request means someone else has the password.
Microsoft’s free security defaults setting requires MFA and blocks older sign-in methods across the whole organization. Microsoft turns it on by default for new subscriptions, but in older setups it has often been switched off along the way, sometimes to “fix” a sign-in problem years ago. It is worth confirming it is still on.
Businesses on Microsoft 365 Business Premium can use Conditional Access instead. It replaces security defaults and allows more control, such as requiring company-managed devices or blocking sign-ins from countries where you do not do business.
A common scenario
An employee enters their password on a fake Microsoft sign-in page that arrived in a convincing “shared document” email. Without MFA, the attacker signs in, quietly reads the mailbox for a few weeks, and then sends a customer an invoice with new bank details. With MFA turned on, the stolen password alone usually gets them nowhere, and the employee sees an approval request they did not expect.
2. Keep admin accounts separate and few
A Global Admin account can change anything in your Microsoft 365 environment, including security settings, passwords, and billing. If one of those accounts is compromised, the attacker has the keys to everything.
- Do not use an admin account for everyday email and web browsing. Give admins a separate account just for administration.
- Keep the number of Global Admins small. Two is common for a small business, so you are not locked out if one person is unavailable.
- Make sure every admin account uses MFA. Microsoft now requires MFA to sign in to the Microsoft 365 admin center, but admin accounts should be protected everywhere they sign in.
- Review the list of admins at least once a year and remove anyone who no longer needs access, including former vendors.
3. Block older sign-in methods
Some older email apps and protocols sign in with just a username and password and cannot use MFA. Attackers like them for exactly that reason. Microsoft has retired most of these for Exchange Online, and both security defaults and Conditional Access can block what remains. It is still worth confirming legacy sign-ins are blocked in your environment.
If someone in the office is still using a very old version of Outlook or a basic mail app on their phone, this is a good time to update it.
4. Strengthen email protection
Email is still the most common way attacks start. Every Microsoft 365 business plan includes built-in protection against spam, malware, and spoofed senders. A few additional steps make a big difference:
- Link and attachment scanning. Microsoft 365 Business Premium adds Microsoft Defender for Office 365 Plan 1, which includes Safe Links, Safe Attachments, and protection against emails impersonating your own people. On Business Basic or Standard, ask whether an add-on makes sense for your business.
- External sender tags. A visible “External” label on messages from outside the company helps people notice a fake email pretending to be from the boss.
- Email authentication (SPF, DKIM, and DMARC). These DNS records help prove that email from your domain is really from you, which makes it harder for scammers to impersonate your business and helps your own email reach inboxes.
- Watch for forwarding rules. A common trick after an account is breached is a hidden rule that forwards copies of email to an outside address. Microsoft blocks automatic forwarding to outside addresses by default for most organizations, but older setups that already used forwarding may still allow it. It should be off unless there is a business reason for it.
5. Control file sharing
OneDrive and SharePoint make it easy to share files, sometimes too easy. Links set to “Anyone with the link” can be forwarded to people you never intended to see them.
- Set the default sharing link to people inside your organization.
- Limit or turn off “Anyone” links if your business does not need them.
- Have links to outside people expire after a set number of days.
- Store company files in SharePoint or Teams instead of individual OneDrive accounts, so files do not leave with an employee.
6. Back up your Microsoft 365 data
This one surprises a lot of business owners. Microsoft keeps its service running, but protecting your data is largely your responsibility. Recycle bins and retention settings are time-limited, and they will not help much if files are encrypted by ransomware, deleted by a former employee, or lost to a sync problem that goes unnoticed for weeks.
A separate Microsoft 365 backup copies your email, OneDrive, SharePoint, and Teams data to another location so you can restore it when something goes wrong. Just as important, the backup should be tested. A backup that has never been restored is a hope, not a plan.
A common scenario
A departing employee’s account is deleted to free up the license. Two months later, someone needs a contract that only lived in that person’s OneDrive and mailbox. By then, Microsoft’s retention window has passed and the files are gone. A separate backup, or a simple offboarding checklist, would have made this a five-minute restore instead of a lost document.
7. Train your team to spot phishing
Security settings catch a lot, but people are the last line of defense. Short, practical training goes further than a once-a-year slideshow.
- Pause before clicking links or opening attachments, especially when the message feels urgent.
- Verify payment or bank change requests by phone using a number you already have, not one in the email.
- Make it easy to report suspicious email, and thank people when they do. Fast reporting can stop an attack before it spreads.
8. Manage the devices that access company data
An employee’s phone or home laptop with company email on it is part of your security, whether you planned it or not. At a minimum, require a passcode or PIN on any device with company email, keep devices updated, and have a way to remove company data from a lost phone or a departing employee’s device.
Every Microsoft 365 business plan includes Basic Mobility and Security, a limited option for managing phones. Business Premium adds Microsoft Intune Plan 1 for fuller device management and Microsoft Defender for Business for endpoint protection on computers.
9. Have a same-day offboarding process
When someone leaves, their access should leave with them, the same day.
- Block sign-in and reset the password.
- Sign the user out of all sessions and remove their devices.
- Convert the mailbox to a shared mailbox or give a manager access if you need to keep it.
- Move any important files to a shared location, then remove the license.
Which Microsoft 365 plan do you need?
Many small businesses start on Microsoft 365 Business Standard. It covers email, Office apps, and Teams well, and it includes security defaults and built-in email protection. Microsoft 365 Business Premium adds the tools that close the bigger gaps: Conditional Access, Defender for Office 365 Plan 1, Intune Plan 1, and Defender for Business.
For businesses that handle sensitive client information, take payments, or have staff working from personal devices, Premium is often worth a look. The right choice depends on your business, and it does not always mean upgrading everyone.
If you are also curious about Copilot and other AI tools, our guide to using AI with the tools you already have explains where they fit and what to secure first.
Where SnapTechs can help
Not sure whether your Microsoft 365 environment is properly secured? SnapTechs helps small businesses review, configure, and manage Microsoft 365 so their teams can work confidently.
We work with businesses across Lancaster, Berks, and Schuylkill County, and the work usually looks like this:
- A Microsoft 365 security review with a clear list of what to fix first
- MFA rollout that does not disrupt your team
- Email protection, sharing settings, and admin account cleanup
- Microsoft 365 backup that is monitored and tested
- Ongoing management so settings stay right as your team changes
Get a Free Consultation See What We Do
Already a SnapTechs client? Submit a support request and we will review your Microsoft 365 security settings with you.
Need IT Support Without the Runaround?
Whether you need managed IT, Microsoft 365 help, business phones, backups, cybersecurity, networking, or a second opinion, SnapTechs gives you straightforward guidance and dependable support.
Practical IT support, Microsoft 365, business phones, cybersecurity, and managed services for small businesses.
© 2026 SnapTechs. All rights reserved.
Contact
Lititz, PA 17543
Ephrata, PA 17522
Quick Links
