Microsoft 365 security settings worth reviewing

Start with the working day, not the switches

A Microsoft 365 security review should answer two questions: who can get into the business, and what can they reach once inside? For a small office, the best starting point is not a screen full of settings. It is a short conversation about everyday work: approving payments, sending quotes, sharing drawings and covering for someone on leave.

Write down the people, devices and applications involved. Include the copier that emails scans and the outside bookkeeper. Then ask your IT provider to connect those workflows to the settings below. Aim for a documented change plan, not an afternoon of clicking every restrictive option.

Check MFA coverage, not just registration

Multifactor authentication (MFA) adds another way to prove identity beyond a password. Microsoft's Security defaults require everyone to register, require MFA for administrators and prompt other users when Microsoft considers it necessary. Registration alone is therefore not the same as a prompt at every sign-in.[1]

Ask which policy actually protects staff accounts, administrators and guests. An older per-user MFA screen can show “Disabled” even when Security defaults or Conditional Access provides protection, so do not judge coverage from that label alone.[1]

For stronger protection, discuss phishing-resistant methods such as FIDO2 passkeys or security keys and Windows Hello for Business. Microsoft recommends these over methods vulnerable to remote phishing, including codes and approval prompts.[2] Start with administrators and payment approvers. Pilot registration, replacement devices and recovery before expanding. Tell staff where to report an unexpected sign-in request.

Keep powerful accounts out of everyday email

Ask for a list of administrator accounts, who owns each one and why each role is needed. Challenge broad access granted for a one-time setup job. The practical least-privilege question is: what is the smallest permission this person needs to do today's work?

Microsoft recommends separate accounts for administration and standard productivity tasks.[1] That means the account used to change security settings should not also be the everyday inbox used to read supplier messages.

Do not remove the last working administrator in a cleanup. Agree on emergency access and test the recovery procedure with your provider before tightening policies. Record who can authorise privileged changes and how access will be reviewed when responsibilities change.

Trace old sign-ins before blocking them

Legacy authentication does not support MFA, and Security defaults blocks legacy authentication requests.[1] Ask your provider to inspect sign-in activity and identify the actual applications and devices involved before changing access rules.

Do not treat “the copier uses email” as a complete diagnosis. Record the client, mail protocol and authentication method, then establish a supported replacement with whoever maintains the device or application. The point is to remove an unsafe sign-in dependency, not to switch off a business function blindly.

Agree on a test: send a scan, receive an application alert and confirm the intended recipient gets it. Schedule the change when someone can troubleshoot. Any temporary exception should have an owner, a reason and a review deadline, not become a forgotten permanent workaround.

Make the intended recipient the default

An “Anyone” link allows access without authentication. SharePoint and OneDrive also offer “Specific people” as a default link choice, while individual sites can have tighter sharing settings than the organisation.[3] For sensitive client files, consider named recipients and view-only access unless editing is necessary.

Separate genuinely public material from internal records. Review existing links and guest access, not only the setting used for new links. Before narrowing external sharing, test with a real partner workflow. Microsoft's guidance notes that sharing restrictions can remove guest access and that OneDrive file requests depend on particular Anyone-link settings.[3]

Choose a review owner for shared project spaces. Someone should be able to explain why each outside collaborator still needs access when the project ends.

Treat arrivals and departures as access changes

For a new starter, use a role-based checklist: named account, required groups, MFA setup and a supervised first sign-in. Revisit access when someone changes jobs internally. Copying a colleague's permissions without checking them can carry old exceptions into a new account.

For a departure, agree on timing with the responsible manager. Microsoft's offboarding guidance covers preventing sign-in, preserving mailbox content, handling devices and handing over email and OneDrive data before account deletion.[4] Treat these as separate decisions, not a single delete button.

Confirm retention requirements and the plan for incoming enquiries before removing licences or deleting accounts. Give a named successor only the access needed for the handover. Do not circulate the departing person's credentials as a shortcut.

A hypothetical office review

Imagine a Cranbrook contractor with eight staff, a seasonal estimator and an external bookkeeper. This is a hypothetical example, not a StratIS customer story. The owner wants stronger sign-ins but cannot afford to interrupt quotes or invoice approvals.

A sensible first pass would check the owner's administrator access, pilot a phishing-resistant method and test the scanner before changing authentication policies. Next, the office would test named-recipient sharing with the bookkeeper and confirm who takes ownership of the estimator's files when the season ends. Each change has a business test, not just a saved setting.

Your next review, in priority order

1. Confirm coverage: identify the active sign-in policies and any unprotected accounts.
2. Protect privileged access: review administrator roles and test recovery.
3. Test dependencies: resolve old sign-ins before enforcement changes.
4. Tighten sharing: pilot recipient-specific access with a partner.
5. Assign ownership: document joiners, leavers and the next review.

Check licensing before approving the plan. Security defaults has no additional licensing requirement; Conditional Access requires at least Microsoft Entra ID P1 and offers more control. Moving between them requires a coordinated replacement of protections, not simply disabling the baseline.[1] Ask your current IT provider for the proposed settings, licence implications, likely disruption, test results and rollback plan. The useful outcome is a safer working day that staff can actually sustain.