Microsoft 365 is often the centre of a small business: email, files, Teams, calendars and shared documents all depend on it. That makes Microsoft 365 security worth treating as a business system rather than simply an email account.
1. Require multi-factor authentication
Passwords alone are not enough for important business accounts. Multi-factor authentication adds another step before access is granted and can prevent many account takeovers even when a password has been exposed.
2. Separate administrator accounts from everyday accounts
Administrator privileges should be limited to people who genuinely need them. Where practical, administration should be performed with a separate privileged account rather than the same account used for daily email and web browsing.
3. Review old users and shared access
When an employee or contractor leaves, access should be removed promptly. Mailboxes, OneDrive files, shared folders, Teams memberships, forwarding rules and third-party applications should all be checked as part of the offboarding process.
4. Check email forwarding and suspicious inbox rules
Compromised accounts are sometimes configured to silently forward messages or hide replies. Periodic checks of forwarding settings and inbox rules can identify behaviour that is easy to miss during normal use.
5. Protect important files with an independent backup
Microsoft 365 provides resilient cloud services, but businesses still need to think about accidental deletion, malicious deletion, retention requirements and recovery from user mistakes. An independent Microsoft 365 backup can provide another recovery path for Exchange, OneDrive, SharePoint and Teams data.
6. Keep business computers secure
Microsoft 365 security is weakened if staff sign in from poorly maintained computers. Devices should receive security updates, use appropriate endpoint protection and be removed or wiped when they are retired or reassigned.
7. Review external sharing
SharePoint and OneDrive make collaboration easy, but links can remain active long after a project finishes. Businesses should periodically review externally shared files and sites and remove access that is no longer required.
8. Know who controls your domain and DNS
Your Microsoft 365 tenant depends on your domain name and DNS records. The business should know which registrar holds the domain, who controls the login and where recovery information is stored.
9. Document recovery information
Keep a secure record of key administrators, recovery methods, domain ownership and important service providers. This is especially important when only one person currently understands the setup.
10. Review security settings regularly
Security is not a one-time configuration. Staff change, devices change and Microsoft 365 features evolve. A periodic review helps identify old permissions, inactive accounts and settings that no longer match how the business works.
Shortcut Computers provides Microsoft 365 support and migration, small-business cyber security and backup and disaster recovery services across South East Melbourne.
Related guides
- Essential Eight for Small Business
- Microsoft 365 Backup for Small Business
- Employee IT Setup and Offboarding Checklist
- IT Support for Accountants, Bookkeepers and Professional Offices
