Late on a Friday afternoon, the controller at an engineering consultancy in Gatineau gets an email from a long-time supplier: their banking details have changed. The message sits in the right thread, with the right tone and the right signature. That's because an attacker has been reading her mailbox for three weeks, and an inbox rule is quietly hiding the supplier's real replies.
This kind of payment fraud is one of the most expensive incidents a small business can suffer. According to industry data cited by Insurance Business Canada (October 2025), the average wire fraud incident costs $118,000. And it often starts with a Microsoft 365 setting nobody ever checked: incomplete multi-factor authentication, a legacy protocol left open, automatic forwarding allowed.
Microsoft 365 is configured first and foremost for easy collaboration. Many small-business tenants were set up years ago and never revisited. Here are the 15 settings our team checks first.
TL;DR
- In Microsoft 365, most of the risk comes down to configuration: incomplete MFA, legacy authentication, overly broad admin rights.
- The 15 settings fall into four groups: identity, email, sharing, and monitoring and resilience.
- An audit only needs a read-only account; nothing in your environment gets changed.
- Several fixes take under an hour and sharply reduce the risk of email-based fraud.
Before you start: access and a benchmark
A Microsoft 365 audit doesn't require any write permissions. Create a dedicated account with the Global Reader role, protect it with MFA and delete it when you're done. For a reference framework, the CIS Microsoft 365 Foundations Benchmark is the most widely used; it lays out recommended controls in two levels of rigour.
Your licence matters too. Some settings (Conditional Access, Safe Links, device management) require Business Premium or an add-on. The rest are available on every plan.
Identity and access (settings 1 to 6)
1. MFA for everyone, no exceptions. Confirm that security defaults or a Conditional Access policy require MFA on every account. Look for forgotten exceptions: the front-desk account, the shared mailbox with sign-in enabled, the old service account.
2. Legacy authentication blocked. Older protocols (POP, IMAP, basic SMTP authentication) don't support MFA, so an attacker who has a password can use them to get around it. According to Microsoft, MFA combined with blocking legacy authentication stops more than 99.9% of common identity attacks. Watch out for the office printer that emails scans; there are safer ways to set it up.
3. Fewer than five Global Administrators. That's Microsoft's own recommendation. Administrators should use a dedicated admin account, separate from their everyday mailbox.
4. Two emergency access accounts. Microsoft recommends two cloud-only "break glass" accounts with very strong credentials stored somewhere safe and an alert on every sign-in. They keep you from being locked out of your own tenant.
5. Phishing-resistant MFA for admins. FIDO2 security keys or passkeys rather than text-message codes. Our guide to choosing an MFA method compares the options.
6. Restricted app consent. Depending on your settings, users may be able to grant a third-party app access to their mailbox. Attackers abuse this with fake apps. Limit consent to verified publishers or require admin approval.
Email (settings 7 to 10)
7. External auto-forwarding blocked. In the outbound spam filter policy, set automatic forwarding to "Off" rather than "Automatic," whose behaviour depends on how old your tenant is. While you're there, review existing inbox rules: they're a classic sign of business email compromise.
8. SPF, DKIM and DMARC. These three DNS records stop others from spoofing your domain. Aim for a DMARC policy set to quarantine or reject. Our guide to SPF, DKIM and DMARC explains each one.
9. Impersonation protection. Anti-phishing policies can protect your executives' names and your domains. With Defender for Office 365, turn on Safe Links and Safe Attachments as well.
10. External sender tagging. Exchange Online can add a visible label to messages from outside your organization. Simple, free and very effective against fake emails from "the CEO."
Sharing and collaboration (settings 11 to 13)
11. SharePoint and OneDrive external sharing. "Anyone" links travel without any control. Restrict them or enforce an expiry date, and keep external sharing to authenticated people.
12. Teams external access and guests. Decide who can chat with outside organizations and who can invite guests. Phishing campaigns through Teams are very real.
13. Dormant accounts and forgotten guests. Former employees' accounts, guests from a project that ended two years ago and licences still assigned to them are all doors left open. Review them at least quarterly.
Monitoring and resilience (settings 14 and 15)
14. Audit log on and actually reviewed. The unified audit log is enabled by default, and Audit (Standard) keeps events for 180 days. Someone still has to look at it: set up alerts for suspicious sign-ins, new forwarding rules and changes to admin roles.
15. Independent backup. Microsoft keeps the service available; it doesn't guarantee you can restore your data beyond its recycle bin windows. Ransomware that encrypts OneDrive, or an employee who deletes folders by mistake, calls for a real backup kept separate from the tenant.
Check that nobody is already inside
Fixing settings won't help if an attacker is already in. A proper Microsoft 365 audit also looks for signs of an active compromise:
- Inbox rules that move or delete messages containing "invoice," "wire" or "payment"
- Forwarding to external addresses configured on individual mailboxes
- Successful sign-ins from countries where you have no staff or customers
- A new MFA method added to an account that the employee doesn't remember adding
- Third-party apps recently granted access to email or files
- Admin accounts created or roles assigned without a known request
If any of these turn up, treat it as an incident before continuing the audit: reset access, revoke sessions and document what you find. For Quebec organizations, if personal information may have been accessed, Law 25 requires you to record the incident in your register and, where there's a risk of serious injury, to notify the Commission d'accès à l'information and the affected individuals promptly. Confirm the process with your legal counsel.
Where to start
You don't need to fix everything in one weekend. Here's a realistic order:
| When | Settings | Typical effort |
|---|---|---|
| This week | 1, 2, 3, 7 | A few hours |
| This month | 4, 6, 8, 10, 13 | One to two days, with testing |
| This quarter | 5, 9, 11, 12, 14, 15 | Planned project, staff communication |
Before each change, warn your staff and test with a small group first. Blocking legacy authentication on a Monday morning without notice is a guaranteed way to flood the help desk. If you also use Google, our Google Workspace security audit follows the same logic.
Our team performs read-only Microsoft 365 and Google Workspace audits, with a report showing the current state, the risk and the fix for every setting.
Frequently asked questions
Do we need Microsoft 365 Business Premium to secure our environment properly?+
Not for the basics: security defaults are free and turn on multi-factor authentication for everyone. That said, Business Premium adds tools that matter for a small business, including Conditional Access, device management with Intune and Defender for Office 365. If you handle sensitive data, the price difference is often justified.
How long does a Microsoft 365 audit take?+
For a business with 10 to 100 users, the technical review usually takes a few days, followed by report writing. All you need to provide is a read-only account with the Global Reader role; the auditor doesn't need to change anything in your environment.
Is Microsoft Secure Score good enough?+
It's a good starting point, but it measures your environment against Microsoft's recommendations without any knowledge of your business context. It doesn't know who should be an administrator, it counts features your licence may not include and it won't detect a compromise already in progress, such as a malicious forwarding rule.
Sources
- 1.Microsoft Learn: Security defaults in Microsoft Entra ID
- 2.Microsoft Learn: Best practices for Microsoft Entra roles
- 3.Microsoft Learn: Auditing solutions in Microsoft Purview
- 4.Microsoft Learn: Control external email forwarding
- 5.Act respecting the protection of personal information in the private sector (CQLR c. P-39.1)
- 6.CIS Microsoft 365 Foundations Benchmark
- 7.Insurance Business Canada: AI-powered attacks push cyber risks higher for Canada's SMEs (October 2025)