If you only do one thing, make sure every user, and above all every administrator, has to use multi-factor authentication (MFA) to sign in. In Microsoft 365 the simplest way to do that on any licence is to turn on security defaults, which Microsoft provides at no extra cost. After that, the priorities are limiting who holds admin rights, blocking automatic forwarding of email to outside addresses, protecting your domain from spoofing, and having a backup and a breach plan you have actually tested.
None of these needs new software. They are settings in tenants that most businesses already pay for, and they are often left as they were on the day the account was created, sometimes years ago, when Microsoft's defaults were weaker than they are now.
Why it is worth an hour of your time
The government's Cyber Security Breaches Survey 2025/2026, published in April 2026, found that 43% of UK businesses identified a cyber breach or attack in the previous 12 months, rising to 46% of small businesses. Phishing was by far the most common type, experienced by 38% of businesses. Only 47% of businesses reported having two-factor authentication in place. A phishing email that steals a password is far less damaging when that password alone cannot open the account.
The eight settings to check
1. Security defaults, or Conditional Access
Security defaults are a single switch in the Microsoft Entra admin center. Once enabled, every user must register for MFA, administrators must complete MFA every time they sign in, and sign-ins using older protocols that cannot do MFA (legacy authentication) are blocked. Microsoft says tenants created on or after 22 October 2019 may already have them on, so check rather than assume. If your licences include Microsoft Entra ID P1, you can use Conditional Access policies instead, which allow exceptions and finer control, but you must then switch security defaults off and put equivalent policies in place straight away.
2. Fewer, separate admin accounts
Microsoft recommends giving the Global Administrator role to fewer than five people, and granting each administrator only the permissions their job needs. The NCSC goes further: administrators should have a separate everyday account for email and web browsing, and use the privileged account only for admin work. In a small business that often means the owner's daily mailbox should not also be the account that controls the whole tenant.
3. Emergency access accounts
Microsoft also recommends two cloud-only emergency access (break glass) accounts with Global Administrator rights, not assigned to any one person, for the day normal admin accounts are locked out. Store their credentials securely, keep them out of daily use and review them as part of your regular checks.
4. Automatic forwarding to external addresses
A common step after an account is compromised is a hidden rule that forwards incoming mail to an outside address. In the Microsoft Defender portal, the outbound spam filter policy controls whether automatic external forwarding is allowed. The default value, Automatic, now means off for most organisations, but older tenants may still have it on. Microsoft itself advises setting it explicitly to on or off rather than leaving it on Automatic. Turn it off and allow exceptions only where there is a business reason.
5. SPF, DKIM and DMARC on your domain
These three DNS records make it harder for criminals to send email that appears to come from your domain, which protects your customers and suppliers as well as you. The NCSC recommends setting up SPF and DKIM, then moving a DMARC policy from monitoring only towards rejecting spoofed mail, using the reports to check nothing legitimate is caught. Remember parked and secondary domains too. The NCSC offers a free email security check service that tests a domain against its standards.
6. Joiners, movers and leavers
Accounts belonging to people who have left, and permissions that outlived a role change, are easy openings. The NCSC advises a joiners, movers and leavers process and regular reviews of accounts for unnecessary privileges. A quarterly look at the user list, licences, shared mailbox access and guest users in Teams and SharePoint is a sensible minimum.
7. A backup you have tested
The NCSC's guide for small organisations asks businesses to back up all the data they need to operate, including emails and customer records, to protect online backups with two-step verification, and to know how to restore them. Before relying on Microsoft 365 retention alone, confirm in writing what your setup can restore, how far back, and who would do it.
8. A plan for when something goes wrong
If a compromised mailbox exposes personal data, the ICO says a reportable breach must be reported without undue delay and within 72 hours of discovering it, and that you should keep a log of what happened even if you decide not to report. Write down who resets passwords, who checks for forwarding rules and sign-ins, and who decides about reporting, before you need it.
How Apex helps
We review Microsoft 365 tenants against this list, explain what we find in plain English, and make the changes with you, so nobody is locked out on a Monday morning. Ongoing checks, admin access and user changes can then sit under cybersecurity and compliance or day-to-day managed IT support. If you are weighing up a formal certification as well, our guide to ISO 27001, SOC 2 and Cyber Essentials sets out the differences. This article is general guidance; menu names in Microsoft 365 change, so check current Microsoft documentation before making changes.
Sources
- GOV.UK, Cyber security breaches survey 2025/2026
- Microsoft Learn, Security defaults in Microsoft Entra ID
- Microsoft Learn, Best practices for Microsoft Entra roles
- Microsoft Learn, Control automatic external email forwarding in Microsoft 365
- NCSC, 10 Steps to Cyber Security: identity and access management
- NCSC, Email security and anti-spoofing
- NCSC, Small organisations guide to cyber security: backing up your data
- ICO, 72 hours: how to respond to a personal data breach