Securing Microsoft 365: the 7 essential settings for an SME
Microsoft 365 holds your e-mail, your files and often your whole organisation. It is also attackers’ favourite target: a single stolen password is enough to read e-mail, send fake invoices to your customers or delete files. Good news: a few settings block the vast majority of attacks.
1. Two-factor authentication for everyone
This is the most important setting. With the Microsoft Authenticator app, a stolen password is no longer enough. Enable it for all accounts, including management (often the most targeted). In small organisations, Microsoft Entra security defaults switch it on in a few clicks.
2. Separate, few administrator accounts
Nobody should work day-to-day with an administrator account. Create a dedicated admin account, protected by two-factor authentication, and limit them to two people at most.
3. Block legacy sign-in methods
Old e-mail protocols (“basic” authentication) do not support two-factor authentication. They must stay disabled: make sure no old software or old printer-scanner still uses them.
4. Control file sharing
In SharePoint and OneDrive, avoid “Anyone with the link” links. Prefer sharing with specific people, with an expiry date for sensitive documents.
5. A real leaver process
When an employee leaves: block sign-in the same day, forward their mailbox (or convert it to a shared mailbox), recover their OneDrive files and remove their devices. A forgotten account is an open door.
6. Back up Microsoft 365
Microsoft guarantees that the service runs, not that your data will never be deleted: a mistake, an unhappy employee or ransomware can erase e-mail and files. A separate backup (for example Veeam or Synology, kept in Switzerland) makes it possible to restore everything. See also our article on the 3-2-1 backup rule.
7. Monitor and improve with Secure Score
Microsoft Secure Score (Microsoft Defender portal) rates the security of your environment and suggests improvements ranked by importance. It is an excellent dashboard to progress step by step.
Bonus
- Enable anti-phishing protection and scanning of attachments and links (Microsoft Defender for Office 365, depending on your licence).
- Configure SPF, DKIM and DMARC on your domain name: your e-mails are delivered better and are harder to spoof.
- Manage computers and phones with Intune: encryption, updates and remote wipe in case of loss.
Need help? We support SMEs, practices and individuals in French-speaking Switzerland. Discover our Microsoft 365 service (page in French) or call us on +41 21 519 21 27.
☕ New business customers: the first meeting is on us — a coffee and a free IT review, with no obligation.