The default configuration in Microsoft 365 prioritises ease of use over protection. External sharing is enabled. Legacy authentication protocols that bypass multi-factor authentication are left open. Anti-phishing policies run at basic levels that miss impersonation attacks. For a UK business handling client data, financial records, or patient information, those defaults are a standing invitation.
Phishing remains the most common entry point for ransomware and business email compromise. Over half of ransomware incidents begin with a phishing email. Once an attacker has valid Microsoft 365 credentials, they look like a legitimate user. They move through SharePoint, OneDrive, and Teams without triggering the alerts that traditional endpoint tools rely on.
This guide covers the four areas where UK businesses most often leave the door open. It is written for decision-makers, not just IT teams. The goal is simple: understand what needs fixing, and know what questions to ask before someone else exploits the gap.
The Vulnerabilities Hiding in Your Default Configuration
Microsoft’s own audit data tells a consistent story. Across 200+ enterprise tenant audits, MFA was not enforced for all users in 60% of cases. No anti-phishing policy beyond the default existed in 65% of tenants. External sharing was unrestricted in 50%.
These are not exotic exploits. They are settings someone forgot to change.
Legacy authentication is the quiet bypass. Protocols like POP3, IMAP, and SMTP AUTH use basic authentication that cannot enforce MFA. Even if you have rolled out MFA to every user, leaving legacy protocols enabled gives an attacker a way around it. Password spray attacks target these protocols specifically because they know MFA does not apply. Blocking legacy authentication should happen before anything else.
Admin roles are handed out too freely. Microsoft alerts when a tenant has more than five Global Administrators. Many UK SMEs have no idea where that limit sits. If a Global Admin account is compromised through a routine phishing email, the attacker inherits control of the entire tenant. The fix is Privileged Identity Management, which grants admin rights only when needed and revokes them immediately after.
Mailbox forwarding rules are a favourite persistence trick. After compromising an account, attackers create hidden rules that forward emails to an external address or move security alerts out of the inbox. Research found that roughly 10% of compromised accounts had malicious mailbox rules created after access, with one rule created just five seconds after takeover. Auto-forwarding to external domains should be off by default unless there is a documented business reason.
External sharing defaults favour convenience. SharePoint and OneDrive allow “Anyone with the link” sharing by default. That link can be forwarded anywhere, and the sender does not need to be authenticated to open it. For businesses holding sensitive data, the default should be specific people, not anyone.
MFA and Conditional Access: The Foundation You Cannot Skip
Multi-factor authentication is the single most effective control you can enable. But MFA alone is not enough anymore.
Push bombing attacks send repeated MFA prompts until a tired user approves one. Adversary-in-the-middle phishing can steal session tokens after MFA has been completed. The type of MFA matters. For administrators and high-risk users, phishing-resistant methods like FIDO2 security keys or Windows Hello for Business should be the standard.
Conditional access is where MFA becomes intelligent. Instead of prompting for MFA every time or never, conditional access evaluates context. Is the sign-in from a known location? Is the device compliant? Is the user’s risk level elevated? The policy engine then decides whether to grant access, require additional verification, or block entirely.
A baseline set of conditional access policies for a UK business should include:
- Require MFA for all users, with emergency break-glass accounts excluded. Test in report-only mode for two to four weeks before enforcing, or you will lock people out.
- Block legacy authentication protocols entirely. There is almost no legitimate business reason to keep POP or IMAP open in 2026.
- Require compliant or hybrid-joined devices for access to sensitive applications like SharePoint and Exchange Online.
- Block sign-ins from high-risk locations or unknown countries where your business does not operate.
- Apply sign-in frequency controls so users re-authenticate periodically, but exclude shared devices like Teams phones that cannot complete interactive MFA.
If you are on Microsoft 365 Business Premium, conditional access is included. If you are on Business Standard or Basic, you do not have it. That licensing gap is one of the reasons Business Premium has become the recommended baseline for UK SMEs that handle any sensitive data.
Defender for Office 365: Turning On the Protection You Already Own
Many UK businesses are paying for Microsoft Defender for Office 365 without realising it. Business Premium includes Plan 1. E3 and E5 include Plan 2. But the features are not fully active until someone configures them.
