10 Microsoft 365 Security Settings Most BC Small Businesses Never Turn On
Most small businesses in BC already pay for Microsoft 365. Very few use the security features they are already paying for. When we review a new client’s setup, we usually find the same handful of settings left at their defaults or never switched on. None of them need new software, and most take minutes.
Here are the 10 settings we check first, why each one matters in plain English, and which Microsoft 365 plan you need.
Before you start
- Settings 1 to 7 work on every Microsoft 365 business plan.
- Settings 8 to 10 need Microsoft 365 Business Premium (or an add-on), which includes Microsoft Entra ID P1, Defender for Office 365 Plan 1 and Intune.
- Test changes with one or two users first, and tell staff before you turn on MFA.
1. Turn on multi-factor authentication (MFA) for everyone
Why: Stolen passwords are behind most hacked mailboxes. MFA means a password alone is not enough to get in. The Canadian Centre for Cyber Security calls strong authentication a baseline control and says it should be mandatory for financial, admin, cloud-admin and executive accounts (Cyber Centre baseline controls).
Easiest way: If you have no Conditional Access policies, turn on Microsoft’s free Security defaults in the Microsoft Entra admin center. It enforces MFA registration for all users and blocks legacy sign-ins in one switch.
2. Block old “legacy” sign-in methods
Why: Older email apps and protocols cannot do MFA, so attackers use them to bypass it. Security defaults block these; if you use Conditional Access instead, create a policy that blocks legacy authentication.
3. Keep fewer than five Global Admins
Why: A Global Admin can do anything, including deleting your whole tenant. Microsoft recommends fewer than five. Give staff the smallest admin role they need (for example, Billing admin or User admin), and never use a Global Admin account for day-to-day email.
4. Label emails from outside your company
Why: A clear “External” tag in Outlook makes a fake “email from the boss” stand out instantly. It is free, takes one PowerShell command (Set-ExternalInOutlook -Enabled $true), and is one of the cheapest defences against invoice and payment fraud.
5. Stop automatic forwarding to outside addresses
Why: After breaking into a mailbox, criminals often create a hidden rule that forwards every email to themselves, sometimes for months. Check that the outbound spam policy blocks automatic external forwarding, and review existing inbox rules for anything forwarding outside the company.
6. Raise deleted-email retention to 30 days
Why: By default, permanently deleted emails are recoverable for only 14 days. Microsoft lets you raise this to 30 days (Microsoft documentation). It costs nothing and doubles your safety window. For longer protection, read why Microsoft 365 is not a backup.
7. Set file sharing to “Specific people” by default
Why: If your default sharing link is “Anyone with the link,” a forwarded email can expose a client file to strangers. In the SharePoint admin center, change the default link type to Specific people and set an expiry for any “Anyone” links you still allow. Our SharePoint and OneDrive setup includes this.
8. Turn on impersonation protection (Business Premium)
Why: Defender for Office 365 can detect emails pretending to be your owner, managers or your own domain, and can rewrite links so they are checked when clicked (Safe Links) and scan attachments before they arrive (Safe Attachments). Add your key people to the protected users list.
9. Use Conditional Access instead of a blunt “all or nothing” (Business Premium)
Why: Conditional Access lets you set sensible rules, such as requiring MFA everywhere, blocking sign-ins from countries you never work in, or only allowing company-managed devices to open sensitive files. It is far more flexible than security defaults once your business grows.
10. Manage company laptops and phones with Intune (Business Premium)
Why: If a laptop is lost on the SkyTrain, Intune lets you lock or wipe company data remotely, force disk encryption and push updates. Pair it with proper endpoint protection.
Bonus: protect your domain with SPF, DKIM and DMARC
These three DNS records prove to other mail servers that email “from” your domain really came from you. Without them, criminals can send convincing fake emails using your own company name. They also help your genuine emails reach inboxes instead of spam folders.
Your 10-point checklist
| # | Setting | Plan needed | Done? |
|---|---|---|---|
| 1 | MFA for all users | Any | ☐ |
| 2 | Legacy authentication blocked | Any | ☐ |
| 3 | Fewer than 5 Global Admins | Any | ☐ |
| 4 | External email tagging | Any | ☐ |
| 5 | External auto-forwarding blocked | Any | ☐ |
| 6 | 30-day deleted item retention | Any | ☐ |
| 7 | Default sharing: Specific people | Any | ☐ |
| 8 | Impersonation protection, Safe Links | Business Premium | ☐ |
| 9 | Conditional Access policies | Business Premium | ☐ |
| 10 | Devices managed with Intune | Business Premium | ☐ |
Just moving to Microsoft 365? Start with our Microsoft 365 migration guide for BC businesses.
Frequently asked questions
Is Microsoft 365 secure out of the box?
Microsoft secures its platform, but many protective settings are optional or left at defaults that favour convenience. Your configuration decides how secure your business actually is.
Do I need Business Premium?
Not for settings 1 to 7. Business Premium adds stronger email threat protection, Conditional Access and device management, which most businesses handling client money or personal data benefit from.
Will turning on MFA annoy my staff?
For a day or two. With the Microsoft Authenticator app, signing in usually takes a single tap, and many sign-ins on trusted devices will not ask every time.
How many of the 10 are switched on in your business?
Book a free IT assessment. We will review your Microsoft 365 security settings and send you a clear report of what to fix first.
Insmart Technology provides Microsoft 365 services, Microsoft security, Exchange Online management and managed IT for businesses across Surrey and the Lower Mainland.
About the author: Naqash Bin Iqbal is an SEO Specialist at Insmart Technology, a Surrey-based managed IT and cybersecurity provider.
