Multi-factor for every account, no exceptions
Most Microsoft 365 breaches start with a stolen password, usually from a fake sign-in page. Multi-factor authentication means a password alone is not enough to get in. Every account that can sign in needs it, including the director who finds it annoying, the shared reception login and the admin account set up years ago by a previous provider.
Use the Microsoft Authenticator app with number matching, or a passkey or security key for admins, rather than text messages where possible. Text codes are better than nothing but are easier to intercept. Plan the rollout: tell staff what is coming, help them register on a set day and keep a short list of anyone who needs help, such as people without a work phone.
Block legacy authentication
Older email protocols and apps sign in with just a username and password and cannot do multi-factor. Attackers use them precisely because they bypass it. Microsoft has turned off much of this for Exchange Online, but some tenants and settings still allow older methods through, and old printers, scanners and accounting tools that send email are often configured that way.
Find out what still uses legacy sign-in by checking the sign-in logs, then fix those devices before blocking it. Scanners that email documents can usually be reconfigured to use a modern method or a dedicated relay. Once nothing legitimate depends on it, block it for the whole tenant so a stolen password cannot be used through that back door.
Stop automatic forwarding outside the business
One of the first things an attacker does after getting into a mailbox is create a rule that forwards copies of every email to an outside address, or moves replies from the bank into an obscure folder. That lets them watch invoices and payment conversations and then send a convincing fake asking for funds to go to a new account.
Exchange Online lets you block automatic external forwarding for everyone, then allow it only for specific mailboxes with a genuine need. Pair that with alerts for new inbox rules that forward or delete mail. It is a small change that closes off one of the most damaging and common patterns in NZ invoice fraud.
Turn on the protections you are already paying for
Depending on your licence, Microsoft 365 includes email filtering features for phishing and malicious attachments, safe link checking and endpoint protection for computers. Many tenants have these switched on with default settings that were never reviewed. Applying Microsoft's recommended preset security policies for email is a quick way to raise the baseline without building every rule by hand.
Check Secure Score in the Defender portal as a to-do list rather than a target. It lists recommended actions with their impact on users, so you can work through the high-value, low-disruption items first. Some recommendations will not suit a ten-person office, and that is fine; the point is to make deliberate choices rather than leave settings at whatever they were on day one.
Admin accounts and alerts
Keep administrator accounts separate from everyday ones, keep their number small and protect them with the strongest sign-in method you have. Make sure security alerts go to a mailbox that someone actually reads. Microsoft 365 raises alerts for suspicious sign-ins, mass deletions and malware, but in many small tenants they go to an old admin address nobody checks.
Confirm that audit logging is turned on so there is a record to investigate if something does happen. It costs nothing to enable and is impossible to recover after the fact. If you have a cyber insurance policy, compare its questionnaire with your settings; insurers commonly ask about multi-factor, admin accounts and backups, and a mismatch can cause problems at claim time.
Device and data basics
Sign-in security matters most, but devices are the other half. Laptops should have disk encryption turned on, supported versions of Windows or macOS, automatic updates and endpoint protection. Phones that read work email should at least have a screen lock and the ability to wipe company data if lost. Intune can apply these settings centrally on business plans that include it.
Finally, review external sharing in SharePoint and OneDrive and remove guests who no longer need access. None of these steps requires new hardware, and most can be done in a day or two. If you would like them checked against your own tenant, the Office IT health check walks through each setting and gives you a plain list of what is on and what is not.
In short
- Require multi-factor sign-in on every account, admins first.
- Find and fix old devices, then block legacy authentication.
- Block automatic forwarding to outside addresses.
- Apply preset email security policies and use Secure Score as a checklist.
- Send alerts to a monitored mailbox and keep audit logging on.