At a glance
- Most Microsoft 365 incidents start from a compromised account: multi-factor authentication is the first line of defence.
- Many protections are already included in business licences but must be enabled and configured.
- Microsoft protects the infrastructure; configuration, access and data remain the company's responsibility.
- Microsoft Secure Score shows the tenant's security level and recommended actions.
Microsoft 365 is at the heart of many companies' work: email, documents, Teams. That is also why it is one of the main targets of attacks. The eight settings below are the ones ALAconnect checks first when it takes over a tenant.
1. Multi-factor authentication for everyone
MFA should be enabled for all users, not just administrators. You can use Microsoft's baseline configuration (security defaults) or, with licences that include it, Conditional Access, which allows more precise rules. To check: are there accounts, including shared or service accounts, that sign in without a second factor?
2. Separate, minimal admin accounts
Tenant administrators should use a dedicated account, different from the one they read email with, protected by MFA and with only the privileges they need. Global administrators should be very few. To check: how many users hold admin roles, and do they all need them?
3. Legacy sign-in protocols blocked
Old authentication methods that do not support MFA are a classic entry point for password attacks. Microsoft has disabled basic authentication for Exchange Online, but it is worth checking that no application or device still uses legacy protocols and blocking them with Conditional Access where available.
4. Automatic external forwarding blocked
After breaching a mailbox, attackers often create a rule that forwards mail to an external address, so they can keep reading it even after the password is changed. Blocking automatic forwarding to external domains, except approved exceptions, closes this path. To check: are there active external forwarding rules in mailboxes?
5. Protection against phishing and malicious attachments
Beyond basic spam filtering, Microsoft Defender for Office 365, included in some licences such as Microsoft 365 Business Premium, checks links and attachments at click time and detects attempts to impersonate colleagues or suppliers. It should be enabled with appropriate policies, not left at minimum settings.
6. SPF, DKIM and DMARC on the domain
These three DNS records tell mail servers worldwide which messages are really sent by your company. Without DMARC, anyone can send emails that appear to come from your domain to customers and suppliers, for example to request payment to a different bank account.
7. External file sharing under control
SharePoint and OneDrive let users share documents with anyone. It is advisable to restrict "anyone with the link" sharing, set expiry dates for external links and allow sharing only with authenticated users or approved domains, especially for sensitive data.
8. Audit log, Secure Score and backup
The audit log lets you reconstruct what happened in an incident and should stay enabled. Microsoft Secure Score rates the configuration and suggests the most useful actions. Finally, data retention in Microsoft 365 does not replace backup: a dedicated backup lets you restore mailboxes, files and sites even after deletions or ransomware attacks.
Where to start
If the first three points are not in place, they are the priority: MFA, separate admin accounts and blocking legacy protocols drastically reduce the risk of account takeover. The other points complete the protection of email, files and data. For an overall picture see also the SME cybersecurity checklist.
How ALAconnect works
ALAconnect configures and manages Microsoft 365 tenants for companies and professional firms: security settings review, MFA and Conditional Access, email protection, DNS records, file sharing and dedicated backup. Discover the Microsoft 365 and cloud service or request a review of your tenant.