Why Default Microsoft 365 Settings Aren’t Enough
Microsoft 365 is the most widely used productivity platform in Australia — and the most targeted. Business Email Compromise (BEC) attacks cost Australian businesses hundreds of millions of dollars each year, and the vast majority exploit misconfigured or under-secured Microsoft 365 tenants.
The problem is that M365 ships with settings optimised for ease of use, not security. Legacy authentication protocols are often left enabled. MFA isn't enforced by default on older tenants. Sharing settings in SharePoint allow external access more broadly than most businesses realise. And Microsoft Defender — which is included in many M365 plans — is rarely configured properly.
The good news: most of these issues are fixable without additional cost, just proper configuration. Here's the complete checklist.
Microsoft's own data shows that accounts without MFA are 99.9% more likely to be compromised. In Australia, BEC (Business Email Compromise) attacks — which almost always start with a compromised M365 account — result in an average loss of over $50,000 per incident.
The Microsoft 365 Security Checklist
Enable Multi-Factor Authentication for All Users
This is non-negotiable. MFA should be enforced for every user in your organisation — not just admins. Use Microsoft Authenticator (push notifications) as the default method, and avoid SMS-based MFA where possible as it's vulnerable to SIM-swapping attacks.
Configure Conditional Access Policies
Conditional Access is Microsoft's intelligent access control — it evaluates every sign-in attempt against a set of conditions before granting access. At minimum, you should block access from high-risk sign-ins, require MFA for all cloud apps, and block legacy authentication protocols (which bypass MFA entirely).
Block Legacy Authentication
Legacy authentication protocols (Basic Auth, IMAP, POP3, SMTP Auth) don't support MFA — meaning any attacker with a stolen password can bypass your MFA entirely using these protocols. Microsoft has been deprecating them, but they may still be enabled on older tenants. Block them via Conditional Access or Authentication policies.
Enable Microsoft Defender for Business
Microsoft Defender for Business (included in M365 Business Premium) provides endpoint detection and response (EDR) across all your devices. It goes far beyond Windows Defender antivirus — offering behavioural analysis, automated investigation, and threat remediation. It must be actively configured; it doesn't protect you out of the box.
Configure Anti-Phishing and Anti-Spoofing Policies
Microsoft Defender for Office 365 includes powerful anti-phishing capabilities that go well beyond basic spam filtering. Enable impersonation protection (which flags emails pretending to be your executives), enable mailbox intelligence, and configure Safe Links and Safe Attachments to scan all incoming email content before delivery.
Set Up Email Authentication (SPF, DKIM, DMARC)
SPF, DKIM, and DMARC are DNS-based email authentication standards that prevent attackers from spoofing your domain — sending emails that appear to come from your business. Many Australian businesses have SPF configured but are missing DKIM and DMARC, which leaves them vulnerable to domain spoofing attacks that target their clients and suppliers.
Review and Restrict SharePoint & OneDrive Sharing
By default, SharePoint and OneDrive allow sharing with anyone who has a link — including external users and anonymous access. For most businesses this is far too permissive. Set external sharing to "New and existing guests only" at minimum, disable "Anyone with the link" sharing, and audit existing shared links regularly.
Enrol Devices in Microsoft Intune
Intune is Microsoft's device management platform — it ensures that only compliant, managed devices can access your M365 data. With Intune, you can enforce encryption (BitLocker), require screen lock PINs, remotely wipe lost or stolen devices, and push security configurations to all devices automatically. This is essential for any business with remote workers or personal devices accessing company data.
Enable Unified Audit Logging
Microsoft 365 logs a huge amount of activity — sign-ins, email access, file downloads, admin changes — but audit logging must be explicitly enabled. Without it, you have no forensic trail when something goes wrong. Enable unified audit logging and set your retention period to at least 90 days (180 days recommended for professional services firms).
Restrict Global Administrator Access
Global Admin accounts have unrestricted access to your entire M365 environment. There should be no more than 2–4 Global Admin accounts in any organisation, they should never be used for day-to-day work, and they should be protected with phishing-resistant MFA (hardware security keys or certificate-based authentication). Use Privileged Identity Management (PIM) for just-in-time admin access where possible.
Which Microsoft 365 Plan Do You Need?
Not all M365 plans include the same security features. Here's what matters for Australian SMBs:
For most Melbourne businesses handling sensitive client data — accounting firms, law practices, medical centres, real estate agencies — Microsoft 365 Business Premium is the minimum recommended plan. The additional cost over Business Standard (~$11/user/month) is far less than the cost of a single security incident.
Upgrading to Business Premium is straightforward and can be done mid-subscription without losing any data or settings. Your managed IT provider can handle the migration with zero downtime. The security features you unlock — particularly Conditional Access, Intune, and Defender for Business — are worth the upgrade for any business handling sensitive information.
How Does This Relate to Essential Eight?
Microsoft 365, when properly configured, directly addresses several Essential Eight controls:
A well-configured Microsoft 365 Business Premium tenant gets you a significant part of the way to Essential Eight Maturity Level 2 — which is one of the reasons we recommend it as the baseline for Melbourne professional services firms. Read our Essential Eight compliance guide for the full picture.
Getting Your M365 Tenant Audited
The fastest way to find gaps in your Microsoft 365 configuration is a Microsoft Secure Score review combined with a manual audit by an experienced M365 specialist. Microsoft Secure Score (found at security.microsoft.com) gives you a score out of 100 and specific recommendations — but it doesn't prioritise them or explain the business impact.
At Melbits, we manage Microsoft 365 across 80+ Melbourne client tenants. We offer a free initial consultation that includes a high-level review of your M365 security posture and a prioritised list of quick wins — most of which cost nothing to implement, just proper configuration.