How to Secure Your Microsoft 365 Account

Published 16 June 2026 · Microsoft 365 · by the 365 Techies team — Microsoft Partners & Dell specialists, looking after Dorset since 1995

Many Microsoft 365 break-ins start the same way: a phishing email, a password typed into a fake sign-in page, and an attacker reading the mailbox for weeks before anyone notices. The good news is that the settings that stop it are mostly free and take an afternoon. Here they are in the order we apply them.

1. Multi-factor authentication for everyone, admins first

MFA is the single control that matters most: a stolen password on its own is no longer enough. In a small tenant the quickest route is Security defaults (Microsoft Entra admin centre, Properties, Manage security defaults), which makes every user register for MFA and blocks the old sign-in methods attackers rely on. Business Premium tenants can use Conditional Access instead for finer control. Use the Microsoft Authenticator app rather than text messages, and cover every admin account before anyone else. Microsoft has been phasing in mandatory MFA for its admin portals since late 2024, so an admin without it will be made to set it up sooner or later anyway.

2. Separate admin accounts, and a second admin

Nobody should read email from a Global Administrator account. Give the owner a normal licensed account for daily work and a separate, unlicensed admin account used only for admin tasks. Then make sure there are at least two admins, because a single admin who loses their phone is a lockout that can take Microsoft weeks to undo. We see it often enough to have written up what happens when the only admin is locked out.

3. Hunt for forwarding rules and rogue apps

An attacker who has been in a mailbox usually leaves something behind: an inbox rule that forwards everything to an outside address, or one that deletes messages containing the word “invoice” so the real owner never sees the replies. Check every mailbox’s rules (Outlook, Settings, Rules) and block automatic forwarding to external addresses for the whole tenant in the Defender portal’s outbound spam policy. While you are there, review Enterprise applications in Entra for anything users have granted access to that you do not recognise, and remove it.

4. Turn on the protection you already pay for

Every business plan includes Exchange Online Protection; Business Premium adds Defender for Office 365 with Safe Links, Safe Attachments and impersonation protection. Switch on the preset security policies (Standard is right for most small businesses) rather than tuning dozens of settings by hand, and add your own domain and your directors’ names to the impersonation lists so a lookalike “from the boss” email is flagged.

5. Watch the sign-ins, and clear out leavers

The sign-in logs in Entra show where each account has been used from. A sign-in from a country nobody in the business has visited is the earliest warning you will get. Check them monthly, or ask us to. And when someone leaves, block their sign-in the same day: our leaver checklist covers the rest, including keeping their mailbox without keeping a licence.

6. Back up what Microsoft does not

None of the above brings back a mailbox that a leaver emptied, or files that ransomware encrypted through a synced OneDrive folder. Microsoft’s retention is limited and time-bound; whether you need a separate Microsoft 365 backup is its own question, and for most businesses the answer is yes.

Key points

• MFA for every account, admins first, with the Authenticator app
• Separate admin accounts, and never only one admin
• Check inbox rules and block external auto-forwarding
• Turn on the preset security policies you already pay for
• Review sign-in logs monthly and block leavers the same day
• Retention is not backup: decide on a Microsoft 365 backup