A new Microsoft 365 subscription arrives. Email works. Files are accessible. Teams is ready. From the user perspective, everything is functional. From a security perspective, that setup is usually also the weakest version of itself.

The problem most SMEs face is not that Microsoft 365 is insecure. It is that the default configuration is designed for convenience, not for a business that needs to demonstrate defensible controls to an insurer, a prospective client, or a government contract evaluator. The settings that matter most are rarely the first things a non-technical administrator touches.

This article does not assume you are a Microsoft 365 engineer. It lays out the priorities that actually matter for a 10–25 seat business and explains what each one means for your day-to-day operations and long-term security posture.

Why Configure First Matters for SMEs

Microsoft 365 includes substantial built-in security. Anti-phishing, anti-spam, and anti-malware protection are included across all plans. Microsoft Business Premium goes further, adding device management, advanced email threat protection, and data loss prevention. Microsoft's own best-practice guidance identifies ten priority areas for securing business data with the platform. (Microsoft Learn)

But built-in features only protect what is turned on and configured correctly. An unconfigured M365 tenancy leaves shared settings too open, admin accounts unprotected, and devices outside any management boundary. The NCSC's guidance on using SaaS securely is clear: even when a platform provides security by default, your organisation still needs to configure, manage, and maintain how your tenancy is used. (National Cyber Security Centre)

The practical consequence for an SME is that initial configuration decisions lock in a security baseline for months or years. A poor first setup creates false confidence. A careful one creates a foundation that gets easier to maintain over time.

The Priority Order: What to Configure First

The following sequence reflects what each control protects, what risk it addresses, and how dependent later steps are on earlier ones. The order is not arbitrary — it follows the chain of risk.

1. Identify and protect administrative accounts

Administrative accounts sit at the top of the M365 permission hierarchy. If a standard user account is compromised, the damage is usually contained to that user's data and access. If an admin account is compromised, the attacker controls the configuration layer — the settings, policies, and permissions that protect everyone else.

Microsoft recommends creating dedicated, privileged cloud-based administrative accounts rather than using personal Microsoft accounts for admin work. Those admin accounts should sit behind stronger authentication controls than standard user accounts. (Microsoft Learn)

For an SME, the practical step is straightforward: identify every account with an administrative role, confirm each one has multi-factor authentication enforced, and ensure the accounts are not shared or used for personal logins. This takes minutes to audit and dramatically reduces your tenancy's blast radius.

What this means for your business: If someone credentials the main administrator's account through a phishing email, the attacker still cannot sign in without the second authentication factor. Protecting admin accounts first is the single most effective way to keep the door locked.

2. Enforce multi-factor authentication for every user

Microsoft's security defaults — which are enabled by default for most new Microsoft 365 tenants — require every user to register for multi-factor authentication and apply stronger protection for administrator accounts. (Microsoft Learn)

The M365 security baseline only works if identity is genuinely protected. Without MFA across all users, credential theft becomes the most likely attack path. Microsoft also keeps separate attention on legacy authentication protocols, which can sit outside the controls most people assume are already blocking unauthorised access. (Microsoft Learn)

The verification question is simple: can you confirm, today, that every single user in the organisation — including owners, contractors, and service accounts — has MFA enforced with no exceptions? If the answer is "I think so" rather than "yes," that is a gap.

What this means for your business: No user account, regardless of access level, can be compromised through a stolen password alone. This is the single most impactful configuration change in the platform.

3. Block legacy authentication

Legacy authentication refers to older authentication protocols that do not support modern security controls such as multi-factor authentication. Protocols like Basic authentication in Outlook, some POP/IMAP configurations, and older API access methods bypass MFA entirely.

Even when MFA is enforced for modern authentication, legacy authentication can serve as a backdoor that attackers use to bypass those protections. Microsoft has been deprecating Basic authentication for several years, but many SME tenancies still have it enabled — or applications still use it without anyone noticing.

Disabling legacy authentication ensures there is no protocol path into your tenancy that skips your MFA standard. (Microsoft Learn)

What this means for your business: If a legacy authentication path was open, attackers may have been able to compromise accounts without triggering MFA even though it appeared to be "on." Blocking this path removes that blind spot.

4. Configure security defaults and preset security policies

Microsoft's security defaults cover a broad set of baseline protections — MFA enforcement, blocking legacy authentication, restricting guest access, and enabling built-in anti-phishing controls. For most SMEs, enabling these defaults delivers substantial protection with minimal configuration effort. (Microsoft Learn)

Business Premium customers additionally have access to Microsoft's preset security policies, which bundle Defender for Office 365 capabilities including Safe Links, Safe Attachments, impersonation protection, and anti-phishing thresholds. Microsoft recommends these presets as a structured starting point for SMEs rather than configuring individual threat policies from scratch. (Microsoft Defender for Office 365)

What this means for your business: Preset security policies give you the equivalent of a security baseline without requiring expertise in each individual control. They are designed for organisations that need strong protection but do not have a dedicated security team.

