Securing Microsoft 365 in a small business: the settings that matter

A freshly created Microsoft 365 tenant works, but it is not configured for your risk level: permissive external sharing, unenforced MFA, admin accounts used daily, rarely reviewed logs. One hour of targeted configuration removes most common attack vectors against small organizations.

The emergency (“break glass”) admin account deserves special care: excluded from usual policies to prevent total lockout, with a long password stored offline and usage logged.

In SharePoint and OneDrive, decide who can share externally and how: anonymous links, convenient but traceable or not, link expiry, allowed domains. An “anyone with the link” share with no expiry is a leak waiting to happen. For email, enable your licence’s anti-phishing protections and think twice before allowing automatic forwarding to external addresses.

Enable and review the unified audit log: unusual sign-ins, role changes, created mailbox rules. Without logs, a compromise can stay invisible for weeks. Also decide who receives Microsoft security alerts and how they are handled.

Finally, remember Microsoft 365 does not replace an independent backup: retention and the recycle bin do not cover every loss scenario. Our 3-2-1 backup guide covers this in detail.

SolutionsCW configures your tenant against a proven checklist, documents every choice and trains the person who will administer it daily. The goal: an environment you understand and control, not a black box depending on a single provider.