Most small-business security incidents start with email: a stolen password, a fake invoice, or a message that looks like it came from the boss. The good news is that Microsoft 365 already includes most of what you need. It just isn't all switched on by default. Here's the order I'd do it in.
Before you start: a ten-minute inventory
Open the Microsoft 365 admin center and write down who has an account, who is a global admin, which shared mailboxes exist, and which accounts belong to people who no longer work with you. Old accounts with old passwords are one of the easiest ways in. Also note where your domain's DNS is managed (your registrar or web host), because you'll need it for step 3.
1. Multi-factor authentication for everyone
This is the single most important step. With MFA, a stolen password alone isn't enough to get in. For most small businesses, turning on Microsoft's Security defaults (in the Entra admin center) is the simplest way: it requires MFA registration for everyone and blocks older sign-in methods that can't do MFA. If you have Business Premium, Conditional Access policies give you finer control instead. Ask staff to use the Microsoft Authenticator app rather than text-message codes where possible.
No shared passwords
Generic addresses like info@ or billing@ are often a single account whose password the whole office knows. That makes MFA awkward and means you can't tell who did what. Make those addresses shared mailboxes instead, and give each person access with their own account — so every sign-in is a real person with their own MFA, and access ends the day someone leaves.
2. Separate admin accounts
Don't read email and browse the web with a global admin account. Keep one or two dedicated admin accounts, protected with MFA, and use normal accounts day to day.
3. SPF, DKIM and DMARC: prove your email is really yours
These three DNS records stop others from sending email that pretends to come from your domain, and they help your real email land in inboxes instead of spam.
- SPF lists who may send for your domain. For Microsoft 365 alone it's a TXT record like
v=spf1 include:spf.protection.outlook.com -all. If other services send as you (a newsletter tool, a booking system), they must be included too — and you can only have one SPF record. - DKIM adds a digital signature to each message. In the Microsoft Defender portal you enable it per domain; Microsoft shows you two CNAME records to add at your DNS host.
- DMARC tells receiving servers what to do with mail that fails those checks, and sends you reports. Start gently with
v=DMARC1; p=none; rua=mailto:[email protected], review the reports for a few weeks, then move top=quarantineand eventuallyp=reject.
4. Turn up phishing protection
- Review the anti-phishing policy in Defender and add protection for the people most likely to be impersonated — the owner and whoever approves payments.
- Tag external email so staff can see when a message didn't come from inside the company.
- If your plan includes Defender for Office 365 (for example Business Premium), turn on Safe Links and Safe Attachments.
5. Watch for the signs of a hijacked mailbox
Attackers who get in often create a hidden rule that forwards or deletes messages. Block automatic forwarding to outside addresses unless you truly need it, and make sure alerts for suspicious sign-ins and new forwarding rules go to someone who reads them.
Offboarding: close the door when someone leaves
When an employee leaves, block their sign-in the same day, reset the password, and sign them out of all sessions. Convert the mailbox to a shared mailbox if others need the email (shared mailboxes under the size limit don't need a license), forward or delegate as needed, and remove the license once you're done. Check their phone too: if company email was on a personal phone, remove the account from it.
Devices: the other half of the picture
Email security doesn't help much if the laptop it's read on is never updated. Keep Windows and macOS updates automatic, turn on disk encryption (BitLocker on Windows, FileVault on Mac), require a screen lock, and use a password manager instead of a notebook. If you have Business Premium, Intune lets you enforce those settings and wipe company data from a lost device.
6. Back up what matters
Microsoft keeps your data available, but its retention features aren't the same as an independent backup you control. If losing a mailbox or a shared folder would hurt, add a backup for Exchange, OneDrive and SharePoint — and test a restore once.
7. The human part: three habits that stop fraud
- Verify payment changes by phone, using a number you already have — never the one in the email.
- Gift cards are a red flag. A “quick favor” from the boss asking for gift cards is a classic scam.
- Report, don't delete. Use the Report button so the whole company gets protected.
How to check your work
- Microsoft Secure Score in the Defender portal lists recommended settings and shows which ones you've completed.
- Send yourself a test email to a Gmail address and choose “Show original”: SPF, DKIM and DMARC should all say PASS.
- Read your first DMARC reports before tightening the policy, to catch any service that sends as you and isn't in SPF yet.
- Ask a colleague to sign in on a new device and confirm MFA is requested.
Where to start this week
If you only do two things: turn on MFA for every account, and publish SPF, DKIM and a DMARC record. Those alone close the most common doors. If you'd rather have someone handle it and keep it maintained, that's exactly what my IT care plan covers — $75 per user per month, minimum $300.