Most small businesses run everything through one of these two platforms, which makes the tenant the single highest-value target in the organisation. Defaults are tuned for compatibility rather than security, and a handful of changes close the gaps we most frequently find during incident work.

Authentication first

  • Enforce multi-factor authentication for every account, including service and shared mailboxes where possible.
  • Prefer passkeys or hardware keys over app codes, and app codes over SMS.
  • Disable legacy authentication protocols such as IMAP, POP, and SMTP basic auth where nothing requires them — these bypass MFA entirely and are actively targeted.
  • Require re-authentication for administrative actions.

Mailbox rules are the compromise signature

Attackers who gain mailbox access create rules that forward messages externally or move security alerts to a rarely-read folder. Both platforms can alert on new forwarding rule creation and can block automatic external forwarding entirely. Turn this on — it is the single most useful detection available for business email compromise, and it is off by default.

Control third-party app access

By default, users can frequently grant third-party applications access to their mail and files with one click. Restrict consent to administrators, or to a vetted list, and review existing grants now. Persistent OAuth tokens survive password changes, which makes them a favoured persistence mechanism.

Administrative hygiene

  • Use separate administrative accounts rather than granting admin rights to daily-use accounts.
  • Keep the number of global administrators small and review it quarterly.
  • Enable audit logging with the longest retention your plan allows.
  • Alert on sign-ins from unusual locations and on impossible travel.

Sharing and external access

Review default sharing settings for files and drives. Both platforms frequently default to permitting link sharing that is broader than organisations expect. Set link defaults to internal, require expiry on external shares, and audit what is currently shared publicly — the results are usually surprising.

Email authentication

Configure SPF, DKIM, and DMARC for your domain and move DMARC to enforcement after a monitoring period. Add an external-sender banner so staff can see at a glance when a message came from outside. Both changes directly reduce the effectiveness of impersonation against your own people, suppliers, and customers.