Business email compromise — where an attacker gets into a mailbox and uses it to redirect invoices or trick colleagues — is one of the most expensive problems we see. In almost every case, the account was missing one of the protections below. You will need a Global Administrator account to make these changes, or ask whoever manages your Microsoft 365.
The two settings that matter most
1. Multi-factor authentication for every user
This is the single biggest improvement you can make. With MFA on, a stolen password on its own is not enough to get into the account.
Smaller tenants can switch on Security defaults in the Microsoft Entra admin centre, which requires MFA for everyone and blocks older sign-in methods that cannot do MFA. If you have Microsoft 365 Business Premium, use Conditional Access policies instead, which give you more control.
Ask staff to use the Microsoft Authenticator app rather than text messages, and make sure every account is covered — including the shared ones and the ones nobody remembers creating.
2. Block automatic forwarding to outside addresses
One of the first things an attacker does after getting into a mailbox is set up a rule that quietly forwards copies of incoming email to an address they control. They can then watch for invoices and payment conversations.
In the Microsoft Defender portal, check the outbound spam policy and make sure automatic forwarding to external addresses is turned off. If someone genuinely needs a forward, allow it for that one mailbox, deliberately.
Other settings worth checking
- Separate admin accounts. Do not use a Global Administrator account for everyday email. Keep at least two admin accounts, protected with strong MFA, and use them only for admin work.
- Sharing links. In SharePoint and OneDrive, consider stopping “Anyone” links, which let anybody with the link open a file without signing in. “Specific people” links are safer for most businesses.
- Old accounts. Remove or block accounts for people who have left, and convert their mailboxes to shared mailboxes if you need to keep the email.
- Licences. While you are reviewing accounts, check you are not paying for licences nobody uses.
- Alerts and audit logs. Make sure auditing is switched on and that someone receives the security alerts Microsoft sends, rather than an unmonitored inbox.
Check your score
Microsoft gives every tenant a Secure Score in the Microsoft Defender portal. It lists recommended improvements, ranked by impact, and shows how each change affects users. It is a useful to-do list, but do not chase the number blindly — some recommendations matter far more than others for a small business, and a few can disrupt how your team works if switched on without planning.
Before you change anything
Tell your staff what is about to happen, especially before turning on MFA. Pick a quiet day, have people install the Authenticator app in advance, and make sure at least one administrator can still sign in if something goes wrong. Ten minutes of preparation avoids a morning of locked-out staff.
If you would rather have it done for you, we review and secure Microsoft 365 tenants as a fixed-price job, and explain every change in plain English as we go.