A compromised Microsoft 365 account can give a criminal a convincing route into your business. They may read invoices, impersonate a director, reset passwords elsewhere or use a trusted mailbox to target customers and suppliers. For a small or medium-sized business, the disruption can be far greater than the apparent size of the incident.
This Microsoft 365 security guide focuses on the safeguards that make a practical difference for UK businesses. The aim is not to turn directors or practice managers into cybersecurity specialists. It is to establish sensible controls, clear ownership and a recovery plan that lets your people work productively without leaving the front door open.
Microsoft 365 security guide: start with identity
Microsoft 365 is built around identity. If someone gains access to a staff member’s account, they can often reach email, Teams files, SharePoint sites and cloud-based business systems from one place. That is why identity protection should come before more visible but less decisive controls.
Multi-factor authentication, or MFA, should be enabled for every user, including directors, administrators, contractors and shared-service accounts where possible. A password alone is no longer enough protection against phishing, password reuse and credential theft. An authenticator app or security key provides much stronger assurance than a text message, although any form of MFA is better than none.
Do not stop at switching MFA on. Review how it is applied. Attackers increasingly use MFA fatigue tactics, repeatedly sending approval prompts until a distracted user accepts one. Number matching, location details and staff awareness training help people spot requests they did not initiate. Where the business handles particularly sensitive information, phishing-resistant authentication such as security keys may be appropriate.
Conditional access policies add another layer of control. These can require MFA when someone signs in from an unfamiliar location, block access from higher-risk countries, prevent use of outdated authentication methods and limit access from unmanaged devices. The right settings depend on how and where your team works. A logistics business with staff travelling internationally needs a different approach from a local accountancy practice, so policies should be tested carefully before broad enforcement.
Keep privileged access small and visible
Global administrator access is powerful and should be treated accordingly. It is not a convenience setting for everyone in IT, nor should it sit permanently on a day-to-day user account. A compromised admin account can create new users, alter security policies and make an attacker much harder to remove.
Keep the number of global administrators to an absolute minimum, use separate accounts for administrative work, and ensure there are at least two secure emergency access accounts. Review privileged roles regularly, particularly after changes in staff, external support arrangements or company structure.
This is also a good time to look at dormant accounts and shared mailboxes. Former employees, unused licences and old supplier accounts create unnecessary opportunities for intrusion. A reliable joiner, mover and leaver process is one of the most cost-effective security controls a business can have.
Strengthen email before fraud reaches your finance team
Email remains the main route for phishing, business email compromise and malware. Microsoft 365 includes useful email security capabilities, but default settings may not reflect your business’s level of risk.
Start by protecting your domain with SPF, DKIM and DMARC. These records help receiving systems identify whether a message claiming to come from your domain is legitimate. They are particularly valuable for protecting customers and suppliers from impersonation. DMARC should normally be introduced in stages, beginning with monitoring so legitimate services are not accidentally blocked.
Within Microsoft 365, review anti-phishing, anti-spam and malware policies. Impersonation protection can flag messages that appear to come from senior people, finance contacts or key suppliers. Safe link and attachment controls can reduce the chance that a user reaches a malicious website or opens harmful content, although they cannot replace sound judgement.
For payment changes, bank detail amendments or requests for confidential information, put a separate verification process in place. A phone call to a known number can prevent a costly mistake. Staff should never rely solely on an email thread, however familiar its wording or signature looks.
Protect data where people actually work
Teams, SharePoint and OneDrive make collaboration easier, but files can quickly be shared more widely than intended. The risk is often not a deliberate breach. It may be a folder shared with the wrong external contact, a sensitive document sent via a personal link or a former employee retaining access to a project site.
Review external sharing settings and agree who can invite guests, create Teams sites or share files outside the organisation. For many SMEs, a controlled approach works best: external collaboration is allowed where it supports clients and suppliers, but it has clear ownership, expiry dates and periodic reviews.
Sensitivity labels and data loss prevention policies can help when your organisation handles personal data, financial information, legal documents or commercially sensitive material. For example, a label may encrypt a board paper or prevent it being forwarded outside the business. These controls need thoughtful configuration. If they are too restrictive, staff will look for workarounds; if they are too relaxed, they may offer little protection.
For regulated firms, security settings should support wider governance requirements rather than sit separately from them. Retention, audit records, access reviews and documented processes all help demonstrate that sensitive information is being handled responsibly.
Secure the devices connecting to Microsoft 365
A well-protected Microsoft 365 tenant can still be exposed through an unsecured laptop or mobile phone. Devices used for business should have current operating systems, encryption, endpoint protection and screen-lock controls. Lost or stolen equipment should be capable of being remotely wiped where practical.
Mobile device management is especially useful when staff access email and documents on personal phones. It can protect business data within approved applications without giving the employer unnecessary visibility into an employee’s personal content. The policy needs to be clear and proportionate, particularly in businesses with a bring-your-own-device culture.
Patch management matters here too. Criminals often exploit known weaknesses after updates have already been released. A regular patching process, supported by reporting and escalation for devices that fall behind, reduces exposure without relying on people to remember every update themselves.
Back up Microsoft 365 data independently
Microsoft 365 provides availability and some recovery features, but that is not the same as having a dedicated, independently managed backup strategy. Accidental deletion, malicious deletion, ransomware and retention gaps can all create difficult recovery situations.
A separate backup for Exchange Online, OneDrive, SharePoint and Teams gives the business more control over how far back it can restore and what it can recover. The detail matters: confirm the retention period, where the backup is held, who can authorise a restore and how quickly critical data can be returned.
Test restoration before an incident happens. Restoring a single email, a folder of documents and a whole SharePoint site are different tasks. A backup that has never been tested is an assumption, not a recovery plan.
Turn staff into a useful line of defence
Most security incidents involve a human decision at some point, usually made under pressure. An employee may open a convincing attachment, approve an unexpected sign-in request or send information to an impersonator. Blaming people does not improve security. Clear, relevant training does.
Short, regular awareness sessions work better than a one-off annual presentation. Use examples that reflect the threats your team sees: false invoice requests, parcel delivery messages, payroll changes, fake document-sharing notifications and QR-code scams. Staff should know exactly how to report a suspicious message and feel comfortable doing so quickly.
Training should also reach senior leaders. Directors and partners are frequent targets because their names, roles and relationships are easy to find. The best technical controls are more effective when leaders model careful verification and follow the same rules as everyone else.
Make response and accountability part of the plan
No set of controls guarantees that an incident will never occur. What separates a contained event from a business-wide problem is the speed and quality of the response. Decide in advance who can disable an account, revoke active sessions, contact affected clients, review audit logs and approve communications.
Document the process in plain English and keep the right contact details available outside Microsoft 365. During an account compromise, the affected platform may not be the best place to store your only response instructions. Rehearsing a short scenario can reveal gaps without causing disruption.
For businesses without internal security expertise, managed support can take pressure away by monitoring alerts, administering policies and providing a real person to call when something does not look right. MSnet can help organisations choose the right mix of managed protection, technical project work and staff education without adding unnecessary complexity.
The most useful next step is often a focused review of your current Microsoft 365 setup: who has access, how accounts are protected, what data is shared externally and whether recovery genuinely works. Fixing the most meaningful gaps first gives your business one less thing to worry about while your team gets on with serving customers.