--- title: Five Microsoft 365 security settings every small business should switch on description: Most small-business breaches start with a setting that was never switched on. Here are five Microsoft 365 changes that close the most common gaps. image: https://www.helpdeskcomputers.com.au/hubfs/insights-m365-security-featured-v2.jpg --- [Skip to content](https://www.helpdeskcomputers.com.au/insights/microsoft-365-security-settings-small-business#main) [![Helpdesk Computers](https://www.helpdeskcomputers.com.au/hubfs/raw_assets/public/hdc-theme/images/brand/helpdesk-logo.svg) ![](https://www.helpdeskcomputers.com.au/hubfs/raw_assets/public/hdc-theme/images/brand/helpdesk-logo-white.svg)](https://www.helpdeskcomputers.com.au/) Services - Run your IT› - Protect› - Connect› - Grow› - [All services →](https://www.helpdeskcomputers.com.au/#services) Run your IT Day-to-day support, Microsoft 365 and the kit your people use. - [**Managed IT**Fully managed or co-managed support](https://www.helpdeskcomputers.com.au/managed-it-services/) - [**Microsoft 365**Migrations, security, licensing and training](https://www.helpdeskcomputers.com.au/microsoft-365/) - [**Procurement**Hardware, licensing and as-a-service options](https://www.helpdeskcomputers.com.au/procurement/) Protect Security you can verify, and recovery that's been tested. - [**Cyber security**Detection, testing, Essential Eight and SMB1001](https://www.helpdeskcomputers.com.au/cyber-security/) - [**Cloud & backup**Cloud servers, backup and disaster recovery](https://www.helpdeskcomputers.com.au/cloud-backup-disaster-recovery/) Connect The network, internet and phones your business runs on. - [**Networks & connectivity**Managed networks, internet, Wi-Fi and firewalls](https://www.helpdeskcomputers.com.au/networks-infrastructure/) - [**Phones & unified comms**Cloud phones, Teams calling and contact centres](https://www.helpdeskcomputers.com.au/voip-telecommunications/) Grow Planning, projects and AI that move the business forward. - [**AI & automation**Copilot, process automation and custom AI agents](https://www.helpdeskcomputers.com.au/ai-automation/) - [**Professional services**Virtual CIO, strategy, projects and extra hands](https://www.helpdeskcomputers.com.au/professional-services/) Book a 20-minute IT review We look at your setup and put what we find in writing, whether or not you go ahead. [Book a review](https://www.helpdeskcomputers.com.au/contact/) [1300 242 422](tel:1300242422) Not sure where to start? Call [1300 242 422](tel:1300242422) and talk to a person. About [About Helpdesk](https://www.helpdeskcomputers.com.au/about/) [Our team](https://www.helpdeskcomputers.com.au/about/#team) [Certifications and partners](https://www.helpdeskcomputers.com.au/about/#certifications) [Community](https://www.helpdeskcomputers.com.au/community/) [Contact us](https://www.helpdeskcomputers.com.au/contact/) [Client support](https://www.helpdeskcomputers.com.au/support/) [Book an IT review](https://www.helpdeskcomputers.com.au/contact/) [1300 242 422](tel:1300242422) [Book an IT review](https://www.helpdeskcomputers.com.au/contact/) Menu [Insights](https://www.helpdeskcomputers.com.au/insights) /[Cyber security](https://www.helpdeskcomputers.com.au/insights/tag/cyber-security) # Five Microsoft 365 security settings every small business should switch on ![](https://www.helpdeskcomputers.com.au/hs-fs/hubfs/Cosmin.png?width=40&height=40&name=Cosmin.png) By [Cosmin Albu](https://www.helpdeskcomputers.com.au/insights/author/cosmin) 16 October 2026 5 min read ![Five Microsoft 365 security settings switched on](https://www.helpdeskcomputers.com.au/hubfs/insights-m365-security-featured-v2.jpg) In 2024–25, Australians reported a cybercrime roughly every six minutes. For small businesses, the average reported cost was $56,600, up 14% on the year before ([ASD Cyber Threat Report 2024–25](https://www.cyber.gov.au/about-us/view-all-content/reports-and-statistics/annual-cyber-threat-report-2024-2025)). The two most common threats businesses reported were both about email: someone getting into a mailbox, and business email compromise that ends in a fake invoice getting paid. Neither usually needs a clever attacker. It takes a reused password, an account without multi-factor authentication, or an old sign-in method nobody turned off. If your business runs on Microsoft 365, most of the fixes are settings you already pay for. These are the five we check first when we take on a new client. ## 1. Turn on multi-factor authentication for everyone A stolen password on its own shouldn't be enough to get into your email. Multi-factor authentication (MFA) adds a second check, usually a prompt on the person's phone, so a password bought on the dark web is useless by itself. The Australian Signals Directorate counts strong MFA among the basics that prevent most reported incidents. **How:** If you're on Microsoft 365 Business Basic or Standard, turn on [security defaults](https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults). It's free and makes every user register for MFA. If you're on Business Premium, use Conditional Access instead, which lets you set rules by user, device and location. Either way, use the Microsoft Authenticator app or passkeys rather than text messages where you can. ## 2. Block old sign-in methods Older email connections, known as legacy authentication, don't support MFA at all. If they're left on, an attacker can skip your MFA by signing in the old way. Microsoft's security defaults block every sign-in that uses these older protocols. **How:** Security defaults handle this automatically. On Business Premium, add a Conditional Access policy that blocks legacy authentication. Check first for anything still relying on it, such as an old scanner that emails documents or a line-of-business app, and move it to a modern method before you switch it off. ## 3. Cut back your admin accounts An administrator account can read every mailbox, create new users and switch security off. That makes it the account attackers want most. Microsoft recommends giving the Global Administrator role to [fewer than five people](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/best-practices), and only the permissions each admin actually needs. **How:** List everyone with an admin role in the Microsoft 365 admin centre and remove any that aren't needed. Give the people who stay a separate admin account that isn't used for everyday email and browsing. Keep two emergency "break glass" accounts, protected and stored safely, in case everyone else gets locked out. ## 4. Lock down email Most business email compromise starts with a convincing message: a fake invoice, a supplier "changing bank details", or an email that looks like it's from the boss. Microsoft 365 has strong filtering built in, but Microsoft's recommended stricter settings stay off until you turn them on. **How:** - Turn on the **Standard** [preset security policy](https://learn.microsoft.com/en-us/defender-office-365/preset-security-policies) in Microsoft Defender. It applies Microsoft's recommended anti-spam, anti-malware and anti-phishing settings in one step. - Set up [SPF, DKIM and DMARC](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-about) for your domain, so other mail servers can tell real email from your business apart from forgeries. - Agree a rule that any change to bank details is confirmed by phone, on a number you already have. No setting replaces this one. ## 5. Keep every device managed and up to date An unpatched laptop is an open door, whatever you've set up in the cloud. Updates for Windows, Microsoft 365 apps and browsers fix known holes that attackers actively look for, and patching is one of the [Essential Eight](https://www.cyber.gov.au/about-us/view-all-content/reports-and-statistics/annual-cyber-threat-report-2024-2025) strategies the ASD recommends. **How:** Make sure automatic updates are on and actually installing, including for third-party apps such as PDF readers. On Business Premium, enrol devices in Microsoft Intune so you can enforce updates, encryption and a screen lock, and see at a glance which devices have fallen behind. Devices that can no longer get updates should be replaced. ## Then: back it up, and test the backup These five settings make a breach much less likely. They don't make it impossible, and they don't protect you from a deleted folder, a departing staff member clearing their mailbox, or ransomware syncing encrypted files into OneDrive. Microsoft keeps the service running. Keeping your own copy of your data is your job. Regular backups are one of the ASD's Essential Eight, and a backup of Microsoft 365 mail, OneDrive, SharePoint and Teams, kept outside your own tenant, is what lets you recover when something goes wrong. A backup you've never restored from is a hope, not a plan. Test a restore at least once a quarter, and write down who does it. ## Where to start If you only do one thing this week, turn on MFA for every account. Then work down the list in order. These settings cover several of the Essential Eight, the ASD's baseline strategies, but not all of them. Application control, Office macro settings and application hardening are separate pieces of work. If you need to show