5. Establish device management controls

Device management ensures that every computer and mobile device accessing company data meets your organisation's security standards. Microsoft Intune, included with Business Premium, provides device management capabilities — and Basic Mobility and Security, included with all business plans, provides basic mobile device management. (Microsoft Learn)

The SME question here is not whether device management exists in the platform. It is whether devices are actually enrolled, whether compliance policies are defined, and whether non-compliant devices are blocked from accessing business resources. Many SMEs have device management available but are using only a fraction of what it can do.

What this means for your business: When devices are managed to a standard, you know which machines are accessing your data, which ones are unpatched, and which ones fall outside your security controls. Management creates visibility; visibility creates control.

6. Set file sharing and external access policies

Microsoft 365's file sharing defaults — on OneDrive and SharePoint — often lean toward convenience. External sharing may be permitted to anyone with a link, or organisations may lack clear boundaries on which files can be shared outside the tenancy.

Microsoft recommends reviewing sharing settings as part of your security configuration, using sensitivity labels and Data Loss Prevention (DLP) policies where available to classify and control how sensitive content moves. (Microsoft Learn)

What this means for your business: If a file shared externally through a link ends up in the wrong hands, the damage is not always from a breach — it can be from an accidental over-share. Defining clear sharing boundaries reduces that risk and strengthens your position when insurers or clients ask about data controls.

7. Review and maintain the configuration

Configuration is not a one-off task. The NCSC guidance on SaaS security emphasises that organisations need to manage and maintain how their tenancy is used over time. Microsoft's best-practice guidance similarly stresses environment maintenance — reviewing admin roles, checking user activity, monitoring Secure Score, and validating that policies have not drifted. (Microsoft Learn)

What changes at the SME level is not constant reconfiguration. It is a manageable cadence: quarterly reviews of admin accounts, user activity logs, sharing settings, and any exceptions that were added and never cleaned up. This is maintenance, not overhaul.

How Does Microsoft 365 Configuration Support Cyber Essentials?

Cyber Essentials is built around five technical controls: firewalls and internet security, secure configuration, user access control, encryption, and security update management. A Microsoft 365 environment does not automatically satisfy those controls just because the platform includes security features — the organisation must configure those features to align with the control requirements.

Secure configuration in Microsoft 365 (admin account protection, MFA enforcement, legacy authentication blocks, device policies) maps directly to the second Cyber Essentials control. User access control maps to the third. Security update management is addressed through Microsoft's update cadence combined with device management policies.

This is not about learning Cyber Essentials to pass an assessment. It is about recognising that the platform's built-in security, when properly configured, aligns closely with what the UK government recommends as a baseline for SMEs. (GOV.UK — Cyber Essentials)

What to Do After the Initial Setup

Once the foundational controls are in place, the focus shifts to maintenance and visibility. Microsoft's Secure Score provides a scoring framework that tracks your configuration posture and suggests prioritised improvements. Monitoring that score and acting on the highest-impact recommendations is a practical way to maintain progress without needing to understand every individual setting.

A structured approach also means establishing ownership. Someone in the organisation — or a trusted external partner — should be responsible for reviewing admin accounts quarterly, verifying that MFA coverage is complete, checking that sharing settings have not drifted, and ensuring new users are brought in to the same standard as existing ones. Without that ownership, even a well-configured baseline will decay.

The flow continues naturally into a maintained environment where joiner, mover, and leaver processes are automated, device compliance is enforced, and the configuration baseline is a living standard rather than a snapshot from when the subscription was first activated. (Microsoft Learn)

FAQs

Should I configure Microsoft 365 security myself or get outside help?

If you have someone in the organisation who understands M365 admin settings, you can apply the basics. The risk is knowing what matters most and having the discipline to review configurations over time. For most 10–25 seat SMEs, a short professional review of the initial setup is more cost-effective than fixing drifted configuration months later.

How long does the initial security configuration take?

The foundational steps — admin account protection, MFA enforcement, legacy authentication blocks, and security defaults — can typically be completed in a single session, often within a few hours. Device management setup depends on how many devices need to be enrolled. The important point is that the configuration is structured, not ad-hoc.

What happens if we only configure half of these controls?

Partial configuration creates uneven protection. MFA without blocking legacy authentication leaves a bypass. Device management without admin account protection leaves the management layer exposed. The controls work as a system, so skipping earlier priorities undermines later ones.

Can we add these controls later if we launch M365 first?

Yes, but every day of unconfigured operation is a day of higher exposure. There is no advantage to delaying configuration for convenience, especially since changing settings after users have been active in the tenancy introduces additional complexity — such as ensuring existing users migrate to modern authentication and that admin accounts are already secured before tightening controls.

How often should we review our Microsoft 365 security settings?

A practical cadence for SMEs is quarterly. Review admin accounts, verify MFA coverage, check for any new sharing exceptions, and look at Secure Score for any significant changes. This takes 30–60 minutes and keeps the baseline from drifting.