Most small businesses in Australia now run on Microsoft 365. Email, files, Teams, the lot. It’s a well-built platform with serious security tools behind it. But a large share of the incidents we hear about don’t come from a flaw in Microsoft’s code. They come from the way a tenant was set up on day one and never revisited: a shared admin password, MFA switched off “because it was annoying”, a mailbox rule nobody noticed forwarding invoices to a stranger.
The good news is that the fixes are well understood, and most of them are already in the licence you’re paying for. Here are the Microsoft 365 security basics we check first, in roughly the order we’d tackle them.
1. Multi-factor authentication for everyone, not just the boss
If you do one thing after reading this, make it this. Multi-factor authentication (MFA) means a stolen password on its own isn’t enough to get into an account. Microsoft has been tightening the screws here too: it now requires MFA to sign in to its admin portals, including the Microsoft 365 admin center. That protects the people running the tenant. It doesn’t automatically protect your staff mailboxes, and those are what attackers usually go after.
Use the Microsoft Authenticator app rather than text-message codes where you can, and make sure every account is covered: shared mailboxes people sign in to, the reception login, the account the bookkeeper uses once a month.
2. Security defaults or Conditional Access: pick one, deliberately
Microsoft gives every tenant a free option called security defaults. Switched on, it requires everyone to register for MFA, enforces MFA for administrators and blocks older sign-in methods that can’t do MFA at all. Newer tenants have it on from the start. If yours was set up years ago, or someone turned it off, it’s worth checking.
The alternative is Conditional Access, which lets you write your own rules: require MFA everywhere except from the office, block sign-ins from countries you never work in, only allow company laptops to open sensitive files. It needs Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium but not in Business Basic or Standard. The mistake to avoid is having neither: security defaults switched off and no Conditional Access policies to replace them.
3. Fewer admins, and separate admin accounts
Global administrator is the master key to your entire business. In a ten-person company, two people should have it, and neither should use that account to read email or browse the web. Give admins a separate account for admin work and a normal account for everything else. It’s a small habit that limits the damage if a day-to-day account is ever phished. It also lines up neatly with the Essential Eight, which treats restricting administrative privileges as a core control.
4. Protect the inbox, because that’s where the money goes
Business email compromise is still one of the most common and costly attacks on Australian businesses. Someone gets into a mailbox, watches quietly, then sends a perfectly timed “our bank details have changed” email to a client. A few settings make this much harder:
- Block automatic forwarding of email to outside addresses unless there’s a business reason.
- Check for unfamiliar inbox rules, especially ones that move or delete messages containing words like “invoice” or “payment”.
- Make sure SPF, DKIM and DMARC are set up for your domain so others can’t easily send email pretending to be you.
- On Business Premium, switch on Defender for Office 365’s Safe Links and Safe Attachments, which check links and files before your staff open them.
One more housekeeping item: Microsoft is retiring “basic” password-only sign-in for SMTP AUTH, the method older printers, scanners and some business apps use to send email. The timeline has shifted more than once, so it’s worth finding anything in your office that still relies on it before it suddenly stops sending.
5. Manage the devices, not just the accounts
Your data lives on laptops and phones as much as in the cloud. Business Premium includes Microsoft Intune for device management and Defender for Business for endpoint protection. Together they let you require encryption and a screen lock, push updates, and wipe company data from a lost phone without touching someone’s personal photos. If you’re on Business Standard, you can still get a long way with good habits and a reputable antivirus, but Premium is where Microsoft 365 starts to look after devices properly.
6. Back up what Microsoft won’t
This one surprises people. Microsoft keeps its platform running, but your data is your responsibility. Its own services agreement recommends that customers regularly back up their content. Deleted items and version history help with everyday accidents, but they’re not a backup if ransomware encrypts your SharePoint library or a departing employee empties their mailbox.
Microsoft now sells its own Microsoft 365 Backup service, and there are well-regarded third-party options too. Whatever you choose, test a restore. A backup you’ve never restored is a hope, not a plan.
7. Keep an eye on what’s happening
Good Microsoft 365 security includes alerts for the things that matter: a new global admin being added, mass file deletions, sign-ins from unusual places, new forwarding rules. Then make sure the alerts go to someone who will actually read them. In many small businesses they quietly land in an unmonitored admin inbox.
8. Train people, briefly and often
Technology catches a lot, but not everything. A ten-minute session every quarter on spotting phishing, checking payment changes by phone and reporting a suspicious email beats an annual hour-long lecture nobody remembers. The goal is a team that feels comfortable saying “this looks odd” without fear of looking silly.
Microsoft 365 security: Business Standard or Business Premium?
Business Standard gives you the apps, email and file storage. Business Premium adds the security layer: Entra ID P1 with Conditional Access, Intune, Defender for Business and Defender for Office 365 Plan 1. For a business handling client data, payments or anything regulated, Premium is usually worth the difference, because the alternative is buying and managing several separate tools to get the same protection. For a two-person business with very little sensitive data, Standard with security defaults switched on can be a sensible start.
How this fits the bigger picture
The Australian Cyber Security Centre publishes a Microsoft 365 cloud security guide for small business that adapts the Essential Eight to Microsoft 365. It covers MFA, admin privileges, backups, patching, macro settings, application control and user application hardening. If you want to know where you stand, our free Essential Eight checklist takes about ten minutes.
None of this Microsoft 365 security work is glamorous. It’s a list of settings, habits and checks. But it’s the list that separates businesses that have a bad week from businesses that have a bad year.
Want a second pair of eyes on your Microsoft 365 set-up?
Sources: Microsoft Learn: mandatory MFA for admin portals · Microsoft Learn: security defaults · Microsoft Learn: Business Premium security overview · Microsoft Learn: Microsoft 365 Backup · ACSC: small business cloud security guides
