How to Secure Microsoft 365 for a Small Business in Australia

Why M365 defaults leave you exposed

Microsoft 365 is the most widely used cloud platform for Australian small businesses — and the most commonly misconfigured. When your IT provider set up your tenant, they almost certainly accepted the defaults. Those defaults prioritise ease of access over security.

The common problems: MFA is not enforced on every account, external sharing is wide open, external mail forwarding has never been explicitly switched off (a classic business email compromise vector), and admin accounts are used for day-to-day work.

Small businesses that reported cybercrime to ASD in 2024-25 lost an average of $56,600 per report, and email compromise and business email compromise fraud were the two most common cybercrimes businesses reported (ASD Annual Cyber Threat Report 2024-25).

The M365 Secure Score — your starting point

Microsoft provides a free security dashboard called Secure Score. Go to security.microsoft.com and click Secure Score in the left navigation. It shows your tenant's score as a percentage and lists specific recommended actions in priority order.

Use Secure Score as your progress tracker: note your current score, then return after each change to see the improvement.

Priority 1: Multi-factor authentication

MFA is the single most impactful security change you can make in M365. ASD calls it one of the most effective controls an organisation can implement to keep attackers out of its systems (ASD: Implementing multi-factor authentication).

1. With Business Premium: in the Microsoft Entra admin centre (entra.microsoft.com), go to Conditional Access and create policies from Microsoft's templates to require MFA for all users and block legacy authentication.
2. Without Conditional Access: turn on security defaults under Entra ID → Overview → Properties → Manage security defaults. They are free on every plan, require everyone to register for MFA and block legacy sign-ins (Microsoft). Use one or the other, not both.
3. Tell your team they will need to set up the Microsoft Authenticator app on their next sign-in.

Priority 2: Disable legacy authentication

Legacy authentication cannot do MFA, so a stolen password is enough to use it. Microsoft has switched off Basic authentication in Exchange Online for POP, IMAP, ActiveSync and the other mail protocols, but SMTP AUTH is still available until its announced retirement (Microsoft). Security defaults or a Conditional Access policy block legacy sign-ins across the whole tenant.

Warning: before disabling legacy auth, check whether any devices or applications in your business are using it. Older printers, scanners, and some third-party apps that send email via SMTP AUTH will stop working. Inventory these first.

Priority 3: Review and restrict admin roles

Most small businesses have too many accounts with Global Administrator privileges. Global Admin can do anything in your M365 tenant — including deleting all your data and changing security settings.

The principle is least-privilege: give people only the access they need to do their job. For most small businesses, you need one or two Global Admin accounts maximum.

Priority 4: Configure mail flow and anti-phishing rules

Microsoft Defender for Office 365 (included in Business Premium) adds Safe Links, Safe Attachments and impersonation protection. Its Built-in protection policy switches on Safe Links and Safe Attachments by default, but impersonation protection needs setting up. Review these in the Microsoft Defender portal at security.microsoft.com → Email & collaboration → Policies & rules → Threat policies:

• Anti-phishing policy: Enable impersonation protection for your executives and domains, or apply the Standard preset security policy.
• Safe Links and Safe Attachments: Confirm Built-in protection or a preset policy covers every user.
• DMARC, DKIM, SPF: Ensure your domain has these email authentication records configured.

Priority 5: External sharing and SharePoint settings

By default, M365 SharePoint and OneDrive allow unrestricted external sharing. Recommended settings:

• Set external sharing to New and existing guests (requires sign-in) rather than Anyone (anonymous access)
• Require guests to authenticate with a one-time passcode
• Set link expiration — external sharing links should expire after 30 days

M365 licensing — what you need

For most small businesses, Microsoft 365 Business Premium covers all the security controls you need (current prices on Microsoft's plan comparison). If you are on Business Basic or Business Standard, it is usually worth pricing the upgrade purely from a security perspective.