Safe Attachments detaches email attachments in a sandbox before delivery. If a document contains a malicious macro or an executable payload, it is blocked before the user ever sees it. This is the primary defence against ransomware delivered by email.
Safe Links rewrites URLs in emails and checks them at the moment of click. A link that looked harmless when the email arrived might redirect to a phishing site hours later. Safe Links catches that change.
Anti-phishing policies need tuning beyond the default. Impersonation protection should be configured for your executives, your finance team, and your own domain name. Attackers spoof the display name of a director and email accounts payable asking for a bank change. The default policy does not block that. A tuned policy does.
Email authentication records are not optional. SPF, DKIM, and DMARC tell receiving servers whether an email claiming to be from your domain is legitimate. Without them, anyone can spoof your domain and target your clients. DMARC should progress from monitoring (p=none) to quarantine, then to reject, once you have confirmed legitimate senders are authenticated.
If you are on Business Premium and have not touched Defender settings, you are paying for protection you are not receiving.
The Internal Security Audit: What to Check Before Someone Else Does
You do not need a six-figure consultancy engagement to find the biggest gaps. A structured internal review covers the essentials in a day.
Start with Microsoft Secure Score. It is not perfect, and it does not surface every critical issue, but it gives a baseline percentage and a prioritised list of recommendations. Anything below 50% means there are fundamental configurations still missing.
Check these five areas in order of impact:
Identity. How many Global Administrators exist? More than five is a warning. Are all users covered by MFA through Conditional Access, or are there exceptions nobody documented? Are legacy authentication protocols blocked?
Email. Is DMARC set to reject or quarantine? Is auto-forwarding to external domains disabled? Are Safe Attachments and Safe Links enabled for all users? Is there an anti-phishing policy with impersonation protection for key people?
Sharing. What is the default SharePoint and OneDrive link type? Can users share anonymously? Are guest accounts reviewed regularly or left active indefinitely?
Devices. Are company laptops and phones enrolled in Intune? Are compliance policies enforcing encryption and screen locks? Can unmanaged devices access sensitive files?
Audit logs. Is unified audit logging enabled? What is the retention period? The default may not be long enough for UK GDPR or sector-specific requirements. A log nobody reads is not a control.
Fix the findings in priority order. MFA and legacy authentication first. Then email authentication and Defender policies. Then sharing controls and device compliance. The exact sequence matters less than starting.
Where Syncriti Comes In
Syncriti works with UK businesses that need Microsoft 365 to be secure without becoming unusable. We run security audits against the configurations covered in this guide. We identify the gaps in your tenant. We implement the fixes without disrupting your team’s daily work.
Whether you need MFA and Conditional Access rolled out properly, Defender for Office 365 configured beyond the defaults, or a full security review before a client audit, we handle the technical work so you can focus on the business.
Get a free consultation at syncryti.co.uk and find out where your Microsoft 365 environment stands.
Frequently Asked Questions
Is Microsoft 365 already secure by default?
No. Microsoft 365 includes built-in security features, but the default configuration prioritises ease of use. MFA is not enforced for all users, legacy authentication protocols remain open, external sharing allows anonymous links, and anti-phishing policies run at basic levels. Security requires deliberate configuration.
What is the single most important Microsoft 365 security setting?
Enforcing MFA for all users through conditional access, with legacy authentication blocked. This closes the most common attack path. Once that is in place, configure Defender for Office 365 Safe Attachments and Safe Links, then tune anti-phishing policies for impersonation protection.
Does Microsoft 365 Business Premium include Defender for Office 365?
Yes. Business Premium includes Defender for Office 365 Plan 1, which covers safe attachments, safe links, and anti-phishing policies. Business Standard and Basic do not include these features. This is one of the main reasons Business Premium is recommended for UK SMEs handling sensitive data.
How often should we run a Microsoft 365 security audit?
At least annually, and after any major change such as a migration, a new user group, or a staff departure. Microsoft’s own Secure Score changes as new features are released, so a yearly review ensures you are not running an outdated configuration.
Can Syncriti help if we do not have an internal IT team?
Yes. Syncriti provides managed Microsoft 365 security and administration services for UK businesses without dedicated IT staff. We handle the configuration, monitoring, and ongoing hardening of your tenant as a co-managed or fully managed service.