customers, insurers or a board where you stand, the next step is a review against the Essential Eight Maturity Model. Not sure which of these are switched on in your Microsoft 365 today? [Book a 20-minute IT review](https://www.helpdeskcomputers.com.au/contact/). We'll check your setup, tell you what we'd fix first, and give you our findings in writing. - [Cyber security](https://www.helpdeskcomputers.com.au/insights/tag/cyber-security) - [Microsoft 365](https://www.helpdeskcomputers.com.au/insights/tag/microsoft-365) ![](https://www.helpdeskcomputers.com.au/hs-fs/hubfs/Cosmin.png?width=64&height=64&name=Cosmin.png) Written by [Cosmin Albu](https://www.helpdeskcomputers.com.au/insights/author/cosmin) On this page Share [mailto:?subject=%3Cspan+id%3D%22hs_cos_wrapper_name%22+class%3D%22hs_cos_wrapper+hs_cos_wrapper_meta_field+hs_cos_wrapper_type_text%22+style%3D%22%22+data-hs-cos-general-type%3D%22meta_field%22+data-hs-cos-type%3D%22text%22+%3EFive+Microsoft+365+security+settings+every+small+business+should+switch+on%3C%2Fspan%3E&body=https%3A%2F%2Fwww.helpdeskcomputers.com.au%2Finsights%2Fmicrosoft-365-security-settings-small-business](mailto:?subject=%3Cspan+id%3D%22hs_cos_wrapper_name%22+class%3D%22hs_cos_wrapper+hs_cos_wrapper_meta_field+hs_cos_wrapper_type_text%22+style%3D%22%22+data-hs-cos-general-type%3D%22meta_field%22+data-hs-cos-type%3D%22text%22+%3EFive+Microsoft+365+security+settings+every+small+business+should+switch+on%3C%2Fspan%3E&body=https%3A%2F%2Fwww.helpdeskcomputers.com.au%2Finsights%2Fmicrosoft-365-security-settings-small-business) Want a second opinion on your setup? A 20-minute call, then our findings in writing. [Book an IT review](https://www.helpdeskcomputers.com.au/contact/) Talk to us ## Rather we just sorted it for you? Book a 20-minute IT review. We'll look at what you have, tell you what we'd fix first, and give you our findings in writing. [Book a 20-minute IT review](https://www.helpdeskcomputers.com.au/contact/) [Call 1300 242 422](tel:1300242422) - Established **2010** - Offices **Melbourne, Sydney, Brisbane** - Certified **ISO/IEC 27001** - Phones answered **Mon–Fri, 8am–5pm** [1300 242 422](tel:1300242422) Managed IT, cyber security, cloud and communications for Australian businesses. Established 2010. - - #### Services - [Managed IT support](https://www.helpdeskcomputers.com.au/managed-it-services/) - [Cyber security](https://www.helpdeskcomputers.com.au/cyber-security/) - [Microsoft 365](https://www.helpdeskcomputers.com.au/microsoft-365/) - [AI & automation](https://www.helpdeskcomputers.com.au/ai-automation/) - [Cloud & backup](https://www.helpdeskcomputers.com.au/cloud-backup-disaster-recovery/) - [Networks & connectivity](https://www.helpdeskcomputers.com.au/networks-infrastructure/) - [Phones & unified comms](https://www.helpdeskcomputers.com.au/voip-telecommunications/) - [Professional services](https://www.helpdeskcomputers.com.au/professional-services/) - [Procurement](https://www.helpdeskcomputers.com.au/procurement/) #### Company - [About us](https://www.helpdeskcomputers.com.au/about/) - [Contact](https://www.helpdeskcomputers.com.au/contact/) - [Insights](https://www.helpdeskcomputers.com.au/insights) - [Community](https://www.helpdeskcomputers.com.au/community/) - [Existing clients](https://www.helpdeskcomputers.com.au/support/) - [Client portal](https://helpdeskcomputers.ITClientPortal.com/) #### Offices - **Melbourne (head office)**6/74 Thomsons Road, Keilor Park VIC 3042 - **Sydney**Level 3, 60 Martin Place, Sydney NSW 2000 - **Brisbane**71 Eagle Street, Brisbane QLD 4000 - [hello@helpdeskcomputers.com.au](mailto:hello@helpdeskcomputers.com.au) - Mon–Fri, 8am–5pm (Melbourne time) © 2026 Helpdesk Computer Systems Pty Ltd ABN 26 147 262 753 [Privacy](https://www.helpdeskcomputers.com.au/privacy-policy/) [Terms of use](https://www.helpdeskcomputers.com.au/terms-of-use/) [Client agreements](https://www.helpdeskcomputers.com.au/documents) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Cosmin Albu", "url" : "https://www.helpdeskcomputers.com.au/insights/author/cosmin" }, "dateModified" : "2026-10-16T00:43:03.270Z", "datePublished" : "2026-10-16T00:42:34.000Z", "headline" : "Five Microsoft 365 security settings every small business should switch on", "image" : [ "https://www.helpdeskcomputers.com.au/hubfs/insights-m365-security-featured-v2.jpg" ], "mainEntityOfPage" : { "@id" : "https://www.helpdeskcomputers.com.au/insights/microsoft-365-security-settings-small-business", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.helpdeskcomputers.com.au/hubfs/Logo%20Standard.svg" }, "name" : "Helpdesk Computers" } } ```