Microsoft 365 is where your email, files, identity and business conversations live. The default setup is not enough for a growing SME.
Published: 12 June 2026
Most businesses think of Microsoft 365 as email and Office apps. Attackers think of it as identity, data, payments, conversations and permission to move around quietly. That is why the baseline matters.
A secure Microsoft 365 tenant is not built by turning on one setting and declaring victory. MFA helps, but MFA on its own is not a strategy. The work is in the policy, the exceptions, the monitoring and the boring little controls that stop a normal account compromise becoming a company-wide problem.
Your Microsoft 365 account is now the front door to the business. Every user should have MFA, but the better question is whether sign-in is being judged properly. Conditional Access should look at risk, location, device state, application and role before granting access.
For administrators and high-risk users, phishing-resistant MFA should be part of the plan. Push notifications alone can be worn down by repeated prompts. A good baseline removes the easy wins for attackers rather than hoping users will spot every trick.
One of the most overlooked Microsoft 365 risks is third-party app consent. A user can be tricked into granting an application access to mailbox, files or profile data. No password theft required. No dramatic malware moment. Just a polite-looking consent screen and a bad decision.
SMEs should normally disable user consent to unverified apps, use an admin consent workflow and review existing enterprise applications. If nobody can explain why an app has access to mail or files, it needs investigating.
External forwarding should be blocked unless there is a clear business reason. Mailbox rules should be monitored. SPF, DKIM and DMARC should be configured properly. These controls are not exotic; they are part of running email responsibly.
Attackers love quiet persistence. A mailbox rule that forwards invoices or hides replies can cause real damage without ever setting off the kind of alarm people imagine when they hear the word cyber.
Admin accounts should be separate from daily user accounts, protected with stronger authentication and limited to the permissions actually needed. Break-glass access should exist, but it should be documented, monitored and kept for emergencies.
Shared admin logins and unknown legacy accounts are usually signs that nobody has owned the tenant properly for a while. That is fixable, but it needs deliberate cleanup rather than another licence purchase.
Microsoft 365 security is weaker if unmanaged personal devices can access company data without restriction. A sensible baseline uses Intune or equivalent controls to separate trusted devices from unknown devices, apply compliance rules and protect business data if a laptop is lost or an employee leaves.
The baseline is not finished when the settings are changed. Sign-in logs, risky users, admin role changes, mailbox forwarding and suspicious app grants need review. If nobody is looking, you do not have monitoring; you have logs.
NorthMSP builds Microsoft 365 around secure defaults, clear admin ownership and practical governance. If you are not sure where your tenant stands, start with a free health check.
Book a free security and IT health check or read more about our Microsoft 365 baseline management.
Most aren’t — and nobody finds out until something happens. We’ll check yours against a known-good baseline and write up what we find.