Why Having Microsoft 365 Doesn’t Automatically Mean You’re Secure
Microsoft 365 does not secure itself automatically. Here are the 10 most important security settings every small business should check:
- Enable Multi-Factor Authentication (MFA) for every user account — not just admins.
- Limit Global Administrator accounts to a maximum of two, and use them only when needed.
- Remove stale and ex-employee accounts — active accounts for past staff are a major vulnerability.
- Use layered email protection — including external email filtering such as IRONSCALES and Microsoft 365’s available threat-protection settings.
- Block legacy authentication protocols that bypass MFA entirely.
- Ensure every company device is protected — by an actively managed endpoint security product, such as ESET (This is the one we use and recommend in Shropshire Computers).
- Configure Conditional Access policies to restrict who can log in and from where.
- Review OneDrive and SharePoint sharing settings — many businesses unknowingly share files publicly.
- Set up a proper backup strategy — Microsoft 365 does not automatically back up your data.
- Turn on unified audit logging so you can investigate what happened if something goes wrong.
Most of these settings require no additional cost. Items 6 and 7 require Microsoft 365 Business Premium. Shropshire Computers can review your current tenant configuration and close any gaps.
What a Microsoft 365 Security Review Can Reveal
Imagine you are the owner of a small property management firm in Shrewsbury. Twelve staff members, a Microsoft 365 Business Standard subscription, and a setup that has worked without obvious problems for the past two years. You have never questioned your security settings because nothing has gone wrong.
Then Shropshire Computers runs a security review of your Microsoft 365 tenant.
The results show that six of your twelve users do not have MFA enabled. Three former employees still have fully active accounts. Your SharePoint document library allows sharing with anyone who has the link. Your team has never enabled audit logging, which would help you identify unauthorized access to your files.
Nothing has gone wrong yet. But your tenant is not secure. In today’s threat landscape, seeing no problems does not mean your business is secure.
At Shropshire Computers, this scenario plays out regularly when we review a new client’s Microsoft 365 setup. The client paid the subscription. The licences are active. However, businesses often fail to configure their security settings properly or review them after the initial setup.
This Microsoft 365 security checklist covers the 10 most important settings every small business in Shropshire, Shrewsbury or Telford should check, verify, and act on today.
Why Isn’t Microsoft 365 Secure Straight Out of the Box?
This is one of the most important things for small business owners to understand. Microsoft 365 provides the tools to secure your business. It does not automatically apply those tools for you.
Microsoft’s shared responsibility model means that Microsoft handles the security of the platform itself. This means the data centres, the infrastructure and the service uptime. Your business, however, is responsible for configuring the security settings within your tenant, managing user accounts, and protecting your own data.
In practice, many small businesses in Shropshire and Shrewsbury set up Microsoft 365, create user accounts, and then focus on using the product without ever revisiting the security configuration. As a result, settings that should be switched on never get enabled, and vulnerabilities accumulate quietly over time.
The 10 items below address the most common and most consequential gaps we find when reviewing small business Microsoft 365 tenants.
Identity and Access — Are the Right People Getting In, and the Wrong People Kept Out?
Identity is the primary attack surface in Microsoft 365. According to Microsoft’s own security research, more than 99.9% of compromised accounts did not have MFA enabled. The three checks in this section address that risk directly.
1. Enable Multi-Factor Authentication for Every User
What it is: Multi-Factor Authentication (MFA) requires users to confirm their identity in two steps when logging in. Typically a password plus a code from the Microsoft Authenticator app or a text message.
Why it matters: MFA is the single most effective control available in Microsoft 365. Even if an attacker steals a user’s password through a phishing email or a data breach elsewhere, they cannot log in without the second factor. Microsoft’s research shows MFA blocks over 99.9% of automated account compromise attacks.
What to check:
- In the Microsoft 365 admin centre, navigate to Users > Active users > Multi-factor authentication
- Verify that MFA status shows as “Enabled” or “Enforced” for every user and not just administrators
- Ensure users are set up with the Microsoft Authenticator app, not just SMS codes (authenticator apps are more resistant to SIM-swapping attacks)
In our experience, MFA is the most frequently incomplete setting we find in small business tenants. It is often enabled for the primary admin account but left off for regular staff — the accounts that are targeted most often in phishing campaigns.
2. Limit and Review Global Administrator Accounts
What it is: A Global Administrator in Microsoft 365 has unrestricted access to every setting, every user account, and every piece of data across the entire tenant. It is the highest level of access that exists.
Why it matters: If an attacker compromises a Global Admin account, they can create new users, reset passwords for every account in the business, read all email, and delete data. Every unnecessary Global Admin account is an additional attack surface.
What to check:
- In the admin centre, go to Roles > Role assignments and review who holds the Global Administrator role
- The NCSC and Microsoft both recommend a maximum of two to four Global Admin accounts for small businesses
- Day-to-day admin tasks should use lower-privilege roles (such as User Administrator or Exchange Administrator) wherever possible
- Global Admin accounts should have MFA enforced and should ideally not be used as regular email accounts
It is common to find that the person who first set up the Microsoft 365 account, a director, a previous IT provider, or a reseller, still holds Global Admin access and has never had it reviewed. Former IT providers who are no longer under contract are a particular risk.
3. Remove Stale and Ex-Employee Accounts
What it is: When a member of staff leaves the business, their Microsoft 365 account continues to exist, and remains fully accessible, until someone explicitly closes or disables it.
Why it matters: Active accounts belonging to former employees are a well-documented attack vector. Attackers specifically look for accounts with lapsed oversight, because nobody is monitoring them day to day. Furthermore, a departed employee who left on poor terms still has access to company email, files, and systems until that account is removed.
What to check:
- Review your full list of active users in the admin centre and compare it against your current staff list
- For every account that belongs to a former employee, immediately block sign-in and reset the password
- Transfer any necessary data before deleting the account permanently
- As a process point, make sure your offboarding procedure includes Microsoft 365 account closure as a mandatory step on the employee’s last day
We regularly find accounts for staff who left six, twelve, or even twenty-four months ago still active and licensed. In some cases, those accounts are still being used by IT providers for remote support access, and the business has no idea.
Email Security — Is Your Inbox Protected Against Today’s Threats?
Phishing remains the most disruptive type of attack on UK businesses. Your email configuration determines how much of that threat reaches your team’s inboxes at all.
4. Add an External Email Security Layer
What it is: Email security works best in layers. An external email security service can inspect messages before they reach Microsoft 365, helping filter spam, suspicious messages, and phishing attempts. Shropshire Computers uses IRONSCALES as an example of an additional email-security layer. Microsoft 365 also offers built-in protections, such as Safe Links and Safe Attachments on eligible plans, which can provide further checks for malicious links and attachments when correctly configured.
Why it matters: No single filter catches every threat. An external layer can help stop unwanted or suspicious email before it enters users’ inboxes, while Microsoft 365’s own protections can provide another line of defence. Layering these controls reduces reliance on one tool alone. It is important to confirm which protections are included in your licences and that policies are enabled for the users who need them.
What to check:
- Review the configuration and reporting in your external email security service, including IRONSCALES if it is part of your setup
- If your Microsoft 365 licence includes Safe Links and Safe Attachments, verify that the policies are enabled and applied to the appropriate users
- Check that available policies are configured to take the appropriate action on confirmed threats, not simply record them
External filtering and Microsoft 365’s built-in protections should be reviewed together. Having a service in place does not automatically mean every policy is correctly configured, so check coverage, alerts, quarantine handling, and how users report suspicious messages.
5. Block Legacy Authentication Protocols
What it is: Legacy authentication refers to older connection methods, such as Basic Authentication, that some email clients and applications use to connect to Microsoft 365. These protocols do not support MFA.
Why it matters: If you have legacy authentication enabled, an attacker can use it to access accounts using only a stolen password, and completely bypass the MFA you have so carefully set up. Blocking legacy authentication closes this gap and ensures that MFA cannot be circumvented.
What to check:
- In the Microsoft Entra admin centre, go to Protection > Conditional Access > Named locations and review your sign-in logs for any legacy authentication traffic
- Check the Microsoft 365 Sign-in report for any successful logins using legacy protocols
- Use Conditional Access (see item 7) to create a policy that blocks legacy authentication for all users
This is one of the less well-known vulnerabilities, but it matters significantly. Several of the small business account compromises we have helped local firms recover from involved an attacker using legacy authentication to bypass MFA something that would have been prevented with a single Conditional Access policy.
Device Security — What Happens If a Laptop Goes Missing?
Your Microsoft 365 tenant is only as secure as the devices that access it. These two settings give your business control over those devices, and over who can log in from them.
6. Protect Every Company Device with ESET
What it is: ESET is an endpoint security product that can help protect business devices against malware and other threats. The right ESET product and features depend on the package deployed by your IT provider, so make sure the protection in place matches the devices and risks in your business.
Why it matters: Every laptop and desktop used for work can become a route into business systems if it is left unprotected or out of date. A centrally managed endpoint security solution helps keep protection consistent, monitor device status, and respond when a threat is detected. Shropshire Computers resells ESET, so it is the endpoint security option to discuss with the team when reviewing your setup.
What to check:
- Open your ESET management console, if one is used, and check that all business devices are listed and reporting correctly.
- Verify that ESET protection is active and up to date on each device, and review any alerts or devices that have stopped reporting.
- Check that all work devices in scope—including any supported laptops, desktops, or mobile devices—are covered by the appropriate product and policies
Do not assume a device is protected just because the business has purchased security software. Confirm that the product is installed, activated, updated, and reporting correctly. Your IT provider can help verify coverage and make sure protection is not missing from devices used for work.
7. Configure Conditional Access Policies
What it is: Conditional Access is a policy engine in Microsoft Entra ID that controls who can log into Microsoft 365, from which devices, and under which conditions. Think of it as an intelligent bouncer that checks more than just a password.
Why it matters: Conditional Access lets you enforce rules such as: require MFA for every login, block access from countries where your business has no staff, require devices to be company-managed before allowing access, or block logins that show signs of unusual risk. Together, these policies dramatically reduce the attack surface of your Microsoft 365 tenant.
Key Conditional Access policies every small business should implement:
- Require MFA for all users (a more robust approach than per-user MFA settings)
- Block legacy authentication (see item 5 best implemented as a Conditional Access policy)
- Require compliant devices for access to sensitive data (if devices are managed through Intune)
- Block sign-ins from high-risk locations where your business has no presence
Most small businesses we work with have never configured a single Conditional Access policy. For businesses on Business Premium, setting up even two or three of these policies delivers an immediate and substantial improvement in security posture often without any disruption to staff.
Data and Storage — Do You Know Who Can Access Your Business Files?
Many small businesses invest heavily in identity and email security, and then leave their file storage entirely unprotected. These two checks address that gap.
8. Review OneDrive and SharePoint External Sharing Settings
What it is: Microsoft 365 allows users to share files and folders with people outside the organisation via OneDrive and SharePoint. The default sharing settings may be more permissive than your business realises.
Why it matters: If sharing is set to “Anyone with the link,” any file a staff member shares externally can be accessed by anyone who receives or finds that link, including people who were never intended to see it. Additionally, shared links often outlive their purpose, remaining active long after a project ends.
What to check:
- In the SharePoint admin centre, go to Policies > Sharing and review the external sharing level
- For most small businesses, the appropriate setting is “New and existing guests” (requiring recipients to verify their identity) rather than “Anyone”
- Audit existing shared links by reviewing the sharing reports in the Microsoft 365 admin centre
- Set a default expiry date on shared links so they do not remain active indefinitely
We have encountered SharePoint libraries at Shrewsbury-based businesses set to “Anyone” sharing meaning that a link posted in a public forum, forwarded to the wrong person, or intercepted in transit would give full access to business files. This is one of the easiest settings to tighten, and one of the most frequently overlooked.
9. Set Up a Proper Backup Strategy
What it is: A deliberate process for creating regular copies of your Microsoft 365 data, email, OneDrive files, SharePoint libraries, and Teams messages, stored in a location separate from your Microsoft 365 tenant.
Why it matters: This is possibly the most important and most misunderstood point on this entire checklist. Microsoft does not automatically back up your Microsoft 365 data. Microsoft’s Service Agreement is explicit: they provide the platform infrastructure, but they are not responsible for data loss. If files are deleted, accidentally, by a departing employee, or by a ransomware attack, Microsoft’s own recycle bin and version history features have limited retention windows and are not a substitute for a proper backup.
What to check:
- Do not assume Microsoft 365 includes backup. It does not, beyond short-term recycle bin and version history
- Consider a dedicated Microsoft 365 backup solution such as Veeam, Datto, or Acronis Cyber Protect Cloud, your IT provider can advise on the right option
- Ensure backups cover email (Exchange Online), files (OneDrive and SharePoint), and where necessary, Teams data
- Verify that backup recovery works by testing a restore periodically
“I thought Microsoft backed everything up” is one of the most common responses we hear from business owners in Shropshire and Shrewsbury when we raise this point. It is an understandable assumption, but it is not correct, and the consequences of data loss without a backup can be severe.
Visibility — Would You Know If Something Had Gone Wrong?
10. Turn On Unified Audit Logging
What it is: Unified audit logging records activity across your Microsoft 365 tenant, logins, file access, email activity, admin changes, and more in a searchable log that can be reviewed during an investigation.
Why it matters: If a breach occurs or if you suspect one, audit logs tell you what happened, when it happened, and which account was involved. Without audit logging enabled, investigating a breach is like trying to solve a crime with no witnesses and no CCTV. Critically, the UK’s Information Commissioner’s Office (ICO) expects organisations to demonstrate they can investigate and report breaches accurately, and audit logs are central to that process.
What to check:
- In the Microsoft Purview compliance portal, go to Audit and confirm that audit log search is active
- Ensure that the audit log retention period is set appropriately — Business Premium retains logs for up to one year
- Consider setting up alert policies for high-risk activities, such as large volumes of file downloads or mass email deletions
Audit logging is the one setting that businesses most regret not having enabled. Always after they needed it. Turning it on costs nothing and requires no ongoing maintenance. It simply needs to be switched on.
How Do You Know What Your Business Has Already Got in Place?
Running through this checklist manually requires access to the Microsoft 365 admin centre and a working knowledge of where each setting lives. For many small business owners and office managers, that is not straightforward.
Microsoft does provide a built-in tool called the Microsoft Secure Score, available in the Microsoft 365 Defender portal. It assesses your tenant against a range of security best practices and gives you a score, along with a prioritised list of recommended actions. It is a useful starting point though it does not replace a thorough review by an IT professional.
For businesses across Shropshire looking for a clear, plain-English assessment of their current Microsoft 365 security posture, Shropshire Computers offers a dedicated Microsoft 365 security review. We check all ten items on this list, identify any gaps, and give you a practical, prioritised plan for closing them without unnecessary upselling or jargon.
The Bottom Line on Your Microsoft 365 Security Checklist
A well-configured Microsoft 365 tenant is one of the most effective cybersecurity measures a small business can have in place. Conversely, a misconfigured one, even if every licence is paid for, can give a false sense of security while leaving the business genuinely exposed.
Here are the four most important things to take away from this checklist:
- MFA is non-negotiable — enable it for every user, not just administrators, and use an authenticator app rather than SMS where possible.
- Microsoft 365 does not back up your data — if you do not have a third-party backup in place, you are one accidental deletion or ransomware attack away from serious data loss.
- Many of the most important settings are switched off by default — a paid subscription does not mean a secure one.
- Ex-employee accounts and over-privileged admins are the gaps attackers look for first — review your user list and admin roles regularly.
If you would like Shropshire Computers to run through this checklist with you — or if you would like us to carry out a full Microsoft 365 security review for your business — we are ready to help.
Book a Microsoft 365 security consultation with Shropshire Computers
Frequently Asked Questions
Is Microsoft 365 secure by default for small businesses?
Not fully. Microsoft 365 provides the tools to secure your tenant, but most of the most important settings including email threat protection, audit logging, and in some cases even MFA are not switched on automatically. Small businesses need to actively configure these settings, or work with an IT provider to do so.
What is the most important Microsoft 365 security setting for a small business?
Multi-Factor Authentication (MFA) is consistently the single most impactful security setting available. Microsoft’s research shows that MFA blocks over 99.9% of automated account compromise attacks. Enable it for every user account not just administrators and prioritise the Microsoft Authenticator app over SMS codes.
Do I need Microsoft 365 Business Premium for all of these security settings?
No. Many of the most important settings are available across all Microsoft 365 Business plans. MFA, admin account management, stale account removal, sharing settings, and audit logging are all available on Business Basic and Business Standard. Business Premium adds useful security and access-management capabilities, including Conditional Access. Endpoint protection and email filtering should still be checked against the products actually deployed and the features included in your licences.
Does Microsoft 365 back up my business data automatically?
No. This is one of the most common misconceptions about Microsoft 365. Microsoft provides the platform and maintains its infrastructure, but they are not responsible for data stored within your tenant. Accidental deletion, ransomware, or a malicious insider can permanently destroy data unless you have a separate backup solution in place. A dedicated Microsoft 365 backup tool such as Veeam, Datto, or Acronis is strongly recommended.
How do I check my current Microsoft 365 security settings?
A good starting point is Microsoft Secure Score, available in the Microsoft 365 Defender portal. It scores your current configuration against Microsoft’s recommended security practices and provides a list of prioritised actions. For a more thorough and plain-English review, Shropshire Computers offers a dedicated Microsoft 365 security assessment for small businesses across the region.
What happens if I do not remove accounts for staff who have left?
Active accounts belonging to former employees remain accessible to anyone who knows or can guess the login credentials. Attackers specifically target dormant accounts because they are less likely to trigger alerts. A former employee who left on poor terms may also retain access to company email, files, and systems until the account is closed. Remove or disable accounts on the employee’s last day, every time, without exception.
What is unified audit logging in Microsoft 365 and why does it matter?
Unified audit logging records activity across your Microsoft 365 tenant including logins, file access, admin changes, and email actions in a searchable log. If a breach occurs, audit logs tell you exactly what happened, when, and from which account. Without audit logging, investigating a breach is nearly impossible. The ICO also expects organisations to be able to report breaches accurately, and audit logs are central to demonstrating that. Enable it now. it costs nothing and needs no ongoing maintenance